Does RekeyLimit property in sshd_config enforce re-keying / key re-exchange?

Question

I have set the RekeyLimit property in sshd_config and tried to perform a SSH. However, I could not see rekeying happening in the verbose logs, all I see is the log message below at the start of the session (in my sshd server logs).

debug3: rekey after 2048 bytes, 0 seconds [preauth]

Only when I enable the RekeyLimit on my SSH client (ssh_config) or use ~R, do I see the logs pertaining to the rekeying activity.

Is this expected? Shouldn't the RekeyLimit property in sshd_config enforce rekeying?

I am using OpenSSH 6.7.

Answer 1

Actually, this is quite interesting question. I had to look into it, how does it actually work. Direct initiation of rekeying using ~R works fine as you describe and it is expected. If client forces rekey, it is also working, but the server side is somehow suppressed. In the code, this variable is handled without special care and if I am right, the client offer overwrites the server's setup, which may not have be intentional and can be interesting topic on openssh-unix-dev list, if there will be no better answer.

It is not specified in the RFC4253, how this should be handled, so it is implementation detail.

However, the rekeying should not be needed to do more frequently than the default, because it stems from MAC sequence number wrapping [RFC4251].

Edit: Rekeying was reworked a bit and in openssh-7.2 should be working better.