Hi, OpenSSH 6.5 is almost ready for release, so we would appreciate testing on as many platforms and systems as possible. This release contains some substantial new features and a number of bugfixes. Snapshot releases for portable OpenSSH are available from http://www.mindrot.org/openssh_snap/ The OpenBSD version is available in CVS HEAD: http://www.openbsd.org/anoncvs.html Portable OpenSSH is also available via anonymous CVS using the instructions at http://www.openssh.com/portable.html#cvs or via Mercurial at http://hg.mindrot.org/openssh Running the regression tests supplied with Portable OpenSSH does not require installation and is a simply: $ ./configure && make tests Live testing on suitable non-production systems is also appreciated. Please send reports of success or failure to openssh-unix-dev at mindrot.org. Below is a summary of changes. More detail may be found in the ChangeLog in the portable OpenSSH tarballs. Thanks to the many people who contributed to this release. Changes since OpenSSH 6.4 ======================== This is a feature-focused release. New features: * ssh(1), sshd(8): Add support for key exchange using elliptic-curve Diffie Hellman in Daniel Bernstein's Curve25519. This key exchange method is the default when both the client and server support it. * ssh(1), sshd(8): Add support for Ed25519 as a public key type. Ed25519 is a elliptic curve signature scheme that offers better security than ECDSA and DSA and good performance. It may be used for both user and host keys. * Add a new private key format that uses a bcrypt KDF to better protect keys at rest. This format is used unconditionally for Ed25519 keys, but may be requested when generating or saving existing keys of other types via the -o ssh-keygen(1) option. We intend to make the new format the default in the near future. Details of the new format are in the PROTOCOL.key file. * ssh(1), sshd(8): Add a new transport cipher "chacha20-poly1305 at openssh.com" that combines Daniel Bernstein's ChaCha20 stream cipher and Poly1305 MAC to build an authenticated encryption mode. Details are in the PROTOCOL.chacha20poly1305 file. * ssh(1), sshd(8): Refuse RSA keys from old proprietary clients and servers that use the obsolete RSA+MD5 signature scheme. It will still be possible to connect with these clients/servers but only DSA keys will be accepted, and OpenSSH will refuse connection entirely in a future release. * ssh(1), sshd(8): Refuse old proprietary clients and servers that use a weaker key exchange hash calculation. * ssh(1): Increase the size of the Diffie-Hellman groups requested for each symmetric key size. New values from NIST Special Publication 800-57 with the upper limit specified by RFC4419 * ssh(1), ssh-agent(1): Support pkcs#11 tokes that only provide X.509 certs instead of raw public keys (requested as bz#1908). * ssh(1): Add a ssh_config(5) "Match" keyword that allows conditional configuration to be applied by matching on hostname, user and result of arbitrary commands. * ssh(1): Add support for client-side hostname canonicalisation using a set of DNS suffixes and rules in ssh_config(5). This allows unqualified names to be canonicalised to fully-qualified domain names to eliminate ambiguity when looking up keys in known_hosts or checking host certificate names. * sftp-server(8): Add the ability to whitelist and/or blacklist sftp protocol requests by name. * sftp-server(8): Add a sftp "fsync at openssh.com" to support calling fsync(2) on an open file handle. * sshd(8): Add a ssh_config(5) PermitTTY to disallow TTY allocation, mirroring the longstanding no-pty authorized_keys option. * ssh(1): Add a ssh_config ProxyUseFDPass option that supports the use of ProxyCommands that establish a connection and then pass a connected file descriptor back to ssh(1). This allows the ProxyCommand to exit rather than staying around to transfer data. Bugfixes: * ssh(1), sshd(8): Fix potential stack exhaustion caused by nested certificates. * ssh(1): bz#1211: make BindAddress work with UsePrivilegedPort. * sftp(1): bz#2137: fix the progress meter for resumed transfer. * ssh-add(1): bz#2187: do not request smartcard PIN when removing keys from ssh-agent. * sshd(8): bz#2139: fix re-exec fallback when original sshd binary cannot be executed. * ssh-keygen(1): Make relative-specified certificate expiry times relative to current time and not the validity start time. * sshd(8): bz#2161: fix AuthorizedKeysCommand inside a Match block. * sftp(1): bz#2129: symlinking a file would incorrectly canonicalise the target path. * ssh-agent(1): bz#2175: fix a use-after-free in the PKCS#11 agent helper executable. * sshd(8): Improve logging of sessions to include the user name, remote host and port, the session type (shell, command, etc.) and allocated TTY (if any). * sshd(8): bz#1297: tell the client (via a debug message) when their preferred listen address has been overridden by the server's GatewayPorts setting. * sshd(8): bz#2162: include report port in bad protocol banner message. * sftp(1): bz#2163: fix memory leak in error path in do_readdir() * sftp(1): bz#2171: don't leak file descriptor on error. * sshd(8): Include the local address and port in "Connection from ..." message (only shown at loglevel>=verbose) Portable OpenSSH: * Switch to a ChaCha20-based arc4random() PRNG for platforms that do not provide their own. * sshd(8): bz#2156: restore Linux oom_adj setting when handling SIGHUP to maintain behaviour over retart. * sshd(8): bz#2032: use local username in krb5_kuserok check rather than full client name which may be of form user at REALM. * ssh(1), sshd(8): Test for both the presence of ECC NID numbers in OpenSSL and that they actually work. Fedora (at least) has NID_secp521r1 that doesn't work. * bz#2173: use pkg-config --libs to include correct -L location for libedit. Reporting Bugs: ============== - Please read http://www.openssh.com/report.html Security bugs should be reported directly to openssh at openssh.com OpenSSH is brought to you by Markus Friedl, Niels Provos, Theo de Raadt, Kevin Steves, Damien Miller, Darren Tucker, Jason McIntyre, Tim Rice and Ben Lindstrom.
Here's a potential problem (freebsd4 but probably other older platforms):
monitor_mm.c: In function `mm_make_entry':
monitor_mm.c:78: warning: unknown conversion type character `z' in format
All instances I've seen so far have been calls to fatal(), and that
does through snprintf. We should probably check for that and if found
use the snprintf in the compat library.
haven't had a chance to look into it yet but posting in case someone
else sees this.
--
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4 37C9 C982 80C7 8FF4 FA69
Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.
Hi, On Fri, Jan 17, 2014 at 11:26:47AM +1100, Damien Miller wrote:> OpenSSH 6.5 is almost ready for release, so we would appreciate testing > on as many platforms and systems as possible. This release contains > some substantial new features and a number of bugfixes.[..] Tested the snapshot of today on NetBSD 5.1_STABLE/sparc64. Took an eternity and a bit :-) - but everything passed: ... key revocation lists: checking revocations for unrevoked certs ok key revocation lists all tests passed gert -- USENET is *not* the non-clickable part of WWW! //www.muc.de/~gert/ Gert Doering - Munich, Germany gert at greenie.muc.de fax: +49-89-35655025 gert at net.informatik.tu-muenchen.de
build failure on netbsd4 with gssapi enabled while linking sshd:
gss-serv-krb5.o: In function `ssh_gssapi_krb5_storecreds?:
gss-serv-krb5.c:135: undefined reference to `krb5_cc_new_unique?
--
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4 37C9 C982 80C7 8FF4 FA69
Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.
On Jan 17 11:26, Damien Miller wrote:> Hi, > > OpenSSH 6.5 is almost ready for release, so we would appreciate testing > on as many platforms and systems as possible. This release contains > some substantial new features and a number of bugfixes.I pulled from CVS HEAD. Builds out of the box on Cygwin (baring the -Werror issues, of course). All tests pass. Corinna -- Corinna Vinschen Cygwin Maintainer Red Hat -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 819 bytes Desc: not available URL: <http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20140117/d61287f9/attachment.bin>
On Fri, Jan 17, 2014 at 11:26:47 +1100, Damien Miller wrote:> Hi, > > OpenSSH 6.5 is almost ready for release, so we would appreciate testing > on as many platforms and systems as possible. This release contains > some substantial new features and a number of bugfixes. >The 20140118 snapshot builds and passes all tests on: RHEL 6.5/amd64 SLES 11sp1/amd64 Mac OS X 10.8.5 For completeness, the following warnings were reported on RHEL and SLES: readpassphrase.c:127: warning: ignoring return value of ?write?, declared with attribute warn_unused_result readpassphrase.c:146: warning: ignoring return value of ?write?, declared with attribute warn_unused_result log.c:448: warning: ignoring return value of ?write?, declared with attribute warn_unused_result ssh.c:1183: warning: ignoring return value of ?daemon?, declared with attribute warn_unused_result serverloop.c:151: warning: ignoring return value of ?write?, declared with attribute warn_unused_result ssh-agent.c:1211: warning: ignoring return value of ?chdir?, declared with attribute warn_unused_result scp.c:1341: warning: ignoring return value of ?write?, declared with attribute warn_unused_result sftp.c:234: warning: ignoring return value of ?write?, declared with attribute warn_unused_result sftp-client.c:1262: warning: ignoring return value of ?ftruncate?, declared with attribute warn_unused_result The list is _much_ longer on OS X; about 750 warnings. However, most of these appear to be related to OpenSSL and are probably related to having to use --without-openssl-header-check. -- Iain Morgan
On 2014-01-16 16:26, Damien Miller wrote:> Hi, > > OpenSSH 6.5 is almost ready for release, so we would appreciate testing > on as many platforms and systems as possible. This release contains > some substantial new features and a number of bugfixes. > > Snapshot releases for portable OpenSSH are available from > http://www.mindrot.org/openssh_snap/ > > The OpenBSD version is available in CVS HEAD: > http://www.openbsd.org/anoncvs.html > > Portable OpenSSH is also available via anonymous CVS using the > instructions at http://www.openssh.com/portable.html#cvs or > via Mercurial at http://hg.mindrot.org/openssh > > Running the regression tests supplied with Portable OpenSSH does not > require installation and is a simply: > > $ ./configure && make tests > >Using openssh-SNAP-20140119.tar.gz: Debian GNU/Linux 7.3 (wheezy) x86_64, gcc (Debian 4.7.2-5) , and OpenSSL 1.0.1e 11 - all tests passed Full test suite (RHEL/AIX/HP-UX/maybe Solaris) will get cranked up in the lab at work come Monday. :)
On Sat, Jan 18, 2014 at 7:29 PM, Kevin Brott <kevin.brott at gmail.com> wrote:> On 2014-01-16 16:26, Damien Miller wrote: >> >> Hi, >> >> OpenSSH 6.5 is almost ready for release, so we would appreciate testing >> on as many platforms and systems as possible. This release contains >> some substantial new features and a number of bugfixes. >> >> Snapshot releases for portable OpenSSH are available from >> http://www.mindrot.org/openssh_snap/ >> >> The OpenBSD version is available in CVS HEAD: >> http://www.openbsd.org/anoncvs.html >> >> Portable OpenSSH is also available via anonymous CVS using the >> instructions at http://www.openssh.com/portable.html#cvs or >> via Mercurial at http://hg.mindrot.org/openssh >> >> Running the regression tests supplied with Portable OpenSSH does not >> require installation and is a simply: >> >> $ ./configure && make tests >> >> > > Using openssh-SNAP-20140119.tar.gz: > Debian GNU/Linux 7.3 (wheezy) x86_64, gcc (Debian 4.7.2-5) , and OpenSSL > 1.0.1e 11 - all tests passed > > Full test suite (RHEL/AIX/HP-UX/maybe Solaris) will get cranked up in the > lab at work come Monday. :) >Ran 20140119 snapshot tests on Ubuntu 12.04.4 LTS x64; had to create /var/empty but after that all test passed. Also compiled and ran the same tests on CentOS 6.5 x64. And got the following: [...] certified host keys: host rsa connect wrong cert certified host keys: host dsa connect wrong cert certified host keys: host rsa connect wrong cert certified host keys: host dsa connect wrong cert failed certified host keys make[1]: *** [t-exec] Error 1 make[1]: Leaving directory `/home/raub/dev/openssh/regress' make: *** [tests] Error 2 [raub at devcentos openssh]$ Anything I should worry about? Or are they related to openssl/something else?> > > > _______________________________________________ > openssh-unix-dev mailing list > openssh-unix-dev at mindrot.org > https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
On-call this week so it's going slow - but felt I should report on the build failure I found: Using http://www.mindrot.org/openssh_snap/openssh-SNAP-20140122.tar.gz OS Build_Target CC OpenSSL BUILD TEST ============== =========================== =========================== ===== ================RHEL 2.1 i686-pc-linux-gnu gcc 2.96-129.7.2 0.9.6b-eng OK all tests passed RHEL 3 TU4 i686-pc-linux-gnu gcc 3.2.3-47 0.9.7a FAIL*2 Fedora Core r2 i686-pc-linux-gnu gcc 3.3.3-7 0.9.7a OK*1 all tests passed RHEL 4.0 nu8 i686-pc-linux-gnu gcc 3.4.6-11 0.9.7a OK*1 all tests passed RHEL 4.0 nu8 x86_64-unknown-linux-gnu gcc 3.4.6-11 0.9.7a OK*1 all tests passed # RHL Red Hat Linux # RHEL Red Hat Enterprise Linux # *1 --without-zlib-version-check # *2 build failure: gcc -g -O2 -Wall -Wpointer-arith -Wuninitialized -Wsign-compare -Wformat-security -fno-strict-aliasing -D_FORTIFY_SOURCE=2 -ftrapv -fno-builtin-memset -std=gnu99 -fPIE -I. -I.. -I. -I./.. -DHAVE_CONFIG_H -c setproctitle.c setproctitle.c: In function `compat_init_setproctitle': setproctitle.c:99: warning: implicit declaration of function `strlen' setproctitle.c:107: `argv_start' undeclared (first use in this function) setproctitle.c:107: (Each undeclared identifier is reported only once setproctitle.c:107: for each function it appears in.) setproctitle.c:108: `argv_env_len' undeclared (first use in this function) setproctitle.c:115: warning: implicit declaration of function `strdup' setproctitle.c:115: warning: assignment makes pointer from integer without a cast make[1]: *** [setproctitle.o] Error 1 make[1]: Leaving directory `/usr/src/openssh/openbsd-compat' make: *** [openbsd-compat/libopenbsd-compat.a] Error 2 ## ## OPENSSH 6.4p1 builds/tests fine ## On Sat, Jan 18, 2014 at 4:29 PM, Kevin Brott <kevin.brott at gmail.com> wrote:> On 2014-01-16 16:26, Damien Miller wrote: > >> Hi, >> >> OpenSSH 6.5 is almost ready for release, so we would appreciate testing >> on as many platforms and systems as possible. This release contains >> some substantial new features and a number of bugfixes. >> >> Snapshot releases for portable OpenSSH are available from >> http://www.mindrot.org/openssh_snap/ >> >> The OpenBSD version is available in CVS HEAD: >> http://www.openbsd.org/anoncvs.html >> >> Portable OpenSSH is also available via anonymous CVS using the >> instructions at http://www.openssh.com/portable.html#cvs or >> via Mercurial at http://hg.mindrot.org/openssh >> >> Running the regression tests supplied with Portable OpenSSH does not >> require installation and is a simply: >> >> $ ./configure && make tests >> >> >> > Using openssh-SNAP-20140119.tar.gz: > Debian GNU/Linux 7.3 (wheezy) x86_64, gcc (Debian 4.7.2-5) , and OpenSSL > 1.0.1e 11 - all tests passed > > Full test suite (RHEL/AIX/HP-UX/maybe Solaris) will get cranked up in the > lab at work come Monday. :) > > > > >-- # include <stddisclaimer.h> /* Kevin Brott <Kevin.Brott at gmail.com> */
Damien Miller <djm at mindrot.org> writes:> Running the regression tests supplied with Portable OpenSSH does not > require installation and is a simply: > > $ ./configure && make testsTested openssh-SNAP-20140123 on Debian jessie/testing amd64 with OpenSSL 1.0.1f on two machines (one with AES-NI instructions), all tests passed and no warnings.> * ssh(1), sshd(8): Add support for Ed25519 as a public key type. > Ed25519 is a elliptic curve signature scheme that offers > better security than ECDSA and DSA and good performance. It may be > used for both user and host keys.Is there SSHFP support for Ed25519? I suppose not - looks like it would need Internet Drafts equivalent to RFC6090 (ECDSA) and RFC6594 (SSHFP). Currently Curve25519 has an I-D but not for Ed25519: http://datatracker.ietf.org/doc/draft-josefsson-tls-curve25519/ ?This document only describes usage of additional curves for ephemeral key exchange (ECDHE), not for use with long-term keys embedded in PKIX certificates (ECDH_RSA and ECDH_ECDSA). This is because Curve25519 is not directly suitable for authentication with ECDSA, and thus not applicable for signing of e.g. PKIX certificates.? -- Gerald Turner Email: gturner at unzane.com JID: gturner at unzane.com GPG: 0xFA8CD6D5 21D9 B2E8 7FE7 F19E 5F7D 4D0C 3FA0 810F FA8C D6D5 -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 197 bytes Desc: not available URL: <http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20140122/65201d70/attachment.bin>
On NetBSD amd64-current with a git pull on 1/22 at about 2300GMT:
(cd openbsd-compat && make)
BUILDDIR=`pwd`; TEST_SHELL="sh";
TEST_SSH_SSH="${BUILDDIR}/ssh";
TEST_SSH_SSHD="${BUILDDIR}/sshd";
TEST_SSH_SSHAGENT="${BUILDDIR}/ssh-agent";
TEST_SSH_SSHADD="${BUILDDIR}/ssh-add";
TEST_SSH_SSHKEYGEN="${BUILDDIR}/ssh-keygen";
TEST_SSH_SSHPKCS11HELPER="${BUILDDIR}/ssh-pkcs11-helper";
TEST_SSH_SSHKEYSCAN="${BUILDDIR}/ssh-keyscan";
TEST_SSH_SFTP="${BUILDDIR}/sftp";
TEST_SSH_SFTPSERVER="${BUILDDIR}/sftp-server";
TEST_SSH_PLINK="plink"; TEST_SSH_PUTTYGEN="puttygen";
TEST_SSH_CONCH="conch"; TEST_SSH_IPV6="yes" ;
TEST_SSH_ECC="yes" ; cd ./regress || exit $?; make
.OBJDIR="${BUILDDIR}/regress" .CURDIR="`pwd`"
BUILDDIR="${BUILDDIR}" OBJ="${BUILDDIR}/regress/"
PATH="${BUILDDIR}:${PATH}" TEST_ENV=MALLOC_OPTIONS="AJRX"
TEST_SHELL="${TEST_SHELL}" TEST_SSH_SSH="${TEST_SSH_SSH}"
TEST_SSH_SSHD="${TEST_SSH_SSHD}"
TEST_SSH_SSHAGENT="${TEST_SSH_SSHAGENT}"
TEST_SSH_SSHADD="${TEST_SSH_SSHADD}"
TEST_SSH_SSHKEYGEN="${TEST_SSH_SSHKEYGEN}"
TEST_SSH_SSHPKCS11HELPER="${TES
T_SSH_SSHPKCS11HELPER}"
TEST_SSH_SSHKEYSCAN="${TEST_SSH_SSHKEYSCAN}"
TEST_SSH_SFTP="${TEST_SSH_SFTP}"
TEST_SSH_SFTPSERVER="${TEST_SSH_SFTPSERVER}"
TEST_SSH_PLINK="${TEST_SSH_PLINK}"
TEST_SSH_PUTTYGEN="${TEST_SSH_PUTTYGEN}"
TEST_SSH_CONCH="${TEST_SSH_CONCH}"
TEST_SSH_IPV6="${TEST_SSH_IPV6}"
TEST_SSH_ECC="${TEST_SSH_ECC}" EXEEXT="" tests &&
echo all tests passed
/home/htodd/openssh/ssh-keygen -if /home/htodd/openssh/regress/rsa_ssh2.prv |
diff - /home/htodd/openssh/regress/rsa_openssh.prv
tr '\n' '\r' </home/htodd/openssh/regress/rsa_ssh2.prv >
/home/htodd/openssh/regress/rsa_ssh2_cr.prv
/home/htodd/openssh/ssh-keygen -if /home/htodd/openssh/regress/rsa_ssh2_cr.prv |
diff - /home/htodd/openssh/regress/rsa_openssh.prv
awk '{print $0 "\r"}' /home/htodd/openssh/regress/rsa_ssh2.prv
> /home/htodd/openssh/regress/rsa_ssh2_crnl.prv
/home/htodd/openssh/ssh-keygen -if /home/htodd/openssh/regress/rsa_ssh2_crnl.prv
| diff - /home/htodd/openssh/regress/rsa_openssh.prv
cat /home/htodd/openssh/regress/rsa_openssh.prv >
/home/htodd/openssh/regress//t2.out
chmod 600 /home/htodd/openssh/regress//t2.out
/home/htodd/openssh/ssh-keygen -yf /home/htodd/openssh/regress//t2.out | diff -
/home/htodd/openssh/regress/rsa_openssh.pub
/home/htodd/openssh/ssh-keygen -ef /home/htodd/openssh/regress/rsa_openssh.pub
>/home/htodd/openssh/regress//t3.out
/home/htodd/openssh/ssh-keygen -if /home/htodd/openssh/regress//t3.out | diff -
/home/htodd/openssh/regress/rsa_openssh.pub
/home/htodd/openssh/ssh-keygen -lf /home/htodd/openssh/regress/rsa_openssh.pub |
awk '{print $2}' | diff - /home/htodd/openssh/regress/t4.ok
/home/htodd/openssh/ssh-keygen -Bf /home/htodd/openssh/regress/rsa_openssh.pub |
awk '{print $2}' | diff - /home/htodd/openssh/regress/t5.ok
/home/htodd/openssh/ssh-keygen -if /home/htodd/openssh/regress/dsa_ssh2.prv >
/home/htodd/openssh/regress//t6.out1
/home/htodd/openssh/ssh-keygen -if /home/htodd/openssh/regress/dsa_ssh2.pub >
/home/htodd/openssh/regress//t6.out2
chmod 600 /home/htodd/openssh/regress//t6.out1
/home/htodd/openssh/ssh-keygen -yf /home/htodd/openssh/regress//t6.out1 | diff -
/home/htodd/openssh/regress//t6.out2
/home/htodd/openssh/ssh-keygen -lf /home/htodd/openssh/regress//t7.out >
/dev/null
/home/htodd/openssh/ssh-keygen -Bf /home/htodd/openssh/regress//t7.out >
/dev/null
/home/htodd/openssh/ssh-keygen -lf /home/htodd/openssh/regress//t8.out >
/dev/null
/home/htodd/openssh/ssh-keygen -Bf /home/htodd/openssh/regress//t8.out >
/dev/null
test "yes" != yes || /home/htodd/openssh/ssh-keygen -lf
/home/htodd/openssh/regress//t9.out > /dev/null
test "yes" != yes || /home/htodd/openssh/ssh-keygen -Bf
/home/htodd/openssh/regress//t9.out > /dev/null
/home/htodd/openssh/ssh-keygen -lf /home/htodd/openssh/regress//t10.out >
/dev/null
/home/htodd/openssh/ssh-keygen -Bf /home/htodd/openssh/regress//t10.out >
/dev/null
FATAL: sshd_proxy broken
*** Error code 1
Stop.
make[1]: stopped in /home/htodd/openssh/regress
*** Error code 1
Stop.
make: stopped in /home/htodd/openssh
--
Hisashi T Fujinaka - htodd at twofifty.com
BSEE(6/86) + BSChem(3/95) + BAEnglish(8/95) + MSCS(8/03) + $2.50 = latte
On Fri, 2014-01-17 at 11:26 +1100, Damien Miller wrote:> Hi, > > OpenSSH 6.5 is almost ready for release, so we would appreciate testing > on as many platforms and systems as possible. This release contains > some substantial new features and a number of bugfixes. > > Snapshot releases for portable OpenSSH are available from > http://www.mindrot.org/openssh_snap/ > > The OpenBSD version is available in CVS HEAD: > http://www.openbsd.org/anoncvs.html > > Portable OpenSSH is also available via anonymous CVS using the > instructions at http://www.openssh.com/portable.html#cvs or > via Mercurial at http://hg.mindrot.org/openssh > > Running the regression tests supplied with Portable OpenSSH does not > require installation and is a simply: > > $ ./configure && make tests > > Live testing on suitable non-production systems is also > appreciated. Please send reports of success or failure to > openssh-unix-dev at mindrot.org. > > Below is a summary of changes. More detail may be found in the ChangeLog > in the portable OpenSSH tarballs. > > Thanks to the many people who contributed to this release. > > Changes since OpenSSH 6.4 > ========================> > This is a feature-focused release. > > New features: > > * ssh(1), sshd(8): Add support for key exchange using elliptic-curve > Diffie Hellman in Daniel Bernstein's Curve25519. This key exchange > method is the default when both the client and server support it. > > * ssh(1), sshd(8): Add support for Ed25519 as a public key type. > Ed25519 is a elliptic curve signature scheme that offers > better security than ECDSA and DSA and good performance. It may be > used for both user and host keys. > > * Add a new private key format that uses a bcrypt KDF to better > protect keys at rest. This format is used unconditionally for > Ed25519 keys, but may be requested when generating or saving > existing keys of other types via the -o ssh-keygen(1) option. > We intend to make the new format the default in the near future. > Details of the new format are in the PROTOCOL.key file. > > * ssh(1), sshd(8): Add a new transport cipher > "chacha20-poly1305 at openssh.com" that combines Daniel Bernstein's > ChaCha20 stream cipher and Poly1305 MAC to build an authenticated > encryption mode. Details are in the PROTOCOL.chacha20poly1305 file. > > * ssh(1), sshd(8): Refuse RSA keys from old proprietary clients and > servers that use the obsolete RSA+MD5 signature scheme. It will > still be possible to connect with these clients/servers but only > DSA keys will be accepted, and OpenSSH will refuse connection > entirely in a future release. > > * ssh(1), sshd(8): Refuse old proprietary clients and servers that > use a weaker key exchange hash calculation. > > * ssh(1): Increase the size of the Diffie-Hellman groups requested > for each symmetric key size. New values from NIST Special > Publication 800-57 with the upper limit specified by RFC4419 > > * ssh(1), ssh-agent(1): Support pkcs#11 tokes that only provide > X.509 certs instead of raw public keys (requested as bz#1908). > > * ssh(1): Add a ssh_config(5) "Match" keyword that allows > conditional configuration to be applied by matching on hostname, > user and result of arbitrary commands. > > * ssh(1): Add support for client-side hostname canonicalisation > using a set of DNS suffixes and rules in ssh_config(5). This > allows unqualified names to be canonicalised to fully-qualified > domain names to eliminate ambiguity when looking up keys in > known_hosts or checking host certificate names. > > * sftp-server(8): Add the ability to whitelist and/or blacklist sftp > protocol requests by name. > > * sftp-server(8): Add a sftp "fsync at openssh.com" to support calling > fsync(2) on an open file handle. > > * sshd(8): Add a ssh_config(5) PermitTTY to disallow TTY allocation, > mirroring the longstanding no-pty authorized_keys option. > > * ssh(1): Add a ssh_config ProxyUseFDPass option that supports the > use of ProxyCommands that establish a connection and then pass a > connected file descriptor back to ssh(1). This allows the > ProxyCommand to exit rather than staying around to transfer data. > > Bugfixes: > > * ssh(1), sshd(8): Fix potential stack exhaustion caused by nested > certificates. > > * ssh(1): bz#1211: make BindAddress work with UsePrivilegedPort. > > * sftp(1): bz#2137: fix the progress meter for resumed transfer. > > * ssh-add(1): bz#2187: do not request smartcard PIN when removing > keys from ssh-agent. > > * sshd(8): bz#2139: fix re-exec fallback when original sshd binary > cannot be executed. > > * ssh-keygen(1): Make relative-specified certificate expiry times > relative to current time and not the validity start time. > > * sshd(8): bz#2161: fix AuthorizedKeysCommand inside a Match block. > > * sftp(1): bz#2129: symlinking a file would incorrectly canonicalise > the target path. > > * ssh-agent(1): bz#2175: fix a use-after-free in the PKCS#11 agent > helper executable. > > * sshd(8): Improve logging of sessions to include the user name, > remote host and port, the session type (shell, command, etc.) and > allocated TTY (if any). > > * sshd(8): bz#1297: tell the client (via a debug message) when > their preferred listen address has been overridden by the > server's GatewayPorts setting. > > * sshd(8): bz#2162: include report port in bad protocol banner > message. > > * sftp(1): bz#2163: fix memory leak in error path in do_readdir() > > * sftp(1): bz#2171: don't leak file descriptor on error. > > * sshd(8): Include the local address and port in "Connection from > ..." message (only shown at loglevel>=verbose) > > Portable OpenSSH: > > * Switch to a ChaCha20-based arc4random() PRNG for platforms that do > not provide their own. > > * sshd(8): bz#2156: restore Linux oom_adj setting when handling > SIGHUP to maintain behaviour over retart. > > * sshd(8): bz#2032: use local username in krb5_kuserok check rather > than full client name which may be of form user at REALM. > > * ssh(1), sshd(8): Test for both the presence of ECC NID numbers in > OpenSSL and that they actually work. Fedora (at least) has > NID_secp521r1 that doesn't work. > > * bz#2173: use pkg-config --libs to include correct -L location for > libedit. > > Reporting Bugs: > ==============> > - Please read http://www.openssh.com/report.html > Security bugs should be reported directly to openssh at openssh.com > > OpenSSH is brought to you by Markus Friedl, Niels Provos, Theo de Raadt, > Kevin Steves, Damien Miller, Darren Tucker, Jason McIntyre, Tim Rice and > Ben Lindstrom. > > _______________________________________________ > openssh-unix-dev mailing list > openssh-unix-dev at mindrot.org > https://lists.mindrot.org/mailman/listinfo/openssh-unix-devSalutations, Tested 1/23/2014 snapshot on Arch Linux 64-bit with following configure options: ./configure \ --prefix=/usr \ --sbindir=/usr/bin \ --libexecdir=/usr/lib/ssh \ --sysconfdir=/etc/ssh \ --with-ldns \ --with-libedit \ --with-ssl-engine \ --with-pam \ --with-privsep-user=nobody \ --with-kerberos5=/usr \ --with-xauth=/usr/bin/xauth \ --with-mantype=man \ --with-md5-passwords \ --with-pid-dir=/run \ Passed all tests. Regards, Mark -- Mark E. Lee <mark at markelee.com> -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 230 bytes Desc: This is a digitally signed message part URL: <http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20140122/8a8aac61/attachment-0001.bin>
Damien Miller <djm <at> mindrot.org> writes:> Hi, > > OpenSSH 6.5 is almost ready for release, so we would appreciate testing > on as many platforms and systems as possible. This release contains > some substantial new features and a number of bugfixes. > > Live testing on suitable non-production systems is also > appreciated. Please send reports of success or failure to > openssh-unix-dev <at> mindrot.org.Hi. Some results to add to the mix using openssh-SNAP-20140124: 1. System: Slackware 14.1 (w/ security patches thru 20140123) Command: ./configure && make tests Result: all tests passed(*) (*) some tests were skipped because: -unset "SUDO" variable -Slackware doesn't ship a netcat suitable for ProxyCommand -no setuid-allowed in regress dir 2. System: Slackware 14.1 (same as above + port of OpenBSD's nc) Command: ./configure && SUDO=/usr/bin/sudo make tests Result: all tests passed(*) (*) some tests were skipped because: -no setuid-allowed in regress dir Is skipping the compilation of setuid-allowed.c intentional? Finally, you asked for confirmation from Aris but I thought I'd share I built an ssh client using libssh 0.6.0 and successfully connect to SNAP-20140124's sshd using curve255190sha256 at libssh.org KEX. Interop confirmed. --mancha
On 17/01/14 01:26, Damien Miller wrote:> Hi, > > OpenSSH 6.5 is almost ready for release, so we would appreciate testing > on as many platforms and systems as possible. This release contains > some substantial new features and a number of bugfixes. >I tried building from git HEAD (603b8f4) but ran into a few issues. It fails to build out of the box on Solaris 2.6: gmake[1]: Entering directory `/export/home/tgc/buildpkg/openssh/src/openssh-git/openbsd-compat' gcc -g -O2 -Wall -Wpointer-arith -Wuninitialized -Wsign-compare -Wformat-security -Wno-pointer-sign -fno-strict-aliasing -D_FORTIFY_SOURCE=2 -ftrapv -fno-builtin-memset -fstack-protector-all -I. -I.. -I. -I./.. -I/usr/tgcware/include -DHAVE_CONFIG_H -c arc4random.c In file included from ../includes.h:174, from arc4random.c:27: ../openbsd-compat/openbsd-compat.h:124: error: conflicting types for 'inet_ntop' /usr/include/resolv.h:303: error: previous declaration of 'inet_ntop' was here gmake[1]: *** [arc4random.o] Error 1 The problem is that configure does not detect that inet_ntop is in libresolv. ... checking for inet_ntop... no ... $ nm /usr/lib/libresolv.so|grep inet_ntop [264] | 42144| 83|FUNC |GLOB |0 |12 |inet_ntop [153] | 0| 0|FILE |LOCL |0 |ABS |inet_ntop.c [154] | 42228| 104|FUNC |LOCL |0 |12 |inet_ntop4 [155] | 42332| 504|FUNC |LOCL |0 |12 |inet_ntop6 $ grep inet_ntop /usr/include/resolv.h const char *inet_ntop __P((int af, const void *src, char *dst, size_t s)); $ I modified configure.ac to detect inet_ntop and the build completes and it passes the testsuite. I also gave it a try on IRIX and found issues there aswell. During configure I get this error: ./configure[10160]: ==: unknown test operator This is a typo in configure.ac, in the pie test. There is still the generic IRIX issue with killpg() only being supported when explicitly using BSD signal semantics. Details are here: http://permalink.gmane.org/gmane.network.openssh.devel/19422 I'm using kill(0, SIGTERM) instead as kill(2) indicates it should work the same. On IRIX 6.5.22 it builds out of the box using MIPSpro 7.4.4m (CC=c99). The testsuite runs until: env passing over multiplexed connection Where is seems to hang, or atleast 10 minutes later there has been no further activity in the logs. On IRIX 6.2 it builds out of the box using MIPSpro 7.3 (7.3.1.2m). The testsuite runs until: test stderr data transfer: proto 2 () Where it hangs and does not get any further, this is the same as previous releases. On IRIX 5.3 the compilation fails using gcc 3.4.6: gcc -g -O2 -Wall -Wpointer-arith -Wuninitialized -Wsign-compare -Wformat-security -fno-strict-aliasing -D_FORTIFY_SOURCE=2 -ftrapv -fno-builtin-memset -std=gnu99 -I. -I.. -I. -I./.. -I/usr/tgcware/include/openssl -I/usr/tgcware/include -DHAVE_CONFIG_H -c bcrypt_pbkdf.c In file included from bcrypt_pbkdf.c:34: ../crypto_api.h:17: error: syntax error before "crypto_uint32" ../crypto_api.h:17: warning: type defaults to `int' in declaration of `crypto_uint32' ../crypto_api.h:17: warning: data definition has no type or storage class bcrypt_pbkdf.c: In function `bcrypt_hash': bcrypt_pbkdf.c:70: error: `uint32_t' undeclared (first use in this function) bcrypt_pbkdf.c:70: error: (Each undeclared identifier is reported only once bcrypt_pbkdf.c:70: error: for each function it appears in.) bcrypt_pbkdf.c:70: error: syntax error before "cdata" bcrypt_pbkdf.c:72: error: `uint16_t' undeclared (first use in this function) bcrypt_pbkdf.c:72: error: syntax error before "j" bcrypt_pbkdf.c:84: error: `j' undeclared (first use in this function) bcrypt_pbkdf.c:86: error: `cdata' undeclared (first use in this function) bcrypt_pbkdf.c:89: error: `uint64_t' undeclared (first use in this function) bcrypt_pbkdf.c: In function `bcrypt_pbkdf': bcrypt_pbkdf.c:115: error: `uint32_t' undeclared (first use in this function) bcrypt_pbkdf.c:115: error: syntax error before "count" bcrypt_pbkdf.c:134: error: `count' undeclared (first use in this function) make[1]: *** [bcrypt_pbkdf.o] Error 1 make[1]: Leaving directory `/usr/people/tgc/buildpkg/openssh/src/openssh-git/openbsd-compat' It's the same issue with poly1305.c For building with gcc < 4.5 adding #include <inttypes.h> is necessary, while gcc 4.5 and later provides <stdint.h> on platforms that lack it. Unfortunately on IRIX 5.3 <inttypes.h> conflicts with <sys/types.h> when using the SGI compiler which means building with gcc is now the only option since the source seems to rely on being able to include <sys/types.h> unconditionally. Once I got the build to complete using gcc 4.5.3, it ends up failling some of the rekey tests. $ cat failed-regress.log trace: client rekey chacha20-poly1305 at openssh.com diffie-hellman-group-exchange-sha1 FAIL: ssh failed (-oRekeyLimit=256k -oCiphers=chacha20-poly1305 at openssh.com -oKexAlgorithms=diffie-hellman-group-exchange-sha1) trace: client rekey chacha20-poly1305 at openssh.com diffie-hellman-group-exchange-sha1 FAIL: ssh failed (-oRekeyLimit=256k -oCiphers=chacha20-poly1305 at openssh.com -oKexAlgorithms=diffie-hellman-group-exchange-sha1) FAIL: corrupted copy (-oRekeyLimit=256k -oCiphers=chacha20-poly1305 at openssh.com -oKexAlgorithms=diffie-hellman-group-exchange-sha1) trace: -1 rekeying(s) FAIL: no rekeying occured (-oRekeyLimit=256k -oCiphers=chacha20-poly1305 at openssh.com -oKexAlgorithms=diffie-hellman-group-exchange-sha1) trace: client rekey chacha20-poly1305 at openssh.com diffie-hellman-group-exchange-sha256 FAIL: ssh failed (-oRekeyLimit=256k -oCiphers=chacha20-poly1305 at openssh.com -oKexAlgorithms=diffie-hellman-group-exchange-sha256) trace: client rekey chacha20-poly1305 at openssh.com diffie-hellman-group-exchange-sha256 FAIL: ssh failed (-oRekeyLimit=256k -oCiphers=chacha20-poly1305 at openssh.com -oKexAlgorithms=diffie-hellman-group-exchange-sha256) FAIL: corrupted copy (-oRekeyLimit=256k -oCiphers=chacha20-poly1305 at openssh.com -oKexAlgorithms=diffie-hellman-group-exchange-sha256) trace: -1 rekeying(s) FAIL: no rekeying occured (-oRekeyLimit=256k -oCiphers=chacha20-poly1305 at openssh.com -oKexAlgorithms=diffie-hellman-group-exchange-sha256) The failed-* logs are here: http://www.jupiterrise.com/tmp/ If I skip the rekey tests the testsuite runs until: test stderr data transfer: proto 2 () Where it hangs and does not get any further, this is the same as previous releases. None of these issues will prevent me from using openssh on IRIX, basic functionality is still okay. -tgc
SNAP 20140127 - All test pass on Solaris 11.1 (SRU 15) with Solaris Studio 12.3
Hi, regress/agent.sh reports wrong exit codes when some of tests fail: run test agent.sh ... agent fwd proto 1 failed (exit code 0) agent fwd proto 2 failed (exit code 0) failed simple agent test It's probably due to using $? value in error message after "if [ $? -ne 0 ]; then" which sets $? to 0. With the attached patch, the output would look like: run test agent.sh ... agent fwd proto 1 failed (exit code 255) agent fwd proto 2 failed (exit code 255) failed simple agent test I noticed it when I'd run "make tests" by an user, who runs ssh-agent with a static socket from .bashrc: eval `ssh-agent -a /tmp/plautrba/.ssh-agent.sock` In this case, the agent.sh always fails, but I consider this more as a configuration issue than a real bug in test suite. However, with the standard .bashrc I can confirm that "make tests" passes on RHEL-7 Beta. Thanks, Petr -- Petr Lautrbach Security Technologies Red Hat Better technology. Faster innovation. Powered by community collaboration. See how it works at redhat.com. -------------- next part -------------- A non-text attachment was scrubbed... Name: agent.sh.patch Type: text/x-patch Size: 1687 bytes Desc: not available URL: <http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20140128/947b3a2e/attachment-0002.bin> -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 836 bytes Desc: OpenPGP digital signature URL: <http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20140128/947b3a2e/attachment-0003.bin>