3 ms·

Workaround (yes, it's client-side): # echo -e "Host *\n\tUseRoaming no\n" >> /etc/ssh/ssh_config Disclaimer: won't work on all operating systems, shells, et

Workaround (yes, it's client-side): # echo -e "Host *\n\tUseRoaming no\n" >> /etc/ssh/ssh_config Disclaimer: won't work on all operating systems, shells, etc. YMMV. Consult a doctor before following any advice you get from the Internet. Void where prohibited. Restrictions may apply. Edited per comments below

pmoriarty 11y ago
Would this work too? $ echo "UseRoaming no" >> ~/.ssh/config
- Zr40 11y ago
  Yes, but it would not apply to other users.
- iamtew 11y ago
  Yes, but it'll only affect that user.
  - ralphm 11y ago
    And only the last `Host` entry in that config, if present.
doogle88 11y ago
Presumably you would have to connect to a malicious host to be effected? Or perhaps a MITM on your connection to a legit host can exploit you somehow.
- masklinn 11y ago
  > Presumably you would have to connect to a malicious host to be effected? Malicious or compromised. > roaming code in the ssh client could be tricked by a hostile sshd server, potentially leaking key material.
- amatix 11y ago
  From the updated OP: > The authentication of the server host key prevents exploitation by a man-in-the-middle, so this information leak is restricted to connections to malicious or compromised servers.
  - jon-wood 11y ago
    Malicious, compromised, or new servers. Because really, how many people check the host key for a newly spun up EC2 instance?
ralphm 11y ago
Don't ever fix your `ssh_config` by appending stuff to the end of the file. The configuration syntax allows for block constructs without an explicit end marker (like `Match` and `Host`). Appending will cause all kinds of sadness.
- gnur 11y ago
  It's from the linked page.
  - ralphm 11y ago
    Indeed. The page gives bad advise. If your config has `Host` blocks, like often in people's personal configs, or if you have a `Match` block, the new directive only applies to the last of those blocks in the config file.
    - snowwrestler 11y ago
      Sufficient to place it at the top of ~/.ssh/config? Or does it also need a block header of its own, like: Host * UseRoaming no
      - skuhn 11y ago
        I confirmed that it does not need to be placed into a Host block, as long as it is above all of your blocks. For instance: UseRoaming no Host * Blah yes Test with: ssh -v remote.ssh.host.com uptime 2>&1 | grep -i roaming If it returns nothing, the config fix is active. If it isn't active, you'll see 'debug1: Roaming not allowed by server'
    - jldugger 11y ago
      Which is why they're appending a newline and Host *?
      - ralphm 11y ago
        Note that the example was changed as a result of my initial comment.
narsil 11y ago
I'm emailing the one-liner to folks and found it helpful to just include the root subshell: sudo bash -c 'echo -e "Host *\n\tUseRoaming no\n" >> /etc/ssh/ssh_config'

pmoriarty 11y ago

Would this work too? $ echo "UseRoaming no" >> ~/.ssh/config

Zr40 11y ago
Yes, but it would not apply to other users.
iamtew 11y ago
Yes, but it'll only affect that user.
- ralphm 11y ago
  And only the last `Host` entry in that config, if present.

doogle88 11y ago

Presumably you would have to connect to a malicious host to be effected? Or perhaps a MITM on your connection to a legit host can exploit you somehow.

masklinn 11y ago
> Presumably you would have to connect to a malicious host to be effected? Malicious or compromised. > roaming code in the ssh client could be tricked by a hostile sshd server, potentially leaking key material.
amatix 11y ago
From the updated OP: > The authentication of the server host key prevents exploitation by a man-in-the-middle, so this information leak is restricted to connections to malicious or compromised servers.
- jon-wood 11y ago
  Malicious, compromised, or new servers. Because really, how many people check the host key for a newly spun up EC2 instance?

ralphm 11y ago

Don't ever fix your `ssh_config` by appending stuff to the end of the file. The configuration syntax allows for block constructs without an explicit end marker (like `Match` and `Host`). Appending will cause all kinds of sadness.

gnur 11y ago
It's from the linked page.
- ralphm 11y ago
  Indeed. The page gives bad advise. If your config has `Host` blocks, like often in people's personal configs, or if you have a `Match` block, the new directive only applies to the last of those blocks in the config file.
  - snowwrestler 11y ago
    Sufficient to place it at the top of ~/.ssh/config? Or does it also need a block header of its own, like: Host * UseRoaming no
    - skuhn 11y ago
      I confirmed that it does not need to be placed into a Host block, as long as it is above all of your blocks. For instance: UseRoaming no Host * Blah yes Test with: ssh -v remote.ssh.host.com uptime 2>&1 | grep -i roaming If it returns nothing, the config fix is active. If it isn't active, you'll see 'debug1: Roaming not allowed by server'
  - jldugger 11y ago
    Which is why they're appending a newline and Host *?
    - ralphm 11y ago
      Note that the example was changed as a result of my initial comment.

narsil 11y ago

I'm emailing the one-liner to folks and found it helpful to just include the root subshell: sudo bash -c 'echo -e "Host *\n\tUseRoaming no\n" >> /etc/ssh/ssh_config'