ssh client: blowfish-cbc required - missing in bionic

[Jens Elkner]

In bionic openssh client/server ships without blowfish-cbc, arcfour, arcfour128, arcfour256 and cast128-cbc. Unfortunately they are required for backward compatibility, especially for embedded devices, which do not support other ciphers (e.g. Rittal Liquid Cooling Package for racks).

So disable them per default is ok, but one should still be able to use them on demand for older, non-upgradable HW/SW envs.

[Seth Arnold (seth-arnold)]

Hello Jens, I believe the openssh-client-ssh1 package provides a client that can be used to communicate with legacy hardware.

Thanks

[Jens Elkner (jelmd)]

No, this is not an option. Also note, that this breaks a lot of workflows without reason, because Ubuntu ssh client simply stops working with a message like "~/.ssh/config line 3: Bad SSH2 cipher spec '...'": it simply does not know such ciphers (does not ignore them). So especially in environments with shared homes bionic (the usual case in enterprises?) cannot be deployed (and telling people, that they need to use different options when the are on bionic, is simply is useless pain for the users as well as company hotlines).

Ubuntu should do, what all major enterprise ready distributions/unices do, i.e. bundle support for those ciphers for backward compatibility, but disable them per default).