[openssh-commits] [openssh] 01/01: upstream: make CheckHostIP default to 'no'. It doesn't provide any

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit 6cb52d5bf771f6769b630fce35a8e9b8e433044f
Author: djm at openbsd.org <djm at openbsd.org>
Date:   Fri Jan 8 04:49:13 2021 +0000

    upstream: make CheckHostIP default to 'no'. It doesn't provide any
    
    perceptible value and makes it much harder for hosts to change host keys,
    particularly ones that use IP-based load-balancing.
    
    ok dtucker@
    
    OpenBSD-Commit-ID: 0db98413e82074f78c7d46784b1286d08aee78f0
---
 readconf.c   | 4 ++--
 ssh_config.5 | 8 ++++----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/readconf.c b/readconf.c
index 2a7870a1..37f92e25 100644
--- a/readconf.c
+++ b/readconf.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: readconf.c,v 1.347 2020/12/22 03:05:31 tb Exp $ */
+/* $OpenBSD: readconf.c,v 1.348 2021/01/08 04:49:13 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo at cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -2297,7 +2297,7 @@ fill_default_options(Options * options)
 	if (options->batch_mode == -1)
 		options->batch_mode = 0;
 	if (options->check_host_ip == -1)
-		options->check_host_ip = 1;
+		options->check_host_ip = 0;
 	if (options->strict_host_key_checking == -1)
 		options->strict_host_key_checking = SSH_STRICT_HOSTKEY_ASK;
 	if (options->compression == -1)
diff --git a/ssh_config.5 b/ssh_config.5
index 04da0575..18a98a8f 100644
--- a/ssh_config.5
+++ b/ssh_config.5
@@ -33,8 +33,8 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $OpenBSD: ssh_config.5,v 1.340 2020/12/22 07:40:26 jmc Exp $
-.Dd $Mdocdate: December 22 2020 $
+.\" $OpenBSD: ssh_config.5,v 1.341 2021/01/08 04:49:13 djm Exp $
+.Dd $Mdocdate: January 8 2021 $
 .Dt SSH_CONFIG 5
 .Os
 .Sh NAME
@@ -421,7 +421,6 @@ or
 .It Cm CheckHostIP
 If set to
 .Cm yes
-(the default),
 .Xr ssh 1
 will additionally check the host IP address in the
 .Pa known_hosts
@@ -432,7 +431,8 @@ and will add addresses of destination hosts to
 in the process, regardless of the setting of
 .Cm StrictHostKeyChecking .
 If the option is set to
-.Cm no ,
+.Cm no
+(the default),
 the check will not be executed.
 .It Cm Ciphers
 Specifies the ciphers allowed and their order of preference.

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.