SSH configuration question

[Richard W Hunt]

I'm currently on OpenVMS 8.3 and TCPIP Services for OpenVMS v 5.6 ECO4.

In files SSH2_CONFIG and SSHD2_CONFIG, there are lines suggesting "groups" of ciphers and MACs that I could use. I can always list every cipher we like, but the "AnyCipher" and "AnySTDCipher" (and the corresponding MAC equivalents) exist as shortcuts.

I have searched this forum for the topic but have gotten nowhere on a definition of the group contents. A wider-range search via Google but limited to OpenVMS TCPIP Services documentation didn't help.

I found something for Process Software (which I think is the basis for the "port" to TCPIP Services for OpenVMS) but there is no guarantee as to what got ported, i.e. what is in these groups on the OVMS version of SSH2.

The biggest issue is that I want to avoid having to type an explicit list, but must also avoid using a shorthand group name that includes "none" as an option. Our security group gets kind of "touchy" if we allow "none" as an option.

Any pointers, even just a link or a document name, would be helpful.

[Art Wiens]

The text returned from this hit on Google says :

"SSH is a popular protocol for securing your network connections. ... browser's connection with a new direct-tcpip channel in the existing SSH session ...... user joe to the SSH group As a bonus. including none AnyCipher Same as Any.4. ..."

http://www.scribd.com/doc/15490791/SSH-The-Secure-Shell-The-Definitive-Guide-by-OReilly-Media

But a search of the document doesn't find the word AnyCipher, the index isn't included and you can't download the book for free.

Read the whole book? Buy it?

Cheers,
Art

[Richard W Hunt]

Thanks, Art. I noticed a few hits like that. The problem is one I might have to escalate to my support contract level in order to find out what is in each possible group. Without casting TOO many aspersions, I have to say that the SSH documentation is a tad weak in defining what each keyword means and yet doesn't clearly state (that I have found) where more information can be found.

I checked before for other reasons, but I'll have to check the RFC documentation again to see if it has any wisdom on this topic that I do not have. Admittedly, it is a likely occurrence anyway, as I've never been accused of excessive wisdom.

[Richard Whalen · Accepted solution]

Though the SSH software that Process Software ported to OpenVMS and the SSH software that HP ported to OpenVMS share a common root, there are some differences. In general the differences in the base software are small enough that Process Software's documentation of functionality that is not specific to OpenVMS will often work with the SSH for TCP/IP Services.

[Richard W Hunt]

Thanks, Richard - The link I found for Process Software's offering does include a bit more documentation on config file keywords than the OpenSSH Guide.

I remember once, a long time ago, when I had to tweak DEC about leaving out something useful from the documentation for RSX-11M. Perhaps it is time to file the modern equivalent of an SPR. (Remember the 5-part carbon forms for SPRs??? Or did I just give away my age?)

[Richard W Hunt]

I filed a ticket with HP since we had a s/w support contract still in force. The reply is that we can use these links:


http://www.ssh.com/documents/32/ssh2_config.html

http://www.ssh.com/documents/32/sshd2_config.html

So as long as I can point my security guys to a description of what I'm using, they'll be happy. Thanks for the suggestions, folks. BTW, my answer is specific to the Ciphers and MACs keyworks, but I gather that the referenced document is mostly applicable to other config-file keywords except for those that are specific to OpenVMS issues.