6 ms·
Does this affect mosh?
by rnhmjoj 11y ago
Does this affect mosh?
- fulafel 11y agoNo, the roaming in Mosh is unrelated to OpenSSH's roaming feature.
- sneak 11y agoIrrelevant; it still affects mosh as mosh does an ssh connection first to do auth and key exchange. That ssh session is potentially vulnerable when connecting to a malicious or compromised host.
- TazeTSchnitzel 11y agoDoesn't mosh initially establish a connection via SSH, though?
- teamhappy 11y agoBut Mosh uses OpenSSH for authentication. And if roaming is enabled by default on the client this could still be an issue, no? I'd say it's still a good idea to add "UseRoaming no" to ssh_config.
- rakoo 11y agoBut authentication in Mosh still relies on OpenSSH, so auth could be intercepted by an attacker after which Mosh is completely open to them: https://mosh.mit.edu/ https://mosh.mit.edu/ > However, in typical usage, Mosh relies on SSH to exchange keys at the beginning of a session, so Mosh will inherit the weaknesses of SSH—at least insofar as they affect the brief SSH session that is used to set up a long-running Mosh session.
- XMPPwocky 11y agoRight, but mosh uses ssh for initial key setup. I suspect it is possible to exploit that. (As an occasional Windows user who's using the Mosh Chrome extension, I have no idea how much risk I'm at; can't edit ssh_config, it's not even exposed)
- sneak 11y agoYes; mosh depends on ssh to set up the connection (auth and initial key exchange).