public inbox for [email protected]  

help / color / mirror / Atom feed

From: Sven <[email protected]>
To: [email protected]
Subject: Re: SSH tunnel key exchange methods
Date: Fri, 27 Nov 2015 09:23:42 +0000 (UTC)
Message-ID: <[email protected]> (raw)
List-Unsubscribe:  <mailto:[email protected]?body=unsub%20pgadmin-support>

> The key exchange methods offered when opening an SSH tunnel are all 
> SHA1 and therefore too weak:
>
> [sshd] fatal: Unable to negotiate with xxx.xxx.xxx.xxx: no matching 
> key exchange method found. Their offer:
> diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,
> diffie-hellman-group1-sha1 [preauth]

Any news on this? If there's no easy way to add safer kexes, I suggest 
you disable the SSH feature altogether. SHA1 is dead and IMO nobody 
should trust a connection established with SHA1 kexes in order to talk 
to databases.



-- 
Sent via pgadmin-support mailing list ([email protected])
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgadmin-support

view thread (17+ messages)  latest in thread

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: [email protected]
  Cc: [email protected], [email protected]
  Subject: Re: SSH tunnel key exchange methods
  In-Reply-To: <[email protected]>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox