enabling "none" cipher

[Nacho]

> As for why your patch doesn't work, there hasn't been any change I'm aware of
> that would break it, but if you show us exactly which patch you're trying to
> use someone here might be able to help you.

Thank you, the patch is this:

https://github.com/freebsd/freebsd-ports/blob/main/security/openssh-portable/files/extra-patch-hpn

As instructed there I add to /usr/local/etc/ssh/ssh_config:

NoneEnabled yes
NoneSwitch yes

And to sshd_config:

NoneEnabled yes

But the client doesn't seem to support the "none" cipher no matter what:

% /usr/local/bin/ssh -Q cipher
3des-cbc
aes128-cbc
aes192-cbc
aes256-cbc
aes128-ctr
aes192-ctr
aes256-ctr
aes128-gcm at openssh.com
aes256-gcm at openssh.com
chacha20-poly1305 at openssh.com

% /usr/local/bin/ssh -T -c none localhost
Unknown cipher type 'none'

Also the patch seems to be inside the ssh binary:

% strings -a /usr/local/bin/ssh | egrep 'None|NONE'
NoneSwitch is found in %.200s.
NoneSwitch directive found in %.200s.
<NONE>
WARNING: ENABLED NONE CIPHER
Cannot switch to NONE cipher with tty allocated
NONE cipher switch disabled when a TTY is allocated
Requesting NONE. Authflag is %d
None requested post authentication.

As for the server, if I add this in sshd_config:

Ciphers chacha20-poly1305 at openssh.com,aes256-gcm at openssh.com,none

It will refuse to start with:

/usr/local/etc/ssh/sshd_config line 38: Bad SSH2 cipher spec 'chacha20-poly1305 at openssh.com,aes256-gcm at openssh.com,none'.

> Stock OpenSSH does not support the "none" cipher.  It's counter to the
> project's goals of "putting an end to unencrypted logins" and "keeping your
> communiques secret", and it's also the kind of thing that has been used for
> protocol downgrade attacks in the past.
 
Of course, I agree with that reasoning, but this is for a special use case where
several slow embedded systems are connected to a server through a local wired
switch, sometimes they must transfer big amounts of data and it slows down the
whole application because of the cipher.

I will make separate openssh packages so the one with the none cipher will not
get installed in a public server.