search for: goeswhere

Why are legacy MACs (like md5-96), and legacy Ciphers (anything in cbc-mode, arcfour*(?)) enabled by default? My proposal would be to change the defaults for ssh_config and sshd_config to contain: MACs hmac-sha2-256,hmac-sha2-512,hmac-sha1 Ciphers aes128-ctr,aes192-ctr,aes256-ctr ...removing md5, truncated versions of sha1, umac64 (for which I can find barely any review), any cipher in cbc

Source: xen Version: 4.4.1-9+deb8u1 Severity: serious Justification: fails to build from source Tags: sid stretch User: reproducible-builds at lists.alioth.debian.org Usertags: ftbfs X-Debbugs-CC: reproducible-builds at lists.alioth.debian.org Dear Maintainer, The package fails to build: symbols.c: In function ?symbols_lookup?: symbols.c:23:61: error: array subscript is above array bounds

When using a ProxyCommand, it appears that the arguments to it are passed in an unsafe manner: % ssh -o ProxyCommand='nc %h %p' '$(not found)' zsh:1: command not found: not nc: you must specify the address/port couple of the remote endpoint ssh_exchange_identification: Connection closed by remote host This is not zsh specific (e.g. it happens with bash). One can resolve the