DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:subject:to:references:from:message-id:date
	:mime-version:in-reply-to:content-type
	:content-transfer-encoding; q=dns; s=default; b=UlVt/QakBB6vTKXq
	oGsMgPbbx43YtKks4BA5RZLSLsdUfhGa2o10jydbRSh79cLE14hlLaIqGkyrrQv+
	s7dvRk8hf5UADjVOGR1uNaBoZs5dmbc/8Js6GMbAhMgIbn7tvcLMoilVzE+61MxN
	F/CwYVxbuO+1AJ6BAAV2x0jwUO8=
Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm
Sender: cygwin-owner@cygwin.com
Mail-Followup-To: cygwin@cygwin.com
Subject: Re: Downgrade opensshh from 7.4 to 5.1?
To: cygwin@cygwin.com
References: <CA+XsFcEFOjSHq7J9kbFCdd6bZndcxKmipvmEFXdKGFP2gYCqKA@mail.gmail.com> <9894fed9-9416-d3cf-71c6-3640291c59ac@gmail.com> <CANnLRdiHY-UnkbLtxCy0NVGrTcOCN0ZgoQmMt0qaM2BWZnCoFg@mail.gmail.com>
From: cyg Simple <cygsimple@gmail.com>
Message-ID: <86046d97-ecc0-ce4e-def4-43becdb1347c@gmail.com>
Date: Tue, 4 Apr 2017 08:25:55 -0400
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.8.0
MIME-Version: 1.0
In-Reply-To: <CANnLRdiHY-UnkbLtxCy0NVGrTcOCN0ZgoQmMt0qaM2BWZnCoFg@mail.gmail.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit

On 4/3/2017 12:23 PM, Stephen John Smoogen wrote:
> On 3 April 2017 at 11:03, cyg Simple <cygsimple@gmail.com> wrote:
>> On 4/3/2017 10:45 AM, Kleine Raphael wrote:
>>> Hello
>>>
>>> My client can not support OpenSSH_7.2p2 (OpenSSL 1.0.2h  3 May 2016)
>>> and I must downgrade the server to OpenSSH_5.1p1 (OpenSSL 0.9.8l 5 Nov
>>> 2009)
>>>
>>
>> Explain more the "can not support".
>>
> 
> While I agree we need more information, this may be one of the cases
> where a person is trying to be circumspect due to other policies.
> 
> I think that the OpenSSH after 6.9 started dropping support for older
> algorithms (https://www.openssh.com/txt/release-7.0) . If you are
> using SSH to manage various industrial equipment then you are pretty
> much stuck with using older SSH because the equipment may only support
> RC4 or maybe only has keys of 512 or 768 bits. [Trying to get an
> industrial manufacturer to update equipment is a multi-decade process.
> They may have just started creating hardware which has SSH vs straight
> telnet and they won't update to a newer version of SSH until 2028 :/]

That may be true except for PCI compliance[1] where every piece of
equipment between the processor and computer needs to be 1024 bit
standard.  I'm well aware of the fact that the change takes time even in
my own professional job there are still certificates that carry the 512
bit cert data.  That doesn't mean the business is not trying to upgrade
but due to the sheer mass of computers running the business there are a
few with OLD, OUT-OF-DATE hardware and OS.  However where the business
is outward facing the whole process has been updated without delay.

[1]
https://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Security_Standard

-- 
cyg Simple

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple