vyos-1x.git/src/migration-scripts/ssh/2-to-3, branch fix/T8955-http-api-verify-tlsVyOS command definitions, scripts, and utilities (mirror of https://github.com/vyos/vyos-1x.git)
https://git.amelek.net/vyos/vyos-1x.git/atom?h=fix%2FT8955-http-api-verify-tls2025-12-17T10:37:48+00:00ssh: T8098: migrate "rijndael-cbc@lysator.liu.se" to "aes256-cbc" cipher2025-12-17T10:37:48+00:00Christian Breunigchristian@breunig.cc2025-12-17T10:37:48+00:00urn:sha1:74b9f249cf1f49eb314f22d1f0a3c6a49ffb2596
According to [1] rijndael-cbc@lysator.liu.se is an alias for aes256-cbc which
was standardized in RFC4253 (2006).
This changes the migrator implementation to not only delete the old
"rijndael-cbc@lysator.liu.se" cipher from the CLI and set the new, standardized
aes256-cbc SSH cipher.
1: https://github.com/openssh/openssh-portable/commit/03e93c753d7c223063a
ssh: T8098: rename "ciphers" CLI node to "cipher"2025-12-14T17:58:00+00:00Christian Breunigchristian@breunig.cc2025-12-14T17:58:00+00:00urn:sha1:ef13a6319a21c8030301aeebbeabf5148adb994c
Follow VyOS CLI best practices for using singular whenever possible to build a
CLI node. As we introduce a new migration 2 -> 3 for SSH we can correct this
minor detail.
ssh: T8098: remove support for deprecated "rijndael-cbc@lysator.liu.se" cipher2025-12-14T17:41:08+00:00Christian Breunigchristian@breunig.cc2025-12-14T17:41:08+00:00urn:sha1:812eea9a3a20afebc20b374a30ceac7f0d87c9b4
According to an Arch Linux forum discussion, the cipher
rijndael-cbc@lysator.liu.se was removed in OpenSSH 6.7.
References:
- https://bbs.archlinux.org/viewtopic.php?id=188613
- https://www.openssh.org/txt/release-6.7
- https://github.com/openssh/openssh-portable/commit/03e93c753d7c223063a