mirror of
https://git.tartarus.org/simon/putty.git
synced 2025-01-09 17:38:00 +00:00
b80a41d386
The Terrapin vulnerability affects the modified binary packet protocol used with ChaCha20+Poly1305, and also CBC-mode ciphers in ETM mode. It's best prevented by the new strict-kex mode, but if the server can't handle that protocol alteration, another approach is to change PuTTY's configuration so that it will negotiate a different algorithm. That may not be possible either (an obvious case being if the server has been manually configured to _only_ support vulnerable modes). But if it is possible, then it would be nice for us to detect that and show how to do it. That could be a hard problem in general, but the most likely cause of it is configuring ChaCha20 to the top of the cipher list, so that it's selected ahead of things that aren't vulnerable. And it's reasonably easy to do just one fantasy-renegotiation, having moved ChaCha20 down to below the warn line, and see if that sorts it out. If it does, we can pass on that advice to the user. |
||
---|---|---|
charset | ||
cmake | ||
contrib | ||
crypto | ||
doc | ||
icons | ||
keygen | ||
otherbackends | ||
proxy | ||
ssh | ||
stubs | ||
terminal | ||
test | ||
unix | ||
utils | ||
windows | ||
.gitignore | ||
aqsync.c | ||
be_list.c | ||
Buildscr | ||
Buildscr.cv | ||
callback.c | ||
cgtest.c | ||
CHECKLST.txt | ||
clicons.c | ||
CMakeLists.txt | ||
cmdgen.c | ||
cmdline.c | ||
config.c | ||
console.c | ||
console.h | ||
defs.h | ||
dialog.c | ||
dialog.h | ||
errsock.c | ||
import.c | ||
LATEST.VER | ||
ldisc.c | ||
LICENCE | ||
licence.pl | ||
logging.c | ||
marshal.h | ||
misc.h | ||
mksrcarc.sh | ||
mkunxarc.sh | ||
mpint.h | ||
network.h | ||
pageant.c | ||
pageant.h | ||
pinger.c | ||
pscp.c | ||
psftp.c | ||
psftp.h | ||
psftpcommon.c | ||
psocks.c | ||
psocks.h | ||
putty.h | ||
puttymem.h | ||
README | ||
release.pl | ||
settings.c | ||
sign.sh | ||
ssh.h | ||
sshcr.h | ||
sshkeygen.h | ||
sshpubk.c | ||
sshrand.c | ||
storage.h | ||
timing.c | ||
tree234.h | ||
version.h | ||
x11disp.c |
This is the README for PuTTY, a free Windows and Unix Telnet and SSH client. PuTTY is built using CMake <https://cmake.org/>. To compile in the simplest way (on any of Linux, Windows or Mac), run these commands in the source directory: cmake . cmake --build . Then, to install in the simplest way on Linux or Mac: cmake --build . --target install On Unix, pterm would like to be setuid or setgid, as appropriate, to permit it to write records of user logins to /var/run/utmp and /var/log/wtmp. (Of course it will not use this privilege for anything else, and in particular it will drop all privileges before starting up complex subsystems like GTK.) The cmake install step doesn't attempt to add these privileges, so if you want user login recording to work, you should manually ch{own,grp} and chmod the pterm binary yourself after installation. If you don't do this, pterm will still work, but not update the user login databases. Documentation (in various formats including Windows Help and Unix `man' pages) is built from the Halibut (`.but') files in the `doc' subdirectory. If you aren't using one of our source snapshots, you'll need to do this yourself. Halibut can be found at <https://www.chiark.greenend.org.uk/~sgtatham/halibut/>. The PuTTY home web site is https://www.chiark.greenend.org.uk/~sgtatham/putty/ If you want to send bug reports or feature requests, please read the Feedback section of the web site before doing so. Sending one-line reports saying `it doesn't work' will waste your time as much as ours. See the file LICENCE for the licence conditions.