Hacker News Reader

Comment by merqurio | Hacker News Reader

As far as I know, this will affect any OSX, am I right ?

It affects all operating systems: http://marc.info/?l=openbsd-tech&m=145278077820529&w=2

Is there any way to update openssh on my side, without waiting to apple ? Is this enough ?https://mochtu.de/2015/01/07/updating-openssh-on-mac-os-x-10...

Even easier, just place this text:

    UseRoaming no

on its own line in your ~/.ssh/config file. If you don't have such a file, create it and put this line into it.

Doing that will only protect you in that OS X user account, but I bet you only ever use one account on your Mac to SSH anyway.

I updated /private/etc/ssh_config on OS X (system-wide vs. user-specific).

I believe that is the config for the daemon, not the client. I think you want ssh_config.

Yeah, typo'd it in my comment above. Thanks, fixed.

You can patch it with:

  # echo 'UseRoaming no' >> /etc/ssh/ssh_config

  $ echo "UseRoaming no" >> ~/.ssh/config

As mentioned in another thread, don't do this blindly. If there are `Host` or`Match` blocks in the config, this new line will only apply to the last of those blocks.

Thanks DrRobinson ! I added it to my .ssh/config

The second one. There is no /etc/ssh on a stock Mac. (Although there is a /private/etc/ssh_config on mine, without the intervening ssh dir)

Hue? There is one on mine. Maybe mine's different because I upgraded from 10.9 to 10.10 to 10.11 whereas you might have started with a later version (or an earlier one)?

You have an /etc/ssh, or just an /etc? I have /etc, which is a symlink to /private/etc, but as I said it has no ssh dir.

FWIW I am on 10.10.5 not 10.11. Maybe there's a change in 10.11. (The article the grandparent links is focused on 10.10 so I assumed that was in the scope of this discussion.)

PS are you on homebrew? maybe homebrew adds it.

Homebrew should not add anything outside of /usr/local iirc.

Yes, that should be enough, be wary of $PATH issues tho.

It will affect any OSX that is new enough to have that code in it. Same is true with other OS. For instance, on an older, patched FreeBSD 7.2 system, we see this result:

  /root/.ssh/config: line 1: Bad configuration option: UseRoaming
  /root/.ssh/config: terminating, 1 bad configuration option

... which means that sshd predates the roaming code. I haven't tested, but I'll bet my snow leopard workstation also predates that code.

So ... if that line:

  UseRoaming no

produces no errors when you ssh as that user, then you had the problem and you fixed it. If it produces the error above, you never had the problem in the first place (although with an older sshd like that, you should make sure you're not exposed to other, older vulnerabilities).

Ok, an update - snow leopard is indeed too old for this to be relevant. SL with the last and latest software updates still doesn't have the roaming code in sshd and therefore you don't need to fix anything (at least wrt roaming...)

Thanks !

According to Theo, yes.

s/X//

Deleted comment

This does not affect the sshd.

Reply on news.ycombinator.com