diff options
| -rw-r--r-- | crypto/openssh/myproposal.h | 6 | ||||
| -rw-r--r-- | crypto/openssh/regress/knownhosts-command.sh | 6 | ||||
| -rw-r--r-- | crypto/openssh/ssh_config.5 | 9 |
3 files changed, 9 insertions, 12 deletions
diff --git a/crypto/openssh/myproposal.h b/crypto/openssh/myproposal.h index f03b7dfd0df9..6d79937b6fa8 100644 --- a/crypto/openssh/myproposal.h +++ b/crypto/openssh/myproposal.h @@ -1,4 +1,4 @@ -/* $OpenBSD: myproposal.h,v 1.68 2020/10/03 04:15:06 djm Exp $ */ +/* $OpenBSD: myproposal.h,v 1.69 2021/08/29 23:53:10 djm Exp $ */ /* * Copyright (c) 2000 Markus Friedl. All rights reserved. @@ -46,7 +46,6 @@ "sk-ecdsa-sha2-nistp256-cert-v01@openssh.com," \ "rsa-sha2-512-cert-v01@openssh.com," \ "rsa-sha2-256-cert-v01@openssh.com," \ - "ssh-rsa-cert-v01@openssh.com," \ "ssh-ed25519," \ "ecdsa-sha2-nistp256," \ "ecdsa-sha2-nistp384," \ @@ -54,8 +53,7 @@ "sk-ssh-ed25519@openssh.com," \ "sk-ecdsa-sha2-nistp256@openssh.com," \ "rsa-sha2-512," \ - "rsa-sha2-256," \ - "ssh-rsa" + "rsa-sha2-256" #define KEX_SERVER_ENCRYPT \ "chacha20-poly1305@openssh.com," \ diff --git a/crypto/openssh/regress/knownhosts-command.sh b/crypto/openssh/regress/knownhosts-command.sh index f15df670b0c8..8472ec8121c5 100644 --- a/crypto/openssh/regress/knownhosts-command.sh +++ b/crypto/openssh/regress/knownhosts-command.sh @@ -1,4 +1,4 @@ -# $OpenBSD: knownhosts-command.sh,v 1.2 2020/12/22 06:47:24 djm Exp $ +# $OpenBSD: knownhosts-command.sh,v 1.3 2021/08/30 01:15:45 djm Exp $ # Placed in the Public Domain. tid="known hosts command " @@ -39,7 +39,9 @@ chmod a+x $OBJ/knownhosts_command ${SSH} -F $OBJ/ssh_proxy x true && fail "ssh connect succeeded with bad exit" for keytype in ${SSH_HOSTKEY_TYPES} ; do + algs=$keytype test "x$keytype" = "xssh-dss" && continue + test "x$keytype" = "xssh-rsa" && algs=ssh-rsa,rsa-sha2-256,rsa-sha2-512 verbose "keytype $keytype" cat > $OBJ/knownhosts_command << _EOF #!/bin/sh @@ -48,6 +50,6 @@ test "x\$1" = "x$keytype" || die "wrong keytype \$1 (expected $keytype)" test "x\$3" = "x$LOGNAME" || die "wrong username \$3 (expected $LOGNAME)" grep -- "\$1.*\$2" $OBJ/known_hosts _EOF - ${SSH} -F $OBJ/ssh_proxy -oHostKeyAlgorithms=$keytype x true || + ${SSH} -F $OBJ/ssh_proxy -oHostKeyAlgorithms=$algs x true || fail "ssh connect failed for keytype $x" done diff --git a/crypto/openssh/ssh_config.5 b/crypto/openssh/ssh_config.5 index d2ae7f282346..9682e352147d 100644 --- a/crypto/openssh/ssh_config.5 +++ b/crypto/openssh/ssh_config.5 @@ -882,12 +882,11 @@ sk-ssh-ed25519-cert-v01@openssh.com, sk-ecdsa-sha2-nistp256-cert-v01@openssh.com, rsa-sha2-512-cert-v01@openssh.com, rsa-sha2-256-cert-v01@openssh.com, -ssh-rsa-cert-v01@openssh.com, ssh-ed25519, ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, sk-ssh-ed25519@openssh.com, sk-ecdsa-sha2-nistp256@openssh.com, -rsa-sha2-512,rsa-sha2-256,ssh-rsa +rsa-sha2-512,rsa-sha2-256 .Ed .Pp The @@ -929,12 +928,11 @@ sk-ssh-ed25519-cert-v01@openssh.com, sk-ecdsa-sha2-nistp256-cert-v01@openssh.com, rsa-sha2-512-cert-v01@openssh.com, rsa-sha2-256-cert-v01@openssh.com, -ssh-rsa-cert-v01@openssh.com, ssh-ed25519, ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com, -rsa-sha2-512,rsa-sha2-256,ssh-rsa +rsa-sha2-512,rsa-sha2-256 .Ed .Pp If hostkeys are known for the destination host then this default is modified @@ -1512,12 +1510,11 @@ sk-ssh-ed25519-cert-v01@openssh.com, sk-ecdsa-sha2-nistp256-cert-v01@openssh.com, rsa-sha2-512-cert-v01@openssh.com, rsa-sha2-256-cert-v01@openssh.com, --ssh-rsa-cert-v01@openssh.com, ssh-ed25519, ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, sk-ssh-ed25519@openssh.com, sk-ecdsa-sha2-nistp256@openssh.com, -rsa-sha2-512,rsa-sha2-256,ssh-rsa +rsa-sha2-512,rsa-sha2-256 .Ed .Pp The list of available signature algorithms may also be obtained using |