colin/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Revert "openssh: 6.9p1 -> 7.0p1"

Browse Source 
This reverts commit a8eb2a6a81. OpenSSH
7.0 is causing too many interoperability problems so soon before the
15.08 release.

For instance, it causes NixOps EC2 initial deployments to fail with
"REMOTE HOST IDENTIFICATION HAS CHANGED". This is because the client
knows the server's ssh-dss host key, but this key is no longer
accepted by default. Setting "HostKeyAlgorithms" to "+ssh-dss" does
not work because it causes ssh-dss to be ordered after
"ecdsa-sha2-nistp521", which the server also offers. (Normally, ssh
prioritizes host key algorithms for which the client has a known host
key, but not if you set HostKeyAlgorithms.)
This commit is contained in:
Eelco Dolstra 2015-08-20 13:50:04 +02:00
parent e4c2f97a27
commit 401782cb67
3 changed files with 2 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
nixos/modules/programs/ssh.nix
View File

@ -115,9 +115,6 @@ in
ForwardX11 ${if cfg.forwardX11 then "yes" else "no"}
# Allow DSA keys for now. (These were deprecated in OpenSSH 7.0.)
PubkeyAcceptedKeyTypes +ssh-dss
${cfg.extraConfig}
'';

3
nixos/modules/services/networking/ssh/sshd.nix
View File

@ -413,9 +413,6 @@ in
${flip concatMapStrings cfg.hostKeys (k: ''
HostKey ${k.path}
'')}
# Allow DSA keys for now. (These were deprecated in OpenSSH 7.0.)
PubkeyAcceptedKeyTypes +ssh-dss
'';
assertions = [{ assertion = if cfg.forwardX11 then cfgc.setXAuthLocation else true;

4
pkgs/tools/networking/openssh/default.nix
View File

@ -17,11 +17,11 @@ let
in
with stdenv.lib;
stdenv.mkDerivation rec {
name = "openssh-7.0p1";
name = "openssh-6.9p1";
src = fetchurl {
url = "mirror://openbsd/OpenSSH/portable/${name}.tar.gz";
sha256 = "1rc52jyc5v5b8j9kvasrnz9vnj9b0i7fw4nqac8wix0r794k4ngx";
sha256 = "1zkci5nbpb4frmzj2vr3kv9j47x2h72kvybcpr0d8mzk73sls1vf";
};
prePatch = optionalString hpnSupport