Subject: ssh1 doc?

From: der Mouse <[email-masked]>
Date: Wed, 17 Jun 2009 16:23:37 -0400 (EDT)

A while back (a year or two?), I asked if there was any ssh1 protocol
documentation, and I was told the closest thing that existed was the
ssh1 implementations' source code.

Is that (still) true now?  I'm asking because I want to write ssh1
compatability support for moussh, so I'll need ssh1 protocol
documentation.  I'm prepared to read source code and write up
documentation if necessary, but I don't see much value in duplicating
effort if someone else has already done it.

/~\ The ASCII				  Mouse
\ / Ribbon Campaign
 X  Against HTML		[email-masked]
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B

---

From: Jan Pechanec <[email-masked]>
Date: Wed, 17 Jun 2009 22:30:20 +0200 (CEST)

>effort if someone else has already done it.

	I'd say that the only documentation is this old draft by Tatu 
Ylonen:

	http://www.snailbook.com/docs/protocol-1.5.txt

	J.

-- 
Jan Pechanec

---

From: Chris Lonvick <[email-masked]>
Date: Wed, 17 Jun 2009 13:42:33 -0700 (PDT)

Hi,

There's the "RFC" file in the old distributions.  Find a copy of 
ssh-1.2.30.tar, open it up and see if that's what you want.

Regards,
Chris

---

From: Peter Gutmann <[email-masked]>
Date: Thu, 18 Jun 2009 22:36:41 +1200

Jan Pechanec <[email-masked]> writes:

>I'd say that the only documentation is this old draft by Tatu Ylonen:
>

There's also his 1996 Usenix Security paper:

  http://www.usenix.org/publications/library/proceedings/sec96/ylonen.html

although that's more a high-level overview.

Oh, and a question for der Mouse, just out of curiosity, isn't it a bit late
to be doing SSHv1? :-).

Peter.

---

From: der Mouse <[email-masked]>
Date: Thu, 18 Jun 2009 14:10:53 -0400 (EDT)

> Oh, and a question for der Mouse, just out of curiosity, isn't it a
> bit late to be doing SSHv1? :-).

Well, yes.  In some respects, I wouldn't waste machine cycles, much
less brain cycles, on ssh1.  But at $DAYJOB we have a few internal
machines which still are ssh1-only (behind our firewall/NAT, to be
sure) that I want to log in to from my desktop.  I've been using the
same ssh1 implementation moussh replaced as my primary remote-login
tool, but (a) I'd like to use a moussh client so that it can share
things like keys files and agent access, and (b) making ssh1 compat
available in moussh for others in similar situations is something I've
been wanting to do for a year or two now.

I hardly want to encourage ssh1 use, certainly.  I've been unsure just
how strongly I want to discourage it; I can imagine a whole spectrum of
possibilties, all the way from "don't distribute any ssh1 compat code"
to "ship moussh with full automatic ssh1 fallback" - I'm currently
tending towards a default of "compiled in but disabled unless a
config-file switch is flipped".

Another reason is curiosity: I have never learned the ssh1 protocol,
and I would like to, even if only to be able to make more-informed
judgements about its risks and thus suitability for a given
environment.

/~\ The ASCII				  Mouse
\ / Ribbon Campaign