|
Hello, fellow kids! ... or whoever may still be subscribed here. I also BCC'd a bunch of people to whom this may be relevant.
Apologies if you're no longer involved in SSH. Pursuant to previous discussion about host key synchronization in SSH, Bitvise SSH Server and SSH Client now implement the mechanism "hostkeys-00%openssh.com@localhost" as defined by OpenSSH: https://cvsweb.openbsd.org/src/usr.bin/ssh/PROTOCOL?annotate=HEAD In our 8.xx versions up to 8.19, the SSH Server will
unconditionally send this global request after successful
authentication to inform the client of its other host keys. This
allows a client to auto-verify those host keys, allowing for host
key rotation. Within 6 weeks after our 8.xx release, we found that several significant client implementations will disconnect on receiving a global request. Affected client version strings that I know of so far include: "Cisco" - a bunch of Cisco appliances, quite common "AutoMate" - an automated file transfer client "WeOnlyDo" - old versions of WeOnlyDo libraries, which unfortunately are indistinguishable from new versions (same version string) We suspect some users may also be using ancient OpenSSH versions
on their production servers that cannot be upgraded. This may
include versions before 3.1, which first supported client-side
receipt of global requests. Furthermore, the following server (!) disconnects on global requests sent by the client in versions before 8.0.8.3: "CerberusFTPServer" With Bitvise software versions 8.21 (being released), we are adopting the following strategy: - We are whitelisting a bunch of software - everything we
could reasonably test to confirm it handles global requests - so
that clients will receive host key sync and can implement it. (In
10 years or when people get around to it) - We are blacklisting a few implementations - in particular the above - so that they will not receive global requests. - I have defined a new SSH_MSG_EXT_INFO extension which SSH clients can use to indicate support for global requests. This is meant to override a server's blacklist/whitelist heuristics. I have published an initial draft for the extension, "global-requests-ok", here: https://tools.ietf.org/html/draft-ssh-global-requests-ok-00 The wire details are not flexible (we have implemented and
released), but the text could be tweaked. Clients which find themselves on a blacklist, but wish to correct their ways; and new implementations that want to use host key sync; are encouraged to include "global-requests-ok" in their EXT_INFO. Side note: although OpenSSH first defined and implemented host key sync, it seems to be disabled by default. Perhaps this is due to problems with global requests in software like the above. I suggest that, for clients that send "global-requests-ok", host
key sync could be reliably enabled by default. Bitvise SSH Client
would welcome it. denis
|