Re: [ptxdist] OpenSSH patches

[Clemens Gruber <clemens.gruber@pqgruber.com>]

On Tue, Jul 14, 2015 at 12:03:47PM +0200, Michael Olbrich wrote:
> On Tue, Jul 07, 2015 at 10:52:52AM +0200, Clemens Gruber wrote:
> > what do you think about my recent OpenSSH patches (not the version bumps) but
> > enabling the sandbox per default (to use seccomp if available) and the switch
> > from DSA to Ed25519. ArchLinux and current Debian both generate Ed25519 pubkeys
> > by default and add them as HostKey to sshd_config.
> > They keep DSA and ECDSA but as they fall apart completely if the random numbers
> > used are not good, I am not sure this is a good idea for embedded systems where
> > entropy is often very scarce. Ed25519 is not that sensitive to entropy problems.
> 
> I looked at what Debian is doing, and I liked it: Basically, the postinst
> script checks the sshd_config and generated the needed keys. I think we can
> do the same in the ssh rc-once script.
> Then we can choose more restrictive defaults. Then those that need other
> keys just need to overwrite sshd_config in the BSP.
> 
> Michael

Hi Michael,

what do you think about my recent patch (openssh: improve rc.once.d script and
harden sshd_config) from July 17th? I tried to follow what Debian is doing for
key generation and I also hardened the default config.

Regards,
Clemens

-- 
ptxdist mailing list
ptxdist@pengutronix.de