sshd versions 1.2.20+ sometimes lies about the host key size by one bit and the OpenSSH ssh client reports a message like Warning: Server lies about size of server host key: actual size is 1023 bits vs. announced 1024. I've only observed it to report even numbers and have an actual size of one less. Similarly, ssh clients of the same vintage require reported sizes that are even numbers which can be a problem if one of old host keys that are actually one bit off are moved forward from the old SSH to OpenSSH. I will attach a patch.
Created attachment 30 [details] Patch against CVS of March 1, 2003
what is this for? the warning is in ssh intentionally. the error has nothing to do with the software version of the server, it's a problem with the key.
Since this is a normal case, I don't think the warning belongs there in the client. I have many users who have no control over what the remote end is, and the warning will mess up their scripts. On the server side, it would be unacceptable to regenerate SSH1 host keys when I upgrade from old SSH to OpenSSH, and some of those old keys are an odd size and the old SSH client chokes on them if we don't round them up to an even number like the old SSH server did. Compat.c already simulates many old bugs so I don't think one more would hurt.
but the warning is for the case you try to disable. and it does not depend on a specific versions of the sshd. another option would be: change the log() to verbose() so it's not in the default
That would be fine with me to have it be only in verbose mode. However, SSH_BUG_SERVERLIESSIZE is still needed because the old clients require key sizes to be reported as an even number of bits, and we wouldn't want to emulate that bug for newer clients. You say that it doesn't depend on the version of sshd and I assume that extends to the ssh client, but I think it's fair to only accommodate the clients known to be picky and which are still pretty commonly found. I will attach a new suggested patch. I have added a comment explaining the known scenario which the warning is for so people who look will know that it is intentionally for this case.
Created attachment 31 [details] New patch changing server lies log()s to verbose()s
assign to markus
*** Bug 34 has been marked as a duplicate of this bug. ***
it's unlikely that this gets changed in the near future. these keys are IMHO broken.
Mass change of RESOLVED bugs to CLOSED