OpenSSH: client bug CVE-2016-0777

Re:OpenSSH: client bug CVE-2016-0777 by ralphm on Thursday January 14, 2016 @10:38AM (#10901993)

Indeed. The page gives bad advise. If your config has `Host` blocks, like often in people's personal configs, or if you have a `Match` block, the new directive only applies to the last of those blocks in the config file.

[ Parent | on HN ]

Re:OpenSSH: client bug CVE-2016-0777 by snowwrestler on Thursday January 14, 2016 @11:04AM (#10902171)

Sufficient to place it at the top of ~/.ssh/config? Or does it also need a block header of its own, like:

    Host *
    UseRoaming no

[ Parent | on HN ]

Re:OpenSSH: client bug CVE-2016-0777 by skuhn on Thursday January 14, 2016 @04:45PM (#10904763)

I confirmed that it does not need to be placed into a Host block, as long as it is above all of your blocks.

For instance:

   UseRoaming no

   Host *
      Blah yes

Test with: ssh -v remote.ssh.host.com uptime 2>&1 | grep -i roaming

If it returns nothing, the config fix is active. If it isn't active, you'll see 'debug1: Roaming not allowed by server'

[ Parent | on HN ]

Re:OpenSSH: client bug CVE-2016-0777 by jldugger on Thursday January 14, 2016 @01:26PM (#10903283)

Which is why they're appending a newline and Host *?

[ Parent | on HN ]

Re:OpenSSH: client bug CVE-2016-0777 by ralphm on Thursday January 14, 2016 @05:03PM (#10904975)

Note that the example was changed as a result of my initial comment.

[ Parent | on HN ]