Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

dropbear: Enhanced security options #1163

Closed
wants to merge 5 commits into from
Closed

dropbear: Enhanced security options #1163

wants to merge 5 commits into from

Conversation

agherzan
Copy link
Contributor

We deactivate various configuration knobs which have security concerns:

  • DROPBEAR_X11FWD - no need to run X over ssh
  • DROPBEAR_SHA1_96_HMAC - HMAC 96 is known to be a weak algorithm. It is
    reported by OpenVAS as a low severity security issue.
  • DROPBEAR_ENABLE_CBC_MODE - As reported by OpenVAS, CBC mode can allow
    an attacker to obtain plaintext from a block of cyphertext.
  • DROPBEAR_DH_GROUP1 - This is documented as "less secure" while in
    newer versions mentioned as "too small for security".

Fixes #1161

Change-type: minor
Changelog-entry: Enhanced security options for dropbear
Signed-off-by: Andrei Gherzan andrei@resin.io

Contributor checklist

Reviewer Guidelines

  • When submitting a review, please pick:
    • 'Approve' if this change would be acceptable in the codebase (even if there are minor or cosmetic tweaks that could be improved).
    • 'Request Changes' if this change would not be acceptable in our codebase (e.g. bugs, changes that will make development harder in future, security/performance issues, etc).
    • 'Comment' if you don't feel you have enough information to decide either way (e.g. if you have major questions, or you don't understand the context of the change sufficiently to fully review yourself, but want to make a comment)

@agherzan agherzan self-assigned this Aug 30, 2018
@agherzan agherzan requested a review from ZubairLK August 30, 2018 11:54
@resin-os-versionbot
Copy link

@agherzan, status checks have failed for this PR. Please make appropriate changes and recommit.

@agherzan agherzan force-pushed the ag_dropbear_security branch 2 times, most recently from 11a97fc to b993e59 Compare August 31, 2018 09:49
@resin-os-versionbot
Copy link

@agherzan, status checks have failed for this PR. Please make appropriate changes and recommit.

ZubairLK
ZubairLK approved these changes Aug 31, 2018
View reviewed changes
Copy link
Contributor

@ZubairLK ZubairLK left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. Surprised these are enabled by default.

@resin-os-versionbot
Copy link

@agherzan, status checks have failed for this PR. Please make appropriate changes and recommit.

2 similar comments
@resin-os-versionbot
Copy link

@agherzan, status checks have failed for this PR. Please make appropriate changes and recommit.

@resin-os-versionbot
Copy link

@agherzan, status checks have failed for this PR. Please make appropriate changes and recommit.

Andrei Gherzan added 5 commits September 4, 2018 11:46
dropbear/krogoth: Enhanced security options
3e132c2 
We deactivate various configuration knobs which have security concerns:

* DROPBEAR_X11FWD - no need to run X over ssh
* DROPBEAR_SHA1_96_HMAC - HMAC 96 is known to be a weak algorithm. It is
        reported by OpenVAS as a low severity security issue.
* DROPBEAR_ENABLE_CBC_MODE - As reported by OpenVAS, CBC mode can allow
        an attacker to obtain plaintext from a block of cyphertext.

Connected-to: #1161
Change-type: minor
Changelog-entry: Enhanced security options for dropbear - krogoth
Signed-off-by: Andrei Gherzan <andrei@resin.io>
dropbear/morty: Enhanced security options
11004be 
We deactivate various configuration knobs which have security concerns:

* DROPBEAR_X11FWD - no need to run X over ssh
* DROPBEAR_SHA1_96_HMAC - HMAC 96 is known to be a weak algorithm. It is
        reported by OpenVAS as a low severity security issue.
* DROPBEAR_ENABLE_CBC_MODE - As reported by OpenVAS, CBC mode can allow
        an attacker to obtain plaintext from a block of cyphertext.
* DROPBEAR_DH_GROUP1 - This is documented as "less secure" while in
        newer versions mentioned as "too small for security".

Connected-to: #1161
Change-type: minor
Changelog-entry: Enhanced security options for dropbear - morty
Signed-off-by: Andrei Gherzan <andrei@resin.io>
dropbear/pyro: Enhanced security options
b15f926 
We deactivate various configuration knobs which have security concerns:

* DROPBEAR_X11FWD - no need to run X over ssh
* DROPBEAR_SHA1_96_HMAC - HMAC 96 is known to be a weak algorithm. It is
        reported by OpenVAS as a low severity security issue.
* DROPBEAR_ENABLE_CBC_MODE - As reported by OpenVAS, CBC mode can allow
        an attacker to obtain plaintext from a block of cyphertext.
* DROPBEAR_DH_GROUP1 - This is documented as "less secure" while in
        newer versions mentioned as "too small for security".

Connected-to: #1161
Change-type: minor
Changelog-entry: Enhanced security options for dropbear - pyro
Signed-off-by: Andrei Gherzan <andrei@resin.io>
dropbear/rocko: Enhanced security options
0a9ad71 
We deactivate various configuration knobs which have security concerns:

* DROPBEAR_X11FWD - no need to run X over ssh
* DROPBEAR_SHA1_96_HMAC - HMAC 96 is known to be a weak algorithm. It is
        reported by OpenVAS as a low severity security issue.
* DROPBEAR_ENABLE_CBC_MODE - As reported by OpenVAS, CBC mode can allow
        an attacker to obtain plaintext from a block of cyphertext.
* DROPBEAR_DH_GROUP1 - This is documented as "less secure" while in
        newer versions mentioned as "too small for security".

Connected-to: #1161
Change-type: minor
Changelog-entry: Enhanced security options for dropbear - rocko
Signed-off-by: Andrei Gherzan <andrei@resin.io>
dropbear/sumo: Enhanced security options
824d45b 
We deactivate various configuration knobs which have security concerns:

* DROPBEAR_X11FWD - no need to run X over ssh
* DROPBEAR_SHA1_96_HMAC - HMAC 96 is known to be a weak algorithm. It is
        reported by OpenVAS as a low severity security issue.
* DROPBEAR_ENABLE_CBC_MODE - As reported by OpenVAS, CBC mode can allow
        an attacker to obtain plaintext from a block of cyphertext.
* DROPBEAR_DH_GROUP1 - This is documented as "less secure" while in
        newer versions mentioned as "too small for security".

Fixes: #1161
Change-type: minor
Changelog-entry: Enhanced security options for dropbear - sumo
Signed-off-by: Andrei Gherzan <andrei@resin.io>
@agherzan
Copy link
Contributor Author

agherzan commented Sep 4, 2018

Dropped in favour of: #1171

@agherzan agherzan closed this Sep 4, 2018
@agherzan agherzan deleted the ag_dropbear_security branch September 10, 2018 14:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@ZubairLK ZubairLK ZubairLK approved these changes

Assignees

@agherzan agherzan

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
2 participants
@agherzan @ZubairLK