OpenSSH
[Top] [All Lists]

Re: bug(?) with OpenSSH 4.4+ and large DSA ID keys

To: downtime@slagheap.net
Subject: Re: bug(?) with OpenSSH 4.4+ and large DSA ID keys
From: Darren Tucker <dtucker@zip.com.au>
Date: Fri, 09 Feb 2007 14:19:25 +1100
Cc: openssh-unix-dev@mindrot.org
Delivered-to: sp-com-lists@consult.net
Delivered-to: openssh-unix-dev-list1@securepoint.com
Delivered-to: openssh-unix-dev-tmda@mindrot.org
Delivered-to: openssh-unix-dev@mindrot.org
In-reply-to: <97E17E29-15F4-4E17-B0EA-21E7A419CF84@slagheap.net>
List-archive: <http://lists.mindrot.org/pipermail/openssh-unix-dev>
List-help: <mailto:openssh-unix-dev-request@mindrot.org?subject=help>
List-id: Development of portable OpenSSH <openssh-unix-dev.mindrot.org>
List-post: <mailto:openssh-unix-dev@mindrot.org>
List-subscribe: <http://lists.mindrot.org/mailman/listinfo/openssh-unix-dev>, <mailto:openssh-unix-dev-request@mindrot.org?subject=subscribe>
List-unsubscribe: <http://lists.mindrot.org/mailman/listinfo/openssh-unix-dev>, <mailto:openssh-unix-dev-request@mindrot.org?subject=unsubscribe>
References: <97E17E29-15F4-4E17-B0EA-21E7A419CF84@slagheap.net>
Sender: openssh-unix-dev-bounces+openssh-unix-dev-list1=securepoint.com@mindrot.org
User-agent: Thunderbird 1.5.0.9 (Windows/20061207)
downtime@slagheap.net wrote:
> Please pardon me if this is the wrong place, or operator error/ 
> retardation is involved.  Any help is sincerely appreciated.
> 
> fatal: mm_request_receive_expect: read: rtype 12 != type 24

That's a symptom of the bug fixed just before the release of OpenSSH 4.5 
(where the monitor and slave get out of sync).  I suggest that you 
upgrade the (other) servers.

The reason for the different behaviour on some hosts is that it's 
dependent on the OpenSSL library version (newer versions will refuse to 
process DSA keys > ~3k).  This means that your big keys still won't 
work, but the server won't kill the connections either.  Big DSA keys 
don't really make sense for SSH so if you want big keys I suggest you 
use RSA.

The "unknown key type" client debug messages are normal.

-- 
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
     Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.
_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev@mindrot.org
http://lists.mindrot.org/mailman/listinfo/openssh-unix-dev

<Prev in Thread] Current Thread [Next in Thread>