Bug#777549: openssh-client: Setting KexAlgorithms disables GSSAPIKeyExchange
Christoph Anton Mitterer <calestyo@scientia.net> writes:
> Anyway,... best chances are if Alfred would report this to upstream
> (which is here not OpenSSH, but the maintainers of the patchset).
That's also true, particularly since it sounded from the second message
like he has a proposed fix. However, it's worth noting that any fix for
this wouldn't make it into jessie at this point, so you'll want to be
thinking about workarounds or planning on backporting a later version.
It does make sense to me that it should be possible to both enable GSS-API
key exchange and otherwise restrict the key exchange methods that the
server will use in the absence of GSS-API. (Ideally, you could restrict
which specific GSS-API key exchange algorithms would be used, but I think
there aren't many to choose from anyway.)
This whole thing is unnecessarily irritating due to the OpenSSH project's
unwillingness to take the key exchange patches, forcing every distribution
to apply them separately and meaning that they aren't considered when
upstream works on things like the configuration parameter for key exchange
methods.
--
Russ Allbery (rra@debian.org) <http://www.eyrie.org/~eagle/>
Reply to: