From sacadmin Tue Jan 16 09:28:55 2007 Received: from sac.sfbay.sun.com (localhost [127.0.0.1]) by sac.sfbay.sun.com (8.13.6+Sun/8.13.6) with ESMTP id l0GHSt4d004537; Tue, 16 Jan 2007 09:28:55 -0800 (PST) Received: (from darrenm@localhost) by sac.sfbay.sun.com (8.13.6+Sun/8.13.6/Submit) id l0GHStUt004533; Tue, 16 Jan 2007 09:28:55 -0800 (PST) Date: Tue, 16 Jan 2007 09:28:55 -0800 (PST) From: Darren J Moffat Message-Id: <200701161728.l0GHStUt004533@sac.sfbay.sun.com> To: PSARC@sac.sfbay.sun.com Cc: ssh-iteam@sun.com Subject: ssh/sshd resync with OpenSSH [PSARC/2007/034 Timeout: 01/23/2007] Status: RO Content-Length: 6068 Template Version: @(#)onepager.txt 1.30 06/09/28 SMI 1. Introduction 1.1. Project/Component Working Name: Resync selected features from OpenSSH to SUNWssh 1.2. Name of Document Author/Supplier: Jan Pechanec 1.3. Date of This Document: 01/05/07 1.4. Name of Major Document Customer(s)/Consumer(s): 1.4.2. The ARC(s) you expect to review your project: PSARC 1.4.4. The name of your business unit: Security 1.5. Email Aliases: 1.5.1. Responsible Manager: Craig.Payne@Sun.COM 1.5.2. Responsible Engineer: Jan.Pechanec@Sun.COM 1.5.3. Marketing Manager: Mark.Thacker@Sun.COM 1.5.4. Interest List: ssh-iteam@Sun.COM 2. Project Summary 2.1. Project Description: Resync selected features from OpenSSH to SUNWssh. Some of those features were requested by our customers, some of them we think that would be requested in the future. In both cases we think that features included in this proposal should be integrated into SUNWssh. Individual features introduced in this document may be put back separately. 2.2. Risks and Assumptions: None. 3. Business Summary 3.1. Problem Area: Customers want some features that can be found in OpenSSH. 3.3. Business Justification: There are people who install OpenSSH on Solaris machines to get these features. We think it's better for them to use our SUNWssh that is shipped and better integrated with Solaris. 3.4. Competitive Analysis: The most often used player is OpenSSH project which is what SUNWssh forked from in 2001. Many things we want to resync now are on our list because people ask "this can be done in OpenSSH, how can we do that in SUNWssh?" 4. Technical Description: 4.1. Details: I will resync with latest OpenSSH (4.5 now). It's an external code with existing open source review. 4.2. Bug/RFE Number(s): 6480090 ConnectTimeout functionality desired for SUNWssh This enables to specify the timeout in seconds used when connecting to the ssh server, instead of using the default system TCP timeout. This value is used only when the target is down or really unreachable, not when it refuses the connection. example usage: time ssh -o ConnectTimeout=10 -p 1234 shark ssh: connect to host shark port 1234: Operation timed out real 0m10.159s user 0m0.115s sys 0m0.033s 6268400 resync ServerAlive functionality This feature is very important when using SSH over a proxy. In that case TCPKeepAlive may not be of any use and ServerAlive is the feature that can help to keep connection up from client side (not all users can set ClientAliveInterval on server side). 6324633 OpenSSH HashKnownHost functionality desired for SUNWssh Allows ssh to hash host names and addresses when they are added to ~/.ssh/known_hosts. These hashed names may be used normally by ssh and sshd, but they do not reveal identifying information should the file's contents be disclosed. The default settings won't use hashing. 5040151 ssh(1) and sshd(1M) should re-key periodically as per-recent recommendations RFC 4253 recommends that session keys are changed periodically. We can do that only manually with SUNWssh now. This RFE will allow automatic rekeying which will be disabled by default. 6472998 implement untrusted X11 forwarding in ssh(1) Implement untrusted X11 forwarding as per X11 security extensions specification. Trusted forwarding will continue to be the default mode. 6459966 add SOCKS version 5 for dynamic forwarding in ssh(1) Add suport for SOCKS5 for dynamic port forwarding. Version 5 supports DNS resolution and UDP support. 6506674 allow specific binding address to be used with -D option for ssh(1) Allow to specify one individual IP address for the dynamic binding. 4.5. Interfaces: We only add new exported interfaces and we follow OpenSSH syntax for all of them. Interface stability is Committed. Interfaces consist of: - new command line options - new keywords for ssh_config(5) configuration file 6480090 ConnectTimeout functionality desired for SUNWssh - NEW keyword for ssh_config(5): ConnectTimeout 6268400 resync ServerAlive functionality - NEW keyword for ssh_config(5): ServerAliveInterval - NEW keyword for ssh_config(5): ServerAliveCountMax 6324633 OpenSSH HashKnownHost functionality desired for SUNWssh - NEW keyword in ssh_config(5): HashKnownHosts - NEW options for ssh-keygen: ssh-keygen -F hostname [-f known_hosts_file] ssh-keygen -H [-f known_hosts_file] ssh-keygen -R hostname [-f known_hosts_file] 5040151 ssh(1) and sshd(1M) should re-key periodically as per-recent recommendations - NEW keyword for ssh_config(5): RekeyLimit 6472998 implement untrusted X11 forwarding in ssh(1) - NEW keyword for ssh_config(5): ForwardX11Trusted 6459966 add SOCKS version 5 for dynamic forwarding in ssh(1) - we extend "-D port" option meaning, the interface remains the same. It will now support not only SOCKS4 but SOCKS5 as well. ssh(1) will automatically recognize the protocol version number. 6506674 allow specific binding address to be used with -D option for ssh(1) - we extend "-D port" syntax to "-D [ip_address:]port" so that individual IP address can be optionaly specified. The new syntax is backward compatible. 4.6. Doc Impact: Manual pages for ssh(1), ssh_config(5) and ssh-keygen(1) will be changed. Diffmarked man pages in the materials directory. 4.7. Admin/Config Impact: We just add new command line options and configuration file keywords but default behaviour won't be changed. 4.9. I18N/L10N Impact: All new messages will be localized. 4.10. Packaging & Delivery: SUNWsshr, SUNWsshcu, SUNWman 4.11. Security Impact: N/A 4.12. Dependencies: N/A 5. Reference Documents: N/A 6. Resources and Schedule: 6.1. Projected Availability: project inception and integration: 1-2 Q 2007 6.5. ARC review type: FastTrack From sacadmin Wed Jan 17 17:10:45 2007 Received: from sfbaymail1sca.SFBay.Sun.COM (sfbaymail1sca.SFBay.Sun.COM [129.145.154.35]) by sac.sfbay.sun.com (8.13.6+Sun/8.13.6) with ESMTP id l0I1AjEX029464; Wed, 17 Jan 2007 17:10:45 -0800 (PST) Received: from nwk-ea-fw-1.sun.com (nwkes-gis-mail-1.SFBay.Sun.COM [10.4.134.5]) by sfbaymail1sca.SFBay.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id l0I1Aj5M006104; Wed, 17 Jan 2007 17:10:45 -0800 (PST) Received: from d1-sfbay-10.sun.com ([192.18.39.120]) by nwk-ea-fw-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id l0I1AeDH015553; Wed, 17 Jan 2007 17:10:40 -0800 (PST) Received: from conversion-daemon.d1-sfbay-10.sun.com by d1-sfbay-10.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) id <0JC100001HTD4R00@d1-sfbay-10.sun.com> (original mail from Ed.Gould@Sun.COM); Wed, 17 Jan 2007 17:10:40 -0800 (PST) Received: from [192.168.0.10] ([129.150.27.86]) by d1-sfbay-10.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) with ESMTPSA id <0JC100DH3HXRNRTU@d1-sfbay-10.sun.com>; Wed, 17 Jan 2007 17:10:40 -0800 (PST) Date: Wed, 17 Jan 2007 17:10:39 -0800 From: Ed Gould Subject: re: ssh/sshd resync with OpenSSH [PSARC/2007/034 Timeout: 01/23/2007] Sender: Ed.Gould@Sun.COM To: psarc Cc: ssh-iteam@Sun.COM, Darren J Moffat Message-id: <24c8068197061170fc4dda876b19b59d@sun.com> MIME-version: 1.0 X-Mailer: Apple Mail (2.624) Content-type: text/plain; format=flowed; charset=US-ASCII Content-transfer-encoding: 7BIT Status: RO Content-Length: 3386 The attached emails were sent to the wrong case log by mistake. --Ed Begin forwarded message: > From: Glenn Skinner > Date: January 16, 2007 17:23:28 PST > To: PSARC@sac.sfbay.sun.com, darrenm@sac.sfbay.sun.com > Cc: ssh-iteam@sun.com > Subject: Re: 2004/034 [ssh/sshd resync with OpenSSH] > Reply-To: Glenn Skinner > > Date: Tue, 16 Jan 2007 09:28:55 -0800 (PST) > From: Darren J Moffat > Subject: ssh/sshd resync with OpenSSH [PSARC/2007/034 Timeout: > 01/23/2007] > > ... > 2. Project Summary > 2.1. Project Description: > > Resync selected features from OpenSSH to SUNWssh. Some of > those features were requested by our customers, some of them we > think that would be requested in the future. In both cases we > think that features included in this proposal should be > integrated into SUNWssh. > > In looking through the feature list, I didn't see anything to > contradict the following claim, but just to be sure: Are all of the > proposed changes upward compatible with ssh as it currently exists in > Solaris? > > -- Glenn > Begin forwarded message: > From: Nicolas Williams > Date: January 16, 2007 17:57:30 PST > To: Glenn Skinner > Cc: PSARC@sac.sfbay.sun.com, darrenm@sac.sfbay.sun.com, > ssh-iteam@sun.com > Subject: Re: 2004/034 [ssh/sshd resync with OpenSSH] > > On Tue, Jan 16, 2007 at 05:23:28PM -0800, Glenn Skinner wrote: >> In looking through the feature list, I didn't see anything to >> contradict the following claim, but just to be sure: Are all of the >> proposed changes upward compatible with ssh as it currently exists in >> Solaris? > > They're all backward compatible, yes. Existing ~/.ssh/config, > /etc/ssh/ssh*_config files, and ssh(1) CLI uses should continue to work > as they do today. > > Note though that ssh(1) chokes on new ~/.ssh/config options, so > unpatched systems won't like uses of ConnectTimeout in there, for > example. > > Nico > -- Begin forwarded message: > From: Jan Pechanec > Date: January 17, 2007 1:21:25 PST > To: Glenn Skinner > Cc: PSARC@sac.sfbay.sun.com, Nicolas Williams > , darrenm@sac.sfbay.sun.com, > ssh-iteam@sun.com > Subject: Re: 2004/034 [ssh/sshd resync with OpenSSH] > > On Tue, 16 Jan 2007, Nicolas Williams wrote: > >> On Tue, Jan 16, 2007 at 05:23:28PM -0800, Glenn Skinner wrote: >>> In looking through the feature list, I didn't see anything to >>> contradict the following claim, but just to be sure: Are all of the >>> proposed changes upward compatible with ssh as it currently exists in >>> Solaris? >> >> They're all backward compatible, yes. Existing ~/.ssh/config, >> /etc/ssh/ssh*_config files, and ssh(1) CLI uses should continue to >> work >> as they do today. >> >> Note though that ssh(1) chokes on new ~/.ssh/config options, so >> unpatched systems won't like uses of ConnectTimeout in there, for >> example. > > and for the record, that will be fixed when I implement > PSARC/2004/505/ that was filed by Nico some time ago. > > however, I don't plan to change shipped /etc/ssh/ssh_config or > /etc/ssh/sshd_config since defaults documented in man pages will be > good > enough. > > Jan. > > -- > Jan Pechanec From Darren.Moffat@sun.com Wed Jan 31 09:37:05 2007 Received: from sunmail4.Singapore.Sun.COM (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.6+Sun/8.13.6) with ESMTP id l0VHb3eA020575 for ; Wed, 31 Jan 2007 09:37:04 -0800 (PST) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail4.Singapore.Sun.COM (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id l0VHaqE2025555 for <@sunmail3mpk.sfbay.sun.com:psarc-ext@sun.com>; Thu, 1 Feb 2007 01:37:02 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JCQ00H0RU9PI100@nwk-avmta-2.sfbay.sun.com> for psarc-ext@sun.com (ORCPT psarc-ext@sun.com); Wed, 31 Jan 2007 09:37:01 -0800 (PST) Received: from gmp-ea-fw-1.sun.com ([129.156.42.6]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JCQ00CYBU9OD1D0@nwk-avmta-2.sfbay.sun.com> for psarc-ext@sun.com (ORCPT psarc-ext@sun.com); Wed, 31 Jan 2007 09:37:01 -0800 (PST) Received: from d1-emea-09.sun.com ([192.18.2.119]) by gmp-ea-fw-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id l0VHaxxx012114 for ; Wed, 31 Jan 2007 17:37:00 +0000 (GMT) Received: from conversion-daemon.d1-emea-09.sun.com by d1-emea-09.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) id <0JCQ00H01U863A00@d1-emea-09.sun.com> (original mail from Darren.Moffat@Sun.COM) for psarc-ext@sun.com (ORCPT psarc-ext@sun.com); Wed, 31 Jan 2007 17:36:59 +0000 (GMT) Received: from [129.156.173.21] by d1-emea-09.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) with ESMTPSA id <0JCQ005F8U9MS630@d1-emea-09.sun.com> for psarc-ext@sun.com (ORCPT psarc-ext@sun.com); Wed, 31 Jan 2007 17:36:59 +0000 (GMT) Date: Wed, 31 Jan 2007 17:36:58 +0000 From: Darren J Moffat Subject: PSARC/2007/034 ssh/sshd resync with OpenSSH Sender: Darren.Moffat@sun.com To: psarc-ext@sun.com Message-id: <45C0D3BA.5010408@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 User-Agent: Thunderbird 1.5.0.8 (X11/20061204) Status: RO Content-Length: 111 The timer has expired and there were no unresolved issues. This case is closed approved. -- Darren J Moffat From sacadmin Wed Jan 31 09:37:11 2007 Received: from sunmail4.Singapore.Sun.COM (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.6+Sun/8.13.6) with ESMTP id l0VHb9f5020579 for ; Wed, 31 Jan 2007 09:37:10 -0800 (PST) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail4.Singapore.Sun.COM (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id l0VHauuf025566; Thu, 1 Feb 2007 01:37:00 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JCQ00301U9M8500@nwk-avmta-1.sfbay.Sun.COM>; Wed, 31 Jan 2007 09:36:58 -0800 (PST) Received: from nwk-ea-fw-1.sun.com ([10.4.134.5]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JCQ00I3TU9LN450@nwk-avmta-1.sfbay.Sun.COM>; Wed, 31 Jan 2007 09:36:57 -0800 (PST) Received: from d1-sfbay-09.sun.com ([192.18.39.119]) by nwk-ea-fw-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id l0VHav7R027262; Wed, 31 Jan 2007 09:36:57 -0800 (PST) Received: from conversion-daemon.d1-sfbay-09.sun.com by d1-sfbay-09.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) id <0JCQ00G01U83LO00@d1-sfbay-09.sun.com> (original mail from Sherri.Shieh@Sun.COM); Wed, 31 Jan 2007 09:36:57 -0800 (PST) Received: from [129.145.154.108] by d1-sfbay-09.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) with ESMTPSA id <0JCQ006OSU9KUVHG@d1-sfbay-09.sun.com>; Wed, 31 Jan 2007 09:36:57 -0800 (PST) Date: Wed, 31 Jan 2007 09:36:56 -0800 From: Sherri Shieh Subject: PSARC Fast Track: ssh/sshd resync with OpenSSH (2007/034) Sender: Sherri.Shieh@Sun.COM To: psarc@Sun.COM, Darren Moffat , Jan.Pechanec@Sun.COM Cc: ssh-iteam@Sun.COM Message-id: <45C0D3B8.8040905@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=us-ascii Content-transfer-encoding: 7BIT X-Accept-Language: en-us, en X-PMX-Version: 5.2.0.264296 User-Agent: Mozilla/5.0 (X11; U; SunOS sun4v; en-US; rv:1.7) Gecko/20060120 Status: RO Content-Length: 341 This case has been marked closed approved based on last week's meeting. - Sherri -- ========================================================= Sherri Shieh Sun Microsystems, Inc. Program Manager Email: sherri.shieh@sun.com Systems Architecture Phone: 650-786-5245/x85245 ===========================================================