On 09/24/2017 06:01 PM, Damien Miller wrote:
On Thu, 21 Sep 2017, Joseph S Testa II wrote:Hi, I'm interested in requiring a minimum of 3072-bit DH moduli when using the "diffie-hellman-group-exchange-sha256" kex, so I edited my /etc/ssh/moduli file such that only 3071+ moduli are left. However, when clients ask for a max of 2048-bit moduli, they actually get one (!). I poked around and found that a fallback mechanism exists (dh.c:185), which returns back the fixed group14 Group in that case (dh.c:441).What behaviour would you like for this case? We can't send a group that is larger than 2048, because the client has said that is the maxiumum that will accept. Would you prefer the server disconnect at that point?
Yeah, I suppose a disconnect would be the option that most closely follows RFC4419. Or the code could bend the rules, return the smallest modulus (3072-bit), and let the client decide if it wants to continue or not (or crash).
I don't have a strong opinion on this part, personally. - Joe _______________________________________________ openssh-unix-dev mailing list openssh-unix-dev@xxxxxxxxxxx https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
