Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use different algorithms depending on the ssh version #166

Merged
merged 2 commits into from
Feb 5, 2017

Conversation

artem-sidorenko
Copy link
Member

@artem-sidorenko artem-sidorenko commented Jan 24, 2017

Fixes GH-162

@artem-sidorenko artem-sidorenko added this to the v2.0.0 milestone Jan 24, 2017
@artem-sidorenko
Copy link
Member Author

PR to ssh-baseline follows..(and is the reason for WIP)

@artem-sidorenko
Copy link
Member Author

artem-sidorenko commented Jan 24, 2017

Currently this feature is server only (basically the same implementation like with privilege_separation). There is an option HostKeyAlgorithms which is valid for server and client, however this option is present on the server starting from something like openssh 6.7 (I do not know the exact version). So a proper server&client implementation would require a bit more changes in order to handle this.

Below an overview over different ssh versions and supported things (key stuff is mostly based on the @atomic111 evaluation):

ubuntu 12.04 ubuntu 14.04 ubuntu 16.04 centos 6.8 centos 7.3
ssh version 5.9 6.6 7.2 5.3 6.6
ssh -Q key support x x x
HostKeyAlgorithms/server support x
dsa key x x x x
rsa key x x x x x
ecdsa key x x x
ed25519 key x x x
debian 7.11 debian 8.6 fedora 24 fedora 25 opensuse leap 42.1 opensuse 13.2
ssh version 6.0 6.7 7.2 7.3 6.6 6.6
ssh -Q key support x x x x x
HostKeyAlgorithms/server support x x ? ?
dsa key x x x x
rsa key x x x x x x
ecdsa key x x x x x x
ed25519 key x x x x x

@artem-sidorenko
Copy link
Member Author

and here is the PR with tests: dev-sec/ssh-baseline#79

@artem-sidorenko artem-sidorenko changed the title WIP: Use different algorithms depending on the ssh version Use different algorithms depending on the ssh version Feb 5, 2017
@artem-sidorenko
Copy link
Member Author

The tests for failing opensuse 42.1 are in PR dev-sec/ssh-baseline#84

@coveralls
Copy link

Coverage Status

Coverage decreased (-0.8%) to 99.228% when pulling 34be301 on artem-sidorenko:alg-update into 5dfe85a on dev-sec:master.

for old chef versions where autodetection does not work
@coveralls
Copy link

Coverage Status

Coverage decreased (-0.4%) to 99.614% when pulling 98375b8 on artem-sidorenko:alg-update into 5dfe85a on dev-sec:master.

@coveralls
Copy link

Coverage Status

Coverage remained the same at 100.0% when pulling f9baa14 on artem-sidorenko:alg-update into 5dfe85a on dev-sec:master.

@atomic111 atomic111 self-requested a review February 5, 2017 22:34
@atomic111
Copy link
Member

@artem-sidorenko thank you for the great work. now we can tag the version to 2.0.0. awesome

@atomic111 atomic111 merged commit 97b2f52 into dev-sec:master Feb 5, 2017
@artem-sidorenko artem-sidorenko deleted the alg-update branch February 6, 2017 08:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants