Bug#989906: openssh-server: With GSSAPIKeyExchage "yes" openssh presents poor quality key exchange methods

To: 989906@bugs.debian.org
Cc: Felix Hädicke <felix.haedicke@gmx.de>
Subject: Bug#989906: openssh-server: With GSSAPIKeyExchage "yes" openssh presents poor quality key exchange methods
From: John Hughes <john.hughes@calva.com>
Date: Mon, 13 Feb 2023 17:25:01 +0100
Message-id: <[🔎] be66ccd1-8665-c612-8a48-04c889d237fe@calva.com>
Reply-to: John Hughes <john.hughes@calva.com>, 989906@bugs.debian.org
In-reply-to: <[🔎] ed8b8b54c4da3cb250c66701349d52e9a737575a.camel@gmx.de>
References: <[🔎] ed8b8b54c4da3cb250c66701349d52e9a737575a.camel@gmx.de> <162377522148.20746.9420183202875211864.reportbug@olympic.calvaedi.com>

On 12/02/2023 18:51, Felix Hädicke wrote:

As far as I can tell there is no way of configuring openssh to avoid
using gss-gex-sha1-toWM5Slw5Ew8Mqkay+al2g==.

It is possible with option "GSSAPIKexAlgorithms", see man page for
ssh_config / sshd_config.

Unfortunately that option doesn't exist in the obsolete openssh-server1:7.9p1-10+deb10u2 I'm using :(


Time to get back on the upgrade treadmill.

--
John Hughes, CalvaEDI -- an Esker company.

Reply to:

References:
- Bug#989906: openssh-server: With GSSAPIKeyExchage "yes" openssh presents poor quality key exchange methods
  - From: Felix Hädicke <felix.haedicke@gmx.de>