Bug#130876: ssh: -5 discloses too much infomation to an attacker, security

[Matthew Vernon <matthew@sel.cam.ac.uk>]

retitle 130876 Sending server software version information should be optional
severity 130876 wishlist
quit

I'll get back to you in more detail when I have time, but in the mean
time - if you want to produce and maintain (since I'm damn sure
upstream wouldn't want to know) a patch that creates a configuration
option enabling the server to produce only the parts of the version
string required by the RFC (which is in /usr/share/doc/ssh) and
nothing more, I'm prepared to incorporate it. The default should be to
display what the package *currently* does. call it -O
'SecurityByObscurity yes' or something.

Matthew

-- 
Rapun.sel - outermost outpost of the Pick Empire
http://www.pick.ucam.org