{"action":"created","issue":{"url":"https://api.github.com/repos/omniti-labs/omnios-build/issues/50","labels_url":"https://api.github.com/repos/omniti-labs/omnios-build/issues/50/labels{/name}","comments_url":"https://api.github.com/repos/omniti-labs/omnios-build/issues/50/comments","events_url":"https://api.github.com/repos/omniti-labs/omnios-build/issues/50/events","html_url":"https://github.com/omniti-labs/omnios-build/issues/50","id":67126364,"number":50,"title":"OpenSSH issues in r151014","user":{"login":"lotheac","id":167940,"avatar_url":"https://avatars.githubusercontent.com/u/167940?v=3","gravatar_id":"","url":"https://api.github.com/users/lotheac","html_url":"https://github.com/lotheac","followers_url":"https://api.github.com/users/lotheac/followers","following_url":"https://api.github.com/users/lotheac/following{/other_user}","gists_url":"https://api.github.com/users/lotheac/gists{/gist_id}","starred_url":"https://api.github.com/users/lotheac/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lotheac/subscriptions","organizations_url":"https://api.github.com/users/lotheac/orgs","repos_url":"https://api.github.com/users/lotheac/repos","events_url":"https://api.github.com/users/lotheac/events{/privacy}","received_events_url":"https://api.github.com/users/lotheac/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-04-08T13:11:15Z","updated_at":"2015-04-08T14:40:28Z","closed_at":null,"body":"I briefly looked at OpenSSH as it is packaged for OmniOS while working on a\r\nrelated problem, intending to evaluate whether we could replace SunSSH with it\r\nin our environment. I ran into a few issues (some of which you may be aware of,\r\nbut I'll document them here nonetheless). These apply to r151014 (and possibly\r\nearlier releases).\r\n\r\n- network/openssh and network/openssh-server conflict with the SunSSH packages,\r\n  obviously. However, entire has require dependencies on the SunSSH packages:\r\n  network/ssh/ssh-key, network/ssh and service/network/ssh [0]. Perhaps this\r\n  could be solved with a mediation like sendmail was? (I uninstalled entire as\r\n  a workaround for testing)\r\n- network/openssh-server does not depend on network/openssh; however, using\r\n  SunSSH ssh-keygen the start method for the openssh service fails, because it\r\n  attempts to generate ECDSA host keys, which SunSSH ssh-keygen cannot do\r\n  (\"unknown key type ecdsa\")\r\n- openssh-server is by default configured to use DSA, RSA, ECDSA and Ed25519\r\n  host keys. Ed25519 keys are not generated by the shipped startup script, and\r\n  a warning is logged.\r\n- SunSSH cannot connect to an OmniOS box which is running OpenSSH :) (perhaps\r\n  the default openssh sshd_config needs to be tuned wrt. KexAlgorithms)\r\n\r\nI might be able to work on a fix for some of these in the near future, just\r\nthought I'd document them for now.\r\n\r\n[0]: as is documented at http://omnios.omniti.com/ticket.php/63, but the fact\r\nthat openssh was updated for 151014 suggests that it might be intended for use.\r\nMaybe I'm missing something.\r\n"},"comment":{"url":"https://api.github.com/repos/omniti-labs/omnios-build/issues/comments/90936119","html_url":"https://github.com/omniti-labs/omnios-build/issues/50#issuecomment-90936119","issue_url":"https://api.github.com/repos/omniti-labs/omnios-build/issues/50","id":90936119,"user":{"login":"danmcd","id":1406252,"avatar_url":"https://avatars.githubusercontent.com/u/1406252?v=3","gravatar_id":"","url":"https://api.github.com/users/danmcd","html_url":"https://github.com/danmcd","followers_url":"https://api.github.com/users/danmcd/followers","following_url":"https://api.github.com/users/danmcd/following{/other_user}","gists_url":"https://api.github.com/users/danmcd/gists{/gist_id}","starred_url":"https://api.github.com/users/danmcd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/danmcd/subscriptions","organizations_url":"https://api.github.com/users/danmcd/orgs","repos_url":"https://api.github.com/users/danmcd/repos","events_url":"https://api.github.com/users/danmcd/events{/privacy}","received_events_url":"https://api.github.com/users/danmcd/received_events","type":"User","site_admin":false},"created_at":"2015-04-08T14:40:28Z","updated_at":"2015-04-08T14:40:28Z","body":"We updated OpenSSH just to make sure it's as close to upstream as possible.  The problems you mention are known.  The SunSSH vs. OpenSSH problem you mention in your last bullet is because SunSSH serves up weak algorithms.  Something needs to give here, and I'm not sure what the best answer is.  My inclination is to change SunSSH to get better symmetric ciphers by default.  Most people have to \"dumb down\" OpenSSH servers to accept the weaker SunSSH cipher/hash pairs."}}