FYI: SSH1 now disabled at compile-time by default

[Damien Miller]

On Tue, 24 Mar 2015, Nico Kadel-Garcia wrote:

> If it's disabled by default in any major distributions, it's going
> to break a lot of git repositories, svn+ssh repositories, and rsync
> environments.

The chronology doesn't support this.

When Subversion 1.0 was released in 2004, OpenSSH had been defaulting to
protocol v.2 for almost three years.

git was first released two years later, at which time v.2 had been the
default for over five years.

Seriously, protocol 2 became the default in *2001* and the old protocol
has been disabled for new sshd installs for the last eight years. If
anything, we've moved way too slowly.

> Can it wait until version 7, instead of being slipped into a minor
> update?

Our version number has been a simple counter for years; the first digit
of the version has no significance beyond that.

Distributions will make their own decisions about what to support and
they already ship far more intrusive changes than flipping a configure
switch. I hope they ship a "openssh-ssh1" package instead of just
setting it back through.

-d