diff options
| author | Christian Breunig <christian@breunig.cc> | 2025-12-17 11:37:48 +0100 |
|---|---|---|
| committer | Christian Breunig <christian@breunig.cc> | 2025-12-17 11:37:48 +0100 |
| commit | 74b9f249cf1f49eb314f22d1f0a3c6a49ffb2596 (patch) | |
| tree | 6b64543188903a97a33826e0fcd889bbd3de8c17 /src/migration-scripts | |
| parent | ef13a6319a21c8030301aeebbeabf5148adb994c (diff) | |
| download | vyos-1x-74b9f249cf1f49eb314f22d1f0a3c6a49ffb2596.tar.gz vyos-1x-74b9f249cf1f49eb314f22d1f0a3c6a49ffb2596.zip | |
ssh: T8098: migrate "rijndael-cbc@lysator.liu.se" to "aes256-cbc" cipher
According to [1] rijndael-cbc@lysator.liu.se is an alias for aes256-cbc which
was standardized in RFC4253 (2006).
This changes the migrator implementation to not only delete the old
"rijndael-cbc@lysator.liu.se" cipher from the CLI and set the new, standardized
aes256-cbc SSH cipher.
1: https://github.com/openssh/openssh-portable/commit/03e93c753d7c223063a
Diffstat (limited to 'src/migration-scripts')
| -rw-r--r-- | src/migration-scripts/ssh/2-to-3 | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/src/migration-scripts/ssh/2-to-3 b/src/migration-scripts/ssh/2-to-3 index ac9f7156c..a3665af1e 100644 --- a/src/migration-scripts/ssh/2-to-3 +++ b/src/migration-scripts/ssh/2-to-3 @@ -14,8 +14,11 @@ # along with this library. If not, see <http://www.gnu.org/licenses/>. # T8098: rijndael-cbc@lysator.liu.se was removed in OpenSSH 6.7 which is used -# starting with VyOS 1.4. Also rename "ciphers" -> "cipher" to follow our -# CLI guidelines to use singular when possible +# starting with VyOS 1.4 - It is an alias for aes256-cbc which was +# standardized in RFC4253, adjust CLI accordingly. +# https://github.com/openssh/openssh-portable/commit/03e93c753d7c223063a +# Also rename "ciphers" -> "cipher" to follow our CLI guidelines to use +# singular when possible from vyos.configtree import ConfigTree @@ -37,3 +40,4 @@ def migrate(config: ConfigTree) -> None: for cipher in config.return_values(new_path): if cipher == deprecated_cipher: config.delete_value(new_path, value=deprecated_cipher) + config.set(new_path, value='aes256-cbc', replace=False) |