Mailing List Archive

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit 6cb52d5bf771f6769b630fce35a8e9b8e433044f
Author: djm@openbsd.org <djm@openbsd.org>
Date: Fri Jan 8 04:49:13 2021 +0000

upstream: make CheckHostIP default to 'no'. It doesn't provide any

perceptible value and makes it much harder for hosts to change host keys,
particularly ones that use IP-based load-balancing.

ok dtucker@

OpenBSD-Commit-ID: 0db98413e82074f78c7d46784b1286d08aee78f0
---
readconf.c | 4 ++--
ssh_config.5 | 8 ++++----
2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/readconf.c b/readconf.c
index 2a7870a1..37f92e25 100644
--- a/readconf.c
+++ b/readconf.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: readconf.c,v 1.347 2020/12/22 03:05:31 tb Exp $ */
+/* $OpenBSD: readconf.c,v 1.348 2021/01/08 04:49:13 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -2297,7 +2297,7 @@ fill_default_options(Options * options)
if (options->batch_mode == -1)
options->batch_mode = 0;
if (options->check_host_ip == -1)
- options->check_host_ip = 1;
+ options->check_host_ip = 0;
if (options->strict_host_key_checking == -1)
options->strict_host_key_checking = SSH_STRICT_HOSTKEY_ASK;
if (options->compression == -1)
diff --git a/ssh_config.5 b/ssh_config.5
index 04da0575..18a98a8f 100644
--- a/ssh_config.5
+++ b/ssh_config.5
@@ -33,8 +33,8 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
-.\" $OpenBSD: ssh_config.5,v 1.340 2020/12/22 07:40:26 jmc Exp $
-.Dd $Mdocdate: December 22 2020 $
+.\" $OpenBSD: ssh_config.5,v 1.341 2021/01/08 04:49:13 djm Exp $
+.Dd $Mdocdate: January 8 2021 $
.Dt SSH_CONFIG 5
.Os
.Sh NAME
@@ -421,7 +421,6 @@ or
.It Cm CheckHostIP
If set to
.Cm yes
-(the default),
.Xr ssh 1
will additionally check the host IP address in the
.Pa known_hosts
@@ -432,7 +431,8 @@ and will add addresses of destination hosts to
in the process, regardless of the setting of
.Cm StrictHostKeyChecking .
If the option is set to
-.Cm no ,
+.Cm no
+(the default),
the check will not be executed.
.It Cm Ciphers
Specifies the ciphers allowed and their order of preference.

--
To stop receiving notification emails like this one, please contact
djm@mindrot.org.
_______________________________________________
openssh-commits mailing list
openssh-commits@mindrot.org
https://lists.mindrot.org/mailman/listinfo/openssh-commits