The host key rotation support sounds very nice, and something I've wanted for a long time:<p>> * ssh(1), sshd(8): Experimental host key rotation support. Add a protocol extension for a server to inform a client of all its available host keys after authentication has completed. The client may record the keys in known_hosts, allowing it to upgrade to better host key algorithms and a server to gracefully rotate its keys.<p>> The client side of this is controlled by a UpdateHostkeys config option (default off).<p>I wish it were on by default, but I guess they want to test it further before enabling it by default. It will remove the temptation to keep using old, weak or suspect keys just because of the hassle of having all the users update their keys or because the admins are afraid of training their users that the scary "HOST KEY HAS CHANGED!!!" warnings are normal and should be ignored.
I submitted a very detailed bug report[0] a while ago, which can lead to a DoS (albeit in a very specific setting). I don't expect anyone to rush to fix it, but I'm surprised that there isn't even a comment about it. Is there another place it needs to be reported in?<p>[0] <a href="https://bugzilla.mindrot.org/show_bug.cgi?id=2265" rel="nofollow">https://bugzilla.mindrot.org/show_bug.cgi?id=2265</a>
> [...] SSH protocol version 1.3, 1.5 [...]<p>Do we still need these? Aren't they extremely ancient? Is there any old client that <i>only</i> support these protocol versions <i></i>and<i></i> has no security issues, or is out-of-support?
<a href="https://bugzilla.mindrot.org/show_bug.cgi?id=1424" rel="nofollow">https://bugzilla.mindrot.org/show_bug.cgi?id=1424</a> :(<p>Oh well, refactoring and crypto work is certainly more important. Congrats on the release.
I have to configure ssh servers so that putty is able to connect, so I can't follow best practices. Why don't the people working in this area help the putty project with support for the latest stuff?
OpenSSH is certainly the standard amongst SSH servers, however, I'm curious if there are serious alternatives that offer something missing in OpenSSH? I know there's a patch floating around that allowed some buffer to be configurable and boosted `scp` performance, for example, but I'm curious if there are other servers that offer anything else interesting.
Fingerprint hash tracking is on the plan to add to Userify soon as well, along with host key wipe and regen. Can't wait to get some of these other awesome features mixed in. Of course, we'll have to wait for distributions to catch up.. queue five year wait..