3 ms·

The usual warning sign here. Be careful when SSHing into hosts you do not know with an unpatched version of OpenSSH: http://cve.mitre.org/cgi-bin/cvename.cgi?

The usual warning sign here. Be careful when SSHing into hosts you do not know with an unpatched version of OpenSSH: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0777 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0777 edit: @Ao7bei3s comment below gives more information on how to protect yourself.

sillysaurus3 11y ago
Rather than post the equivalent of "Ignore this Show HN," you should post the steps people can take to protect themselves.
- Ao7bei3s 11y ago
  ssh -o "PreferredAuthentications=password,keyboard-interactive" -o "UseRoaming=no" root@sshtron.zachlatta.com Explanation: Use a recent ssh version (if you've updated in February you're safe), or put in your .ssh/config file: # CVE-2016-0777 UseRoaming no Additionally, while you are at it, you can take care of some privacy problems. These are really not a big deal though. Don't hand your SSH public key to the server: # Makes SSH not try other keys than ~/.ssh/id_{dsa/ecdsa/rsa}. IdentitiesOnly yes # And move ~/.ssh/id_{dsa/ecdsa/rsa}{,.pub} somewhere else, # including it on a per host basis: Host *.example.com example.com IdentityFile ~/.ssh/my_id_rsa Or you could just disable pubkey authentication for this one connection with ssh -o "PreferredAuthentications=password,keyboard-interactive". Including root@ prevents leaking your local username. If in doubt, man ssh + man ssh_config (they contain other useful things like "CanonicalizeHostname yes / CanonicalDomains ycombinator.com" / example: ssh root@news). (I don't know what's wrong with the internet that we need "how to SSH" posts now, though. But here it is.)
- gouggoug 11y ago
  I assume most people on HN, given the warning and the CVE, would easily find the information they need on google. But sure, if you read this and need information, please read @Ao7bei3s' comment.

sillysaurus3 11y ago

Rather than post the equivalent of "Ignore this Show HN," you should post the steps people can take to protect themselves.

Ao7bei3s 11y ago
ssh -o "PreferredAuthentications=password,keyboard-interactive" -o "UseRoaming=no" root@sshtron.zachlatta.com Explanation: Use a recent ssh version (if you've updated in February you're safe), or put in your .ssh/config file: # CVE-2016-0777 UseRoaming no Additionally, while you are at it, you can take care of some privacy problems. These are really not a big deal though. Don't hand your SSH public key to the server: # Makes SSH not try other keys than ~/.ssh/id_{dsa/ecdsa/rsa}. IdentitiesOnly yes # And move ~/.ssh/id_{dsa/ecdsa/rsa}{,.pub} somewhere else, # including it on a per host basis: Host *.example.com example.com IdentityFile ~/.ssh/my_id_rsa Or you could just disable pubkey authentication for this one connection with ssh -o "PreferredAuthentications=password,keyboard-interactive". Including root@ prevents leaking your local username. If in doubt, man ssh + man ssh_config (they contain other useful things like "CanonicalizeHostname yes / CanonicalDomains ycombinator.com" / example: ssh root@news). (I don't know what's wrong with the internet that we need "how to SSH" posts now, though. But here it is.)
gouggoug 11y ago
I assume most people on HN, given the warning and the CVE, would easily find the information they need on google. But sure, if you read this and need information, please read @Ao7bei3s' comment.