Hello,
since one currently (after the 9.6 release addressing terrapin with
strict-kex) cant be sure that strict KEX mode is negotiated (it depends
on the capabilities of the partner), and the mitigation for that is to
disable most modern/alternative ciphers and MAC modes -
I would suggest you offer the option to enforce strict-kex mode as a server
config as well as a per-host config in the client config.
(obcredits: jssh has this setting).
Not sure if you also have precedence for warning on (console initiated)
connections which have no strict-kex, but that would be an additional
feature.
Gruss
Bernd
--
https://bernd.eckenfels.net
_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev@mindrot.org
https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
since one currently (after the 9.6 release addressing terrapin with
strict-kex) cant be sure that strict KEX mode is negotiated (it depends
on the capabilities of the partner), and the mitigation for that is to
disable most modern/alternative ciphers and MAC modes -
I would suggest you offer the option to enforce strict-kex mode as a server
config as well as a per-host config in the client config.
(obcredits: jssh has this setting).
Not sure if you also have precedence for warning on (console initiated)
connections which have no strict-kex, but that would be an additional
feature.
Gruss
Bernd
--
https://bernd.eckenfels.net
_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev@mindrot.org
https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev