openssh bugs - Jul 2023 - [Bug 3587] New: Would OpenSSH consider adding a switch to hide the specific OpenSSH version number?

https://bugzilla.mindrot.org/show_bug.cgi?id=3587

            Bug ID: 3587
           Summary: Would OpenSSH consider adding a switch to hide the
                    specific OpenSSH version number?
           Product: Portable OpenSSH
           Version: -current
          Hardware: Other
                OS: Linux
            Status: NEW
          Severity: security
          Priority: P5
         Component: sshd
          Assignee: unassigned-bugs at mindrot.org
          Reporter: rmsh1216 at 163.com

Although I know that the sshv2 protocol, rfcrfc4253, describes Protocol
Version Exchange, I would like to ask if openssh will consider adding a
new switch to allow customers to choose to hide the specific version
number of openssh or delete the specific version number in debug logs
during version exchange.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3587

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |djm at mindrot.org

--- Comment #1 from Damien Miller <djm at mindrot.org> ---
what would this achieve?

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3587

--- Comment #2 from renmingshuai <rmsh1216 at 163.com> ---
Some scanning software determines whether OpenSSH has certain
vulnerabilities based on the specific version number, even if the
vulnerabilities have been fixed through patches. Hiding specific
version numbers can be scanned through these.

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3587

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |WONTFIX
             Status|NEW                         |RESOLVED

--- Comment #3 from Damien Miller <djm at mindrot.org> ---
placating incorrect reports from naive scanning software isn't a good
reason to break an important compatibility feature, sorry. I suggest
using the existing VersionAddendum option to signal patching status.

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.