OpenSSH Initial Cleartext Keyword Patch

This patch adds a pre-authentication step to ssh where the client where the client legitimizes to the server with an initial cleartext keyword.

This should exclude the vast majority of Internet hackers from the group of potential attackers on the ssh daemon, and provide peace of mind to sysadmins of remote boxes.

I'm solicitating user comments and feedback (no flames, please) to claus.fischer@clausfischer.com.

The Idea

Since remote exploits of the ssh server are very critical to me, and since I do not like to be forced updates under pressure of time, I have decided to customize my ssh version to use an initial cleartext keyword as a first round of authentication, before even exchanging protocol version strings.

This idea came to me after realizing that ssh, due to its highly complex multi-functional code, creates a new class of problems that old tools like telnet didn't have. As a consequence, there are situations where a telnet server would be 'more secure' than ssh.

An initial cleartext keyword exchange between client and server excludes hackers that have no access to the network between client and server from exploiting the more complex code inside ssh in case of possible bugs. This gives the sysadmin some relieve, and makes security updates less painfully stressy.

Due to the very simple code, the patch should be easy to verify and should not introduce new security problems.

Its use is limited, however, to situations where you have control over clients and servers, and do not mind violating the ssh RFC's.

Since there might be other Linux users who can appreciate such a feature, I'm providing this patch publicly and soliciting feedback. The OpenSSH folks have already indicated they are not interested.

How to use it

To enable the initial cleartext keyword exchange, put a line like

InitialCleartextKeyword somelongwordwithdigits12345andletters

into your /etc/ssh/sshd_config file. Obviously you shouldn't use any real passwords here, since this text is visible to anyone sniffing between client and server.

For the client, you have to use the new option -K:

ssh -K somelongwordwithdigits12345andletters other-options ...

Caveats

The patch is not complete; man pages, documentation, installed sshd_config files etc. should be modified as well.
The package has the same name as the original Debian package.
Activation of the keyword makes the protocol RFC-incompatible.
If the keyword is activated on the server, all clients must be patched. This probably excludes servers with a large public audience.

Feedback solicited

Why this is a good/bad idea.
Possibilities for improvements.
I have used isalpha() for 7-bit ASCII chars without verifying whether this is valid under various locales.

Patch and Debian Package

The patch initial_cleartext_keyword.patch against ssh_3.4p1-1 sources.

A modified ssh_3.4p1-1_i386.deb binary.