3 ms·
Just a note: the default AWS Linux AMI doesn't seem to have this problem on the server side. Connecting to one of my EC2 instances with verbose on I get the fo
by Corrado 11y ago
Just a note: the default AWS Linux AMI doesn't seem to have this problem on the server side. Connecting to one of my EC2 instances with verbose on I get the following message:
debug1: Roaming not allowed by server
Yeah! AWS Linux for the win. :)
- aexaey 11y agoThis is client-only vulnerability: The matching server code has never been shipped, but the client code was enabled by default and could be tricked by a malicious server into leaking client memory to the server, including private client user keys.[1] [1] https://lists.mindrot.org/pipermail/openssh-unix-dev/2016-January/034680.html https://lists.mindrot.org/pipermail/openssh-unix-dev/2016-Ja...
- deleted 11y ago[deleted]
- Skunkleton 11y agoOpenSSH server doesn't support roaming. This is a client only issue. The problem is that your connection could be MITM'd by someone looking to exploit this bug.
- hackuser 11y ago> your connection could be MITM'd MITM isn't a risk, if I understand this statement in the undeadly.org announcement: The authentication of the server host key prevents exploitation by a man-in-the-middle, so this information leak is restricted to connections to malicious or compromised servers.
- kardos 11y agoUnless it's your first connection to a legit uncompromised server, yes? (AWS instance, etc)
- tomku 11y agoThat message actually means that your client has roaming enabled and is therefore vulnerable.
- deleted 11y ago[deleted]