Re: OpenSSH: client bug CVE-2016-0777 and CVE-2016-0778

2016-01-16 Thread Tim
Tim: >> This shows just one advantage of doing fresh installs, instead of >> updates. Those of use who do fresh installs, won't have old keys from >> prior releases still on our systems. Gordon Messmer: > "Your keys" means your private authentication keys. The ones in > ~/.ssh. If you keep or

Re: OpenSSH: client bug CVE-2016-0777 and CVE-2016-0778

2016-01-15 Thread Gordon Messmer
On Thu, Jan 14, 2016 at 8:35 AM, Frank Elsner wrote: > you should do an > echo 'UseRoaming no' >> /etc/ssh/ssh_config Depending on the content of your ssh_config file, that might not be an effective fix. The recommended mitigation is: # echo -e 'Host *\nUseRoaming no' >> /etc/ssh/ssh_config >

Re: OpenSSH: client bug CVE-2016-0777 and CVE-2016-0778

2016-01-15 Thread Gordon Messmer
On 01/15/2016 03:51 AM, Tim wrote: This shows just one advantage of doing fresh installs, instead of updates. Those of use who do fresh installs, won't have old keys from prior releases still on our systems. "Your keys" means your private authentication keys. The ones in ~/.ssh. If you keep

Re: OpenSSH: client bug CVE-2016-0777 and CVE-2016-0778

2016-01-15 Thread Tim
On Thu, 2016-01-14 at 14:05 -0600, Dan Mossor wrote: > Also, it would be prudent to rotate your keys, as this bug has been > present since 2009. "Rotating your keys," sounds kind of humourous. ;-) This shows just one advantage of doing fresh installs, instead of updates. Those of use who do fr

Re: OpenSSH: client bug CVE-2016-0777 and CVE-2016-0778

2016-01-14 Thread stan
On Thu, 14 Jan 2016 17:35:10 +0100 Frank Elsner wrote: > you should do an > > echo 'UseRoaming no' >> /etc/ssh/ssh_config > > to secure your system according to > http://undeadly.org/cgi?action=article&sid=20160114142733 Thanks for the heads up. -- users mailing list users@lists.fedoraprojec

Re: OpenSSH: client bug CVE-2016-0777 and CVE-2016-0778

2016-01-14 Thread Dan Mossor
On 01/14/2016 10:35 AM, Frank Elsner wrote: Hello folks, you should do an echo 'UseRoaming no' >> /etc/ssh/ssh_config to secure your system according to http://undeadly.org/cgi?action=article&sid=20160114142733 Do not aks me for details. I'm just redistributing the warning. --Frank Also,

OpenSSH: client bug CVE-2016-0777 and CVE-2016-0778

2016-01-14 Thread Frank Elsner
Hello folks, you should do an echo 'UseRoaming no' >> /etc/ssh/ssh_config to secure your system according to http://undeadly.org/cgi?action=article&sid=20160114142733 Do not aks me for details. I'm just redistributing the warning. --Frank -- users mailing list users@lists.fedoraproject.org