Groups > linux.debian.user > #196563

Re: [Debian] Re: [Debian] Re: Undesired ssh login attempts

From	Reco <recoverym4n@gmail.com>
Newsgroups	linux.debian.user
Subject	Re: [Debian] Re: [Debian] Re: Undesired ssh login attempts
Date	2018-06-11 14:30 +0200
Message-ID	<vZu7n-32b-5@gated-at.bofh.it> (permalink)
References	<vZ6eK-5is-13@gated-at.bofh.it> <vZ6HL-5I7-1@gated-at.bofh.it> <vZt1D-2rh-3@gated-at.bofh.it> <vZtEl-2DN-1@gated-at.bofh.it> <vZtO1-2W9-3@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

	Hi.

On Mon, Jun 11, 2018 at 08:04:35AM -0400, Jim Popovitch wrote:
> On Mon, 2018-06-11 at 14:51 +0300, Reco wrote:
> > 	Hi.
> > 
> > On Mon, Jun 11, 2018 at 07:12:32AM -0400, Jim Popovitch wrote:
> > > On Sun, 2018-06-10 at 14:27 +0300, Reco wrote:
> > > > 
> > > > Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com
> > > 
> > > What's your thoughts on extending that a bit by adding aes256-ctr
> > > to
> > > that list?
> > 
> > Don't use it, unless compatibility with certain Windows SSH clients
> > is
> > required. [1] is a good read on this Cipher.
> > What I can consider is ADEAD variety of AES, but - I'm uncertain
> > whenever it made its way to OpenSSH at all. It's not in Stretch's
> > version of openssh, that's for sure.
> > 
> 
> Hmmm.  I was reading [1] earlier and felt that "Don't use it" applied
> to CBC but not CTR.  I use ConnectBot (Android SSH client app) and it
> has a limited set of ciphers.

I have two considerations on this then:

1) Abforementioned link says that (and that applies to aes256-ctr):

* nonce reuse is catastrophic, confidentiality is completely lost
* leaks somewhat more information about the size of the plaintext

Second I can live with, but first is a big "no" in my book.

2) ConnectBot is nice, but I prefer Termux with a proper Debian chroot
over it.
That way I'm certain that all the deficiencies/vulnerabilities
discovered in a foreseeable future receive a timely update.

Reco

Thread

Undesired ssh login attempts deloptes <deloptes@gmail.com> - 2018-06-10 13:00 +0200
  Re: Undesired ssh login attempts Dan Purgert <dan@djph.net> - 2018-06-10 13:20 +0200
    Re: Undesired ssh login attempts Roberto C. Sánchez <roberto@debian.org> - 2018-06-10 14:30 +0200
      Re: Undesired ssh login attempts Dan Purgert <dan@djph.net> - 2018-06-11 12:10 +0200
    Re: Undesired ssh login attempts Thomas D Dial <tdial@acm.org> - 2018-06-11 03:50 +0200
  Re: Undesired ssh login attempts Reco <recoverym4n@gmail.com> - 2018-06-10 13:30 +0200
    Re: Undesired ssh login attempts Dejan Jocic <jodejka@gmail.com> - 2018-06-10 14:30 +0200
    Re: Undesired ssh login attempts deloptes <deloptes@gmail.com> - 2018-06-10 16:40 +0200
    Re: [Debian] Re: Undesired ssh login attempts Jim Popovitch <jim@k4vqc.com> - 2018-06-11 13:20 +0200
      Re: [Debian] Re: Undesired ssh login attempts Reco <recoverym4n@gmail.com> - 2018-06-11 14:00 +0200
        Re: [Debian] Re: [Debian] Re: Undesired ssh login attempts Jim Popovitch <jim@k4vqc.com> - 2018-06-11 14:10 +0200
          Re: [Debian] Re: [Debian] Re: Undesired ssh login attempts Reco <recoverym4n@gmail.com> - 2018-06-11 14:30 +0200
            Re: [Debian] Re: [Debian] Re: [Debian] Re: Undesired ssh login  attempts Jim Popovitch <jim@k4vqc.com> - 2018-06-11 15:00 +0200
  Re: Undesired ssh login attempts likcoras <likcoras@riseup.net> - 2018-06-10 13:30 +0200
    Re: Undesired ssh login attempts Joe <joe@jretrading.com> - 2018-06-10 14:30 +0200

csiph-web