On Tue, May 5, 2015 at 3:02 PM, <lawgi...@nym.hush.com> wrote:
> On 5/4/2015 at 9:39 PM, "Darren Tucker" <dtuc...@zip.com.au> wrote:
> >Please try this patch on your server.
>
[...]
> We upgrade from snapshots, and don't have the source installed, so we
> can't easily check this patch.
>
I have committed the patch and it should be in the next snapshot.
However, your response prompted us to look again into the WinSCP options,
> and under Advanced Site Settings > SSH > Key exchange, there is the ability
> to reorder the preferred key exchange algorithms.
>
You could probably work around it by removing
diffie-hellman-group-exchange-sha1 from KexAlgorithms in sshd_config (but
that'd also disable it for clients that do it properly).
Preferring "D-H group 14" before "D-H group exchange" allows the client to
> connect. If D-H group exchange is obsolete then the fix should really be
> applied to WinSCP?
>
DH Group Exchange is not obsolete, but WinSCP is using an obsolete form of
it that was never standardized. Right now we're blacklisting all versions
of WinSCP from DH-GEX but if someone can tell us which versions have the
problem and which future ones won't then we can restrict the blacklist.
--
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4 37C9 C982 80C7 8FF4 FA69
Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.
