LWN: Comments on "OpenSSH 9.0 released"

OpenSSH 9.0 released

nix — Fri, 03 Jun 2022 16:44:26 +0000

Workaround? Not using chattr :( alas, I want to use the immutable bit heavily, and this also breaks every backup program I've ever seen whenever a file is hardlinked (those that support setting the immutable bit at all): they all restore the first link, set its attributes (including immutability), then assume they can make further hardlinks to it later on. Not without unsetting immutability around the hardlinking, you can't...

OpenSSH 9.0 released

mrugiero — Thu, 21 Apr 2022 15:10:11 +0000

If they wanted to discourage use of scp they should just have dropped the command and forced the user to call sftp instead. Now I have a command that doesn't do what it's expected to do, which is using the scp protocol for file transfer, and breaks compatibility with other implementations in the process (as mentioned in a different comment, you'd need to explictly install the sftp-server now if you use dropbear, which seems like a drag for the use case of keeping disk and RAM usage low).
It reminds me of Apple being """"helpful"""" by making gcc a symlink to clang.

OpenSSH 9.0 released

mrugiero — Thu, 21 Apr 2022 15:05:12 +0000

Which is also true for sftp. This change broke compatibility with the remote using dropbear, as it supports real scp but not sftp.

OpenSSH 9.0 released

pabs — Fri, 15 Apr 2022 01:27:13 +0000

What workaround for the missing chattr support are you using?

OpenSSH 9.0 released

nix — Thu, 14 Apr 2022 19:40:35 +0000

> rsync really needs a --mirror option that would make both sides identical in everything.

It needs to be able to copy the attributes settable via chattr(1) first, and apparently this will never happen. This is a bit annoying to those of us who use rsync to keep whole machines synced with a master on a bigger system and would like to chattr some parts of the tree :(

OpenSSH 9.0 released

flussence — Mon, 11 Apr 2022 14:48:11 +0000

I don't think everyone's security should be predicated by what a piece of paper owned by a third party says. FIPS is also a standard, but nobody in their right mind waits around for it.

OpenSSH 9.0 released

Paf — Mon, 11 Apr 2022 14:26:46 +0000

Yes, that’s exactly the point being made. It is a force for that and so spreading uncertainty about it helps an agency that doesn’t want that transition to occur. Not saying you’re doing that but the point is the logic can go in either direction. (Which doesn’t mean it’s wrong, I think it just means we don’t know.)

OpenSSH 9.0 released

ballombe — Mon, 11 Apr 2022 12:13:07 +0000

Sorry but the the NIST competition is a major force toward the use of post-quantum crypto.

OpenSSH 9.0 released

LtWorf — Mon, 11 Apr 2022 07:05:11 +0000

> It looks like sftp only ever made it to rfc-draft stage.

But it doen's thave the weekly security bug due to shell expansion trickery? Which is why scp is being abandoned, since it's not really possible to fix it.

OpenSSH 9.0 released

pabs — Mon, 11 Apr 2022 00:24:33 +0000

My go-to for rsync is -aSHAX --delete, otherwise you miss some aspects of most Linux native filesystems. In addition I expect there are still some aspects of other filesystems missing, for eg HFS+ resource forks and NTFS secondary streams.

rsync really needs a --mirror option that would make both sides identical in everything.

OpenSSH 9.0 released

NYKevin — Sun, 10 Apr 2022 23:43:18 +0000

IMHO, the basic problem with rsync(1) is that it doesn't know whether it wants to be a tutorial or a reference document, and so it ends up doing both things badly. It's not quite as bad as bash(1) (too long) or sudoers(5) (https://xkcd.com/1343/, see title text), but it's still not great.

OpenSSH 9.0 released

farnz — Sun, 10 Apr 2022 21:25:03 +0000

The way -a is documented is an example of how it's really difficult to write documentation that's both clear to newcomers and concise for experts.

When you look further down (I have 3.2.3 from Aug 2020), it says:


       --archive, -a
              This is equivalent to -rlptgoD.  It is a quick way of saying you want recursion and want to preserve almost every‐
              thing (with -H being a notable omission).  The only exception to the above equivalence  is  when  --files-from  is
              specified, in which case -r is not implied.

              Note that -a does not preserve hardlinks, because finding multiply-linked files is expensive.  You must separately
              specify -H.

This is much clearer if you're not used to rsync, but a lot less concise - it tries to explain the effect of -rlptgoD but not -H -A -X. If you're an expert user just re-checking the options, though, you'd see the -rlptgoD bit and mentally expand it to: --archive does all the things you'd expect if you're using rsync as a rcp replacement - it handles directories recursively, it copies symlinks as symlinks, it preserves permissions, mtime, group and owner, and it correctly handles Devices and special files, but it does not attempt to copy Hard links as hard links, ACLs or Xattrs.

OpenSSH 9.0 released

aaronmdjones — Sun, 10 Apr 2022 20:37:13 +0000

You are confusing key exchange (the algorithm that derives the encryption and authentication keys for the underlying traffic) with authentication.

NTRU is for the former; ssh-keygen, ssh-agent, gpg-agent, scdaemon, and such will never see it and don't even know that you're using it.

OpenSSH 9.0 released

j0057 — Sun, 10 Apr 2022 20:16:06 +0000

The rsync manpage hurts my brain. It lists multiple examples with the '-av' options. What do they do? Well, '-v' or '--verbose' is easy. Then comes '-a' or '--archive', which is equivalent to, quote, "-rltpgoD (no -H, -A, -X)". That usually makes me want to avoid using rsync.

OpenSSH 9.0 released

gerdesj — Sat, 09 Apr 2022 21:00:42 +0000

lol, use scp to install rsync

OpenSSH 9.0 released

cypherpunks2 — Sat, 09 Apr 2022 19:42:52 +0000

We already know for a fact that ECC is broken. All that's stopping it from being broken in practice is quantum error correction and coherence times. And I would hope that we would use a hybrid key exchange in TLS and all major protocols for a long time but not because of a backdoor so much as possible weaknesses in relatively new algorithms.

OpenSSH 9.0 released

JoeBuck — Sat, 09 Apr 2022 17:49:15 +0000

The NSA does not own all of the world's cryptographers and will be unlikely to succeed again at inserting a back door into a standard, since they got caught (see https://en.wikipedia.org/wiki/Dual_EC_DRBG ). Experts will be looking harder next time, and there was enough troubling analysis at that time that almost everyone rejected that algorithm.

But we could reverse your argument: suppose that NSA has secret advanced technology to use quantum computing to break current cryptography, not quite ready yet but close. How to protect that? We wouldn't want people to switch away from algorithms that they are close to breaking. Maybe by spreading paranoia about the post-quantum crypto contest?

OpenSSH 9.0 released

ballombe — Sat, 09 Apr 2022 16:45:55 +0000

Yes. The paranoid in me cannot help but wonder whether the NIST post-quantum crypto contest is not a sneaky attempt by the NSA to divert people from safe EC crypto to something less studied where they are more likely to have an edge.

OpenSSH 9.0 released

tamiko — Sat, 09 Apr 2022 15:54:48 +0000

At least the way how sntrup761 is combined with x25519 ensures that the hybrid kex scheme does not degrade the security level of x25519.

OpenSSH 9.0 released

champtar — Sat, 09 Apr 2022 13:56:40 +0000

rsync is wonderful, but it needs to be installed on both side, and is not present in minimal installs. Also it means you have shell access most of the time.

OpenSSH 9.0 released

cyperpunks — Sat, 09 Apr 2022 12:58:35 +0000

scp is so weak, it should not be used at all. learn rsync, its sane.

OpenSSH 9.0 released

dtucker — Sat, 09 Apr 2022 12:07:19 +0000

> The scp "protocol" is a dismal relic of SSH 1

It dates back further than that to 4.2BSD's rcp in 1982. In OpenBSD they were almost identical codebases and we used to apply fixes to both scp.c and rcp.c (until rcp was deleted from the tree).

In fact the in the original release of ssh-1.0.0 scp.c still had a CVS Id for rcp.c, which based on the ID seems to have been sourced from FreeBSD.

OpenSSH 9.0 released

mkj — Sat, 09 Apr 2022 05:40:47 +0000

I don't see how gpg-agent would see anything about NTRU, have you seen it as a problem? sntrup761x25519 should only be getting used for key exchange (KEX), versus gpg-agent which doesn't handle KEX, just public key auth signatures which keep using existing schemes.

gpg-agent might still need updating to handle rsa-sha2 signatures, but that's a different problem. https://adamheins.com/blog/ssh-agent-key-rsa

OpenSSH 9.0 released

CoelacanthusHex — Sat, 09 Apr 2022 04:35:20 +0000

And it seems that there are other problems here. If you are using gpg-agent, and OpenSSH matches the NTRU algorithm, gpg-agent will refuse because it does not support the algorithm, which makes it unusable. Now OpenSSH uses this algorithm as the first choice. This makes the probability of encountering this problem greatly increased.

OpenSSH 9.0 released

floppus — Sat, 09 Apr 2022 01:19:53 +0000

rsync also has "weird" quoting, though.

Without -s, rsync uses the remote shell's filename expansion (which I think is the same as scp.)

With -s (the supposedly safer option), the behavior is *less* predictable. Suppose the remote host has two files, named 'a\b' (a backslash b) and 'a\\b' (a backslash backslash b). Then:

"rsync -s 'host:a\b' ." will copy 'a\b': the backslash is literal.

"rsync -s 'host:a\\b' ." will copy 'a\\b': both backslashes are literal.

"rsync -s 'host:a\\*b' ." will copy both 'a\b' and 'a\\b': because the argument contains a star, backslashes are treated as escapes.

OpenSSH 9.0 released

cypherpunks2 — Sat, 09 Apr 2022 00:16:32 +0000

The addition of NTRU Prime for PQC is a little premature, because a new paper just came out which showed that many LWE schemes are weaker than was previously thought. The paper admits that it is not directly applicable to NTRU (which is not an LWE scheme), but it might be adaptable to it.

https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/F...
https://doi.org/10.5281/zenodo.6412487

> NTRU-based cryptosystems are among the leading candidates for lattice-based post-quantum cryptography. In this work, we propose improvements to the dual attack on LWE, and as such our attack is not immediately applicable to NTRU-based cryptosystems. It is an interesting question whether ideas from this work can be adapted to similar improvements to attacks on NTRU. Specifically, there appear to be similarities between the dual attack on LWE and the so-called “hybrid attack” [How07, Wun16] on NTRU. The hybrid attack also involves enumerating over parts of the secret, and then invoking some distinguisher to determine whether a resulting vector is close to a certain constant lattice. It seems reasonable to the writers of this paper that ideas similar to those presented here can be used to reduce the running time of such attacks as well, though anything definitive would of course require further research.

OpenSSH 9.0 released

cjwatson — Fri, 08 Apr 2022 23:58:58 +0000

Any such workflow had probably already been broken by OpenSSH 8.0's scp security fix and would have had to devise a workaround, probably involving switching to something with better-specified semantics.

OpenSSH 9.0 released

cjwatson — Fri, 08 Apr 2022 23:57:33 +0000

I wouldn't get too distracted by the IETF standards status here. The scp "protocol" is a dismal relic of SSH 1, before all the modern SSH protocol work, and because of the way it relied on calling scp on the remote end it was nearly impossible to extend sensibly.

Some may remember the scp security fix from OpenSSH 8.0, which had pretty much no alternative within the traditional protocol but to break some workflows due to that protocol's reliance on wildcard expansion by the remote shell. The mere fact that the remote shell's parsing rules even had to be involved in copying files should give you the willies about how scp used to work ...

PuTTY's pscp has used the SFTP protocol for years, incidentally.

OpenSSH 9.0 released

k8to — Fri, 08 Apr 2022 23:29:18 +0000

sftp is sometimes annoying to use. scp is sometimes annoying to use. One of these has a lot more "unpleasant surprise" problems that can lead to security problems.

sftp isn't really my dream utility, but my use of Linux and Unix tools has steadiliy drifted towards "making do wih stuff in the default install" instead of "installing very user-friendly tools". For better or worse.

OpenSSH 9.0 released

atnot — Fri, 08 Apr 2022 21:58:37 +0000

The scp protocol is also not standardized. It less "tried and true" and more "regretful and known to be broken".

OpenSSH 9.0 released

bof — Fri, 08 Apr 2022 21:38:32 +0000

Honest, BECAUSE of scp's totally weird quoting behaviour, in all my personal "enterprise" scripting over the years, I absolutely avoided use of it. sftp, sometimes. rsync whenever it comes to file transfers. scp, never ever.

OpenSSH 9.0 released

dullfire — Fri, 08 Apr 2022 21:37:55 +0000

Am I just missing something? It looks like sftp only ever made it to rfc-draft stage.

So they are trying to replace something tried and true, with something that was never even standardized?

OpenSSH 9.0 released

marduk — Fri, 08 Apr 2022 19:47:27 +0000

AFAICT this applies only to wildcard "*" and ~ expansion. The wildcard expansion was using the shell on the server end so originally you would have to escape it to prevent the client shell from expanding it. I interpret this to mean it now works similar to how rsync and wildcard expansion works (IOW the sftpd daemon does the expansion instead of the shell so double-quoting is not necessary). As for which method is "correct" I think is subjective but the argument is that service-side expansion is more secure than shell expansion.

As far as tilde "~" expansion I think they are saying that it's not part of the protocol and worked "by accident" do to the server-side shell expansion but if the server is running 8.7+ and has the appropriate extension enabled then it will still work.

OpenSSH 9.0 released

cpacejo — Fri, 08 Apr 2022 18:15:06 +0000

The quoting change sounds like it will break workflows which correctly perform escaping as needed. E.g., any tool which (correctly) uses scp to transfer files with spaces in their names would now need to be changed to use this new `-O` flag. I expect lots of enterprise workflows to be broken by this. What am I missing?

OpenSSH 9.0 released

cjwatson — Fri, 08 Apr 2022 18:08:20 +0000

The description at the top of this article is quite misleading. There are indeed changes to sftp (client and server) here, but those aren't what might cause compatibility issues: that comes down to a change in scp to use the sftp protocol instead of the crusty old shell-based protocol.

Rarely have I looked forward more to a compatibility break. I've lost count of the number of times I've had to argue with scp's obtuse traditional quoting rules.