OpenSSH 4.0 has just been released. It will be available from the
mirrors listed at http://www.openssh.com/ shortly.
OpenSSH is a 100% complete SSH protocol version 1.3, 1.5 and 2.0
implementation and includes sftp client and server support.
We would like to thank the OpenSSH community for their continued
support to the project, especially those who contributed source and
bought T-shirts or posters.
We have a new design of T-shirt available, more info on
http://www.openbsd.org/tshirts.html#18
For international orders use http://https.openbsd.org/cgi-bin/order
and for European orders, use http://https.openbsd.org/cgi-bin/order.eu
Changes since OpenSSH 3.9:
============================
* ssh(1) now allows the optional specification of an address to bind to
in port forwarding connections (local, remote and dynamic). Please
refer to the documentation for the -L and -R options in the ssh(1)
manual page and the LocalForward and RemoteForward options in the
ssh_config(5) manpage. (Bugzilla #413)
* To control remote bindings while retaining backwards compatibility,
sshd(8)'s GatewayPorts option has been extended. To allow client
specified bind addresses for remote (-R) port forwardings, the server
must be configured with "GatewayPorts clientspecified".
* ssh(1) and ssh-keyscan(1) now support hashing of host names and
addresses added to known_hosts files, controlled by the ssh(1)
HashKnownHosts configuration directive. This option improves user
privacy by hiding which hosts have been visited. At present this
option is off by default, but may be turned on once it receives
sufficient testing.
* Added options for managing keys in known_hosts files to ssh-keygen(1),
including the ability to search for hosts by name, delete hosts by
name and convert an unhashed known_hosts file into one with hashed
names. These are particularly useful for managing known_hosts files
with hashed hostnames.
* Improve account and password expiry support in sshd(8). Ther server
will now warn in advance for both account and password expiry.
* sshd(8) will now log the source of connections denied by AllowUsers,
DenyUsers, AllowGroups and DenyGroups (Bugzilla #909)
* Added AddressFamily option to sshd(8) to allow global control over
IPv4/IPv6 usage. (Bugzilla #989)
* Improved sftp(1) client, including bugfixes and optimisations for the
``ls'' command and command history and editing support using libedit.
* Improved the handling of bad data in authorized_keys files,
eliminating fatal errors on corrupt or very large keys. (Bugzilla
#884)
* Improved connection multiplexing support in ssh(1). Several bugs
have been fixed and a new "command mode" has been added to allow the
control of a running multiplexing master connection, including
checking that it is up, determining its PID and asking it to exit.
* Have scp(1) and sftp(1) wait for the spawned ssh to exit before they
exit themselves. This prevents ssh from being unable to restore
terminal modes (not normally a problem on OpenBSD but common with
-Portable on POSIX platforms). (Bugzilla #950)
* Portable OpenSSH:
- Add *EXPERIMENTAL* BSM audit support for Solaris systems
(Bugzilla #125)
- Enable IPv6 on AIX where possible (see README.platform for
details), working around a misfeature of AIX's getnameinfo.
(Bugzilla #835)
- Teach sshd(8) to write failed login records to btmp for
unsuccessful auth attempts. Currently this is only for password,
keyboard-interactive and challenge/response authentication methods
and only on Linux and HP-UX.
- sshd(8) now sends output from failing PAM session modules to the
user before exiting, similar to the way /etc/nologin is handled
- Store credentials from gssapi-with-mic authentication early enough
to be available to PAM session modules when privsep=yes.
Checksums:
=========
- MD5 (openssh-4.0.tgz) = 7dbf15fe7c294672e8822127f50107d0
- MD5 (openssh-4.0p1.tar.gz) = 122bec49d2cace00b71cc29b5ececed3
Reporting Bugs:
==============
- please read http://www.openssh.com/report.html
and http://bugzilla.mindrot.org/
OpenSSH is brought to you by Markus Friedl, Niels Provos, Theo de Raadt,
Kevin Steves, Damien Miller, Ben Lindstrom, Darren Tucker and Tim Rice.
On Mar 9 02:54, Damien Miller wrote:> OpenSSH 4.0 has just been released. It will be available from the > mirrors listed at http://www.openssh.com/ shortly. > [...] > - MD5 (openssh-4.0.tgz) = 7dbf15fe7c294672e8822127f50107d0 > - MD5 (openssh-4.0p1.tar.gz) = 122bec49d2cace00b71cc29b5ececed3I just downloaded openssh-4.0p1.tar.gz from ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/ and I'm getting another MD5 sum: $ md5sum openssh-4.0p1.tar.gz 7b36f28fc16e1b7f4ba3c1dca191ac92 openssh-4.0p1.tar.gz I'm wondering if that's just a wrong MD5 sum inthe announcement or if the version actually differs. Corinna -- Corinna Vinschen Cygwin Project Co-Leader Red Hat, Inc.
On Wed, Mar 09, 2005 at 06:11:22PM +0100, Rainer Peter Feller wrote:> On Wed, 2005-03-09 at 02:54 -0700, Damien Miller wrote: > <SNIP> > > > Checksums: > > =========> > > > - MD5 (openssh-4.0.tgz) = 7dbf15fe7c294672e8822127f50107d0 > > - MD5 (openssh-4.0p1.tar.gz) = 122bec49d2cace00b71cc29b5ececed3> whups! I got 7b36f28fc16e1b7f4ba3c1dca191ac92 for openssh-4.0p1.tar.gz ??? > what is wrong?-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 In short, the MD5 signature for the Portable tarball in the release notes is wrong. The correct signature is: 7b36f28fc16e1b7f4ba3c1dca191ac92 openssh-4.0p1.tar.gz There was a last-minute compile fix which require a re-rolling of the release tarballs. I have confirmed that the signature in the release notes matches the signature for the tarball without that fix, that the the tarball on the FTP site contains the fix and that the only difference between the two is the aforementioned fix. I have also confirmed a good gpg signature from djm. The online version of the release notee has also been corrected and will appear at http://www.openssh.com/txt/release-4.0 shortly. Apologies to all for the confusion. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (OpenBSD) iD8DBQFCL1Y4yYKAx4/0+mkRAiAAAJ9J/It/MkUrnjjBHmTV4zed/fH+jwCg1krg uchwZKbkVciEQGzB8rBXiUc=RXLr -----END PGP SIGNATURE----- -- Darren Tucker (dtucker at zip.com.au) GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4 37C9 C982 80C7 8FF4 FA69 Good judgement comes with experience. Unfortunately, the experience usually comes from bad judgement.
On Wed, Mar 09, 2005 at 06:11:22PM +0100, Rainer Peter Feller wrote:> On Wed, 2005-03-09 at 02:54 -0700, Damien Miller wrote: > <SNIP> > > > Checksums: > > =========> > > > - MD5 (openssh-4.0.tgz) = 7dbf15fe7c294672e8822127f50107d0 > > - MD5 (openssh-4.0p1.tar.gz) = 122bec49d2cace00b71cc29b5ececed3> whups! I got 7b36f28fc16e1b7f4ba3c1dca191ac92 for openssh-4.0p1.tar.gz ??? > what is wrong?-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 In short, the MD5 signature for the Portable tarball in the release notes is wrong. The correct signature is: 7b36f28fc16e1b7f4ba3c1dca191ac92 openssh-4.0p1.tar.gz There was a last-minute compile fix which require a re-rolling of the release tarballs. I have confirmed that the signature in the release notes matches the signature for the tarball without that fix, that the the tarball on the FTP site contains the fix and that the only difference between the two is the aforementioned fix. I have also confirmed a good gpg signature from djm. The online version of the release notee has also been corrected and will appear at http://www.openssh.com/txt/release-4.0 shortly. Apologies to all for the confusion. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (OpenBSD) iD8DBQFCL1Y4yYKAx4/0+mkRAiAAAJ9J/It/MkUrnjjBHmTV4zed/fH+jwCg1krg uchwZKbkVciEQGzB8rBXiUc=RXLr -----END PGP SIGNATURE----- -- Darren Tucker (dtucker at zip.com.au) GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4 37C9 C982 80C7 8FF4 FA69 Good judgement comes with experience. Unfortunately, the experience usually comes from bad judgement.
On Wed, Mar 09, 2005 at 06:11:22PM +0100, Rainer Peter Feller wrote:> On Wed, 2005-03-09 at 02:54 -0700, Damien Miller wrote: > <SNIP> > > > Checksums: > > =========> > > > - MD5 (openssh-4.0.tgz) = 7dbf15fe7c294672e8822127f50107d0 > > - MD5 (openssh-4.0p1.tar.gz) = 122bec49d2cace00b71cc29b5ececed3> whups! I got 7b36f28fc16e1b7f4ba3c1dca191ac92 for openssh-4.0p1.tar.gz ??? > what is wrong?-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 In short, the MD5 signature for the Portable tarball in the release notes is wrong. The correct signature is: 7b36f28fc16e1b7f4ba3c1dca191ac92 openssh-4.0p1.tar.gz There was a last-minute compile fix which require a re-rolling of the release tarballs. I have confirmed that the signature in the release notes matches the signature for the tarball without that fix, that the the tarball on the FTP site contains the fix and that the only difference between the two is the aforementioned fix. I have also confirmed a good gpg signature from djm. The online version of the release notee has also been corrected and will appear at http://www.openssh.com/txt/release-4.0 shortly. Apologies to all for the confusion. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (OpenBSD) iD8DBQFCL1Y4yYKAx4/0+mkRAiAAAJ9J/It/MkUrnjjBHmTV4zed/fH+jwCg1krg uchwZKbkVciEQGzB8rBXiUc=RXLr -----END PGP SIGNATURE----- -- Darren Tucker (dtucker at zip.com.au) GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4 37C9 C982 80C7 8FF4 FA69 Good judgement comes with experience. Unfortunately, the experience usually comes from bad judgement.
On Wed, Mar 09, 2005 at 06:11:22PM +0100, Rainer Peter Feller wrote:> On Wed, 2005-03-09 at 02:54 -0700, Damien Miller wrote: > <SNIP> > > > Checksums: > > =========> > > > - MD5 (openssh-4.0.tgz) = 7dbf15fe7c294672e8822127f50107d0 > > - MD5 (openssh-4.0p1.tar.gz) = 122bec49d2cace00b71cc29b5ececed3> whups! I got 7b36f28fc16e1b7f4ba3c1dca191ac92 for openssh-4.0p1.tar.gz ??? > what is wrong?-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 In short, the MD5 signature for the Portable tarball in the release notes is wrong. The correct signature is: 7b36f28fc16e1b7f4ba3c1dca191ac92 openssh-4.0p1.tar.gz There was a last-minute compile fix which require a re-rolling of the release tarballs. I have confirmed that the signature in the release notes matches the signature for the tarball without that fix, that the the tarball on the FTP site contains the fix and that the only difference between the two is the aforementioned fix. I have also confirmed a good gpg signature from djm. The online version of the release notee has also been corrected and will appear at http://www.openssh.com/txt/release-4.0 shortly. Apologies to all for the confusion. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (OpenBSD) iD8DBQFCL1Y4yYKAx4/0+mkRAiAAAJ9J/It/MkUrnjjBHmTV4zed/fH+jwCg1krg uchwZKbkVciEQGzB8rBXiUc=RXLr -----END PGP SIGNATURE----- -- Darren Tucker (dtucker at zip.com.au) GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4 37C9 C982 80C7 8FF4 FA69 Good judgement comes with experience. Unfortunately, the experience usually comes from bad judgement.
On Wed, Mar 09, 2005 at 06:11:22PM +0100, Rainer Peter Feller wrote:> On Wed, 2005-03-09 at 02:54 -0700, Damien Miller wrote: > <SNIP> > > > Checksums: > > =========> > > > - MD5 (openssh-4.0.tgz) = 7dbf15fe7c294672e8822127f50107d0 > > - MD5 (openssh-4.0p1.tar.gz) = 122bec49d2cace00b71cc29b5ececed3> whups! I got 7b36f28fc16e1b7f4ba3c1dca191ac92 for openssh-4.0p1.tar.gz ??? > what is wrong?-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 In short, the MD5 signature for the Portable tarball in the release notes is wrong. The correct signature is: 7b36f28fc16e1b7f4ba3c1dca191ac92 openssh-4.0p1.tar.gz There was a last-minute compile fix which require a re-rolling of the release tarballs. I have confirmed that the signature in the release notes matches the signature for the tarball without that fix, that the the tarball on the FTP site contains the fix and that the only difference between the two is the aforementioned fix. I have also confirmed a good gpg signature from djm. The online version of the release notee has also been corrected and will appear at http://www.openssh.com/txt/release-4.0 shortly. Apologies to all for the confusion. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (OpenBSD) iD8DBQFCL1Y4yYKAx4/0+mkRAiAAAJ9J/It/MkUrnjjBHmTV4zed/fH+jwCg1krg uchwZKbkVciEQGzB8rBXiUc=RXLr -----END PGP SIGNATURE----- -- Darren Tucker (dtucker at zip.com.au) GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4 37C9 C982 80C7 8FF4 FA69 Good judgement comes with experience. Unfortunately, the experience usually comes from bad judgement.
Damien Miller wrote:> * Improve account and password expiry support in sshd(8). Ther server > will now warn in advance for both account and password expiry.Curious - does this include Krb5/GSSAPI support? I'd like to expire passwords at regular intervals, but SSH was my main roadblock since password would expire with no notice... (I assume it would only warn you, and not let you change expired passwords) Kudos to the OpenSSH folks for 4.0... :) Best Wishes - Peter -- Peter_Losher at isc.org | ISC | OpenPGP 0xE8048D08 | "The bits must flow" -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 187 bytes Desc: OpenPGP digital signature Url : http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20050316/6c2a7aa4/attachment.bin