Re:35-year-old vulnerability discovered in scp
by unilynx on Tuesday January 15, 2019 @05:11AM
(#18910068)
Ideally they set up SSHFP dns records with the hostkey fingerprints
Haven't yet encountered it in the wild though
Re:35-year-old vulnerability discovered in scp
by Insequent on Tuesday January 15, 2019 @08:01AM
(#18910822)
Or they automatically distribute the host key fingerprints onto employees machines via some organization-wide internal method (ldap, orchestration/configuration management tool of the month, ssh_config pointing to a global known_hosts on a share, etc.).
Re:35-year-old vulnerability discovered in scp
by rkeene2 on Tuesday January 15, 2019 @03:20PM
(#18914661)
OpenSSH also supports certificates, so you can have the host system provide a certificate identifying it -- but you have to setup a CA, and arrange for new hosts to securely have their host keys signed by it.
Re:35-year-old vulnerability discovered in scp
by rsync on Tuesday January 15, 2019 @11:19AM
(#18912237)
"Ideally they set up SSHFP dns records with the hostkey fingerprints ..."
We (rsync.net) are doing this in 2019. A little embarrassed we haven't done it already ...
Re:35-year-old vulnerability discovered in scp
by icedchai on Tuesday January 15, 2019 @02:48PM
(#18914300)
I've been using SSH since SSH-1 was released in 1995. I've never seen anyone verify a host key, ever!
Also, when I reinstall a server and keep the name, I preserve the keys from the original server.
Ideally your organization should keep updated (public) host keys somewhere, say on some https-protected website so you can double check yourself. How common is this?
(I mainly use ssh for interactive/tunneling use, but with a bit of bad luck the host key would change just in time for scp. BTW, don't rsync/unison use scp sometimes?)