Hi,
some time ago sshd(8) got its list of kex/macs/ciphers shrunk. This
breaks py-paramiko both on the kex and macs POV.
>From transport.py:
_preferred_ciphers = ( 'aes128-ctr', 'aes256-ctr', 'aes128-cbc',
'blowfish-cbc', 'aes256-cbc', '3des-cbc',
'arcfour128', 'arcfour256' )
_preferred_macs = ( 'hmac-sha1', 'hmac-md5', 'hmac-sha1-96', 'hmac-md5-96' )
_preferred_keys = ( 'ssh-rsa', 'ssh-dss', 'ecdsa-sha2-nistp256' )
_preferred_kex = ( 'diffie-hellman-group1-sha1',
'diffie-hellman-group-exchange-sha1' )
_preferred_compression = ( 'none', )
You can match this against sshd_config(8).
Some upstream tickets:
https://github.com/paramiko/paramiko/issues/242
https://github.com/paramiko/paramiko/issues/161
If you have a github account, please ping them. :)
Meanwhile, consumers should be fixed, this includes duplicity for which
I have a patch (for another mail).
sqlite> select * from depends where dependspath = 'security/py-paramiko';
devel/bzr|security/py-paramiko|||security/py-paramiko|T
devel/bzr|security/py-paramiko|||security/py-paramiko|R
net/py-zmq|security/py-paramiko|||security/py-paramiko|R
sysutils/ansible|security/py-paramiko|||security/py-paramiko|R
sysutils/duplicity|security/py-paramiko|||security/py-paramiko|R
sqlite> select * from depends where dependspath = 'net/py-zmq';
devel/ipython|net/py-zmq|||net/py-zmq|R
devel/ipython|net/py-zmq|||net/py-zmq|B
sysutils/py-metlog|net/py-zmq|||net/py-zmq|T
sysutils/salt|net/py-zmq|||net/py-zmq|R
sqlite>
bzr looks fine at first try, ansible uses ssh by default since 1.3,
py-zmq is probably in trouble since it currently depends on and uses
paramiko but it could easily use only openssh, with patching
(zmq/ssh/tunnel.py). I have no idea how py-zmq consumers are actually
affected.
--
jca | PGP : 0x1524E7EE / 5135 92C1 AD36 5293 2BDF DDCC 0DFA 74AE 1524 E7EE
