bugzilla-daemon at bugzilla
Jan 31, 2012, 8:22 AM
Post #1 of 1
(87 views)
Permalink
|
|
[Bug 1974] New: Support for encrypted host keys
|
|
https://bugzilla.mindrot.org/show_bug.cgi?id=1974
Bug #: 1974
Summary: Support for encrypted host keys
Classification: Unclassified
Product: Portable OpenSSH
Version: 5.9p1
Platform: All
OS/Version: All
Status: NEW
Severity: enhancement
Priority: P2
Component: sshd
AssignedTo: unassigned-bugs [at] mindrot
ReportedBy: zevweiss [at] gmail
Created attachment 2125
--> https://bugzilla.mindrot.org/attachment.cgi?id=2125
Patch to implement support for encrypted host keys in sshd
(Copy/paste from this post to the mailing list:
http://marc.info/?l=openssh-unix-dev&m=132774431906364&w=2)
I recently found myself wanting to run sshd with passphrase-protected
host keys rather than the usual unencrypted format, and was somewhat
surprised to discover that sshd did not support this. I'm not sure if
there's any particular reason for that, but I've developed the
[attached] patch (relative to current CVS at time of writing) that
implements this. It prompts for the passphrase when the daemon is
started, similarly to Apache's behavior with encrypted SSL
certificates.
My initial implementation instead operated by passing the passphrase
along to the rexec child, but I decided I thought it was slightly nicer
to decrypt the key once and pass it along rather than redoing it every
time. I can send the previous version if that would be preferred
though -- this key-passing version does have some resulting ugliness in
its handling of options.num_host_key_files, as described in a comment
in the patch.
--
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.
_______________________________________________
openssh-bugs mailing list
openssh-bugs [at] mindrot
https://lists.mindrot.org/mailman/listinfo/openssh-bugs
|
