holgerfriedrich commented on PR #2684: URL: https://github.com/apache/karaf/pull/2684#issuecomment-4581856047
@jbonofre > OpenSSH 10.3 changed the way such certificates are handled; see the [OpenSSH 10.3 release notes](https://www.openssh.org/txt/release-10.3). In Apache MINA SSHD, there is a new flag CoreModuleProperties.ALLOW_EMPTY_CERTIFICATE_PRINCIPALS (by default false) that can be set on an SshClient or SshServer or also on a Session directly. If the value is false, certificates without principals are rejected as in OpenSSH 10.3; if it is true, such certificates are considered to match any user or host name as in OpenSSH < 10.3. > Set the flag on an SshClient or ClientSession to determine the handling of host certificates. Set it on an SshServer or ServerSession to govern the handling of user certificates. Do you think we need a follow-up PR to keep the old behaviour, at least for the 4.4.x branch? The patch itself would be just a one-liner: `CoreModuleProperties.ALLOW_EMPTY_CERTIFICATE_PRINCIPALS.set(..., true);` affecting ~5 files where we build instances of ssh client or server, and maybe a new test. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
