Hi, OpenSSH 9.9p1 is almost ready for release, so we would appreciate testing on as many platforms and systems as possible. This is a bugfix release. Snapshot releases for portable OpenSSH are available from http://www.mindrot.org/openssh_snap/ The OpenBSD version is available in CVS HEAD: http://www.openbsd.org/anoncvs.html Portable OpenSSH is also available via git using the instructions at http://www.openssh.com/portable.html#cvs At https://anongit.mindrot.org/openssh.git/ or via a mirror at Github: https://github.com/openssh/openssh-portable Running the regression tests supplied with Portable OpenSSH does not require installation and is a simply: $ ./configure && make tests Live testing on suitable non-production systems is also appreciated. Please send reports of success or failure to openssh-unix-dev at mindrot.org. Security bugs should be reported directly to openssh at openssh.com. Below is a summary of changes. More detail may be found in the ChangeLog in the portable OpenSSH tarballs. Thanks to the many people who contributed to this release. Future deprecation notice ======================== OpenSSH plans to remove support for the DSA signature algorithm in early 2025. This release disables DSA by default at compile time. DSA, as specified in the SSHv2 protocol, is inherently weak - being limited to a 160 bit private key and use of the SHA1 digest. Its estimated security level is only 80 bits symmetric equivalent. OpenSSH has disabled DSA keys by default since 2015 but has retained run-time optional support for them. DSA was the only mandatory-to- implement algorithm in the SSHv2 RFCs, mostly because alternative algorithms were encumbered by patents when the SSHv2 protocol was specified. This has not been the case for decades at this point and better algorithms are well supported by all actively-maintained SSH implementations. We do not consider the costs of maintaining DSA in OpenSSH to be justified and hope that removing it from OpenSSH can accelerate its wider deprecation in supporting cryptography libraries. Currently DSA is disabled at compile time by default. The final step of removing DSA support entirely is planned for the first OpenSSH release of 2025. DSA support may be re-enabled in OpenBSD by setting "DSAKEY=yes" in Makefile.inc. To enable DSA support in portable OpenSSH, pass the "--enable-dsa-keys" option to configure. Potentially-incompatible changes -------------------------------- * ssh(1): remove support for pre-authentication compression. OpenSSH has only supported post-authentication compression in the server for some years. Compression before authentication significantly increases the attack surface of SSH servers and risks creating oracles that reveal information about information sent during authentication. * ssh(1), sshd(8): processing of the arguments to the "Match" configuration directive now follows more shell-like rules for quoted strings, including allowing nested quotes and \-escaped characters. If configurations contained workarounds for the previous simplistic quote handling then they may need to be adjusted. Changes since OpenSSH 9.8 ======================== This release contains a number of new features and bugfixes. New features ------------ * ssh(1), sshd(8): add support for a new hybrid post-quantim key exchange based on on the FIPS 203 Module-Lattice Key Enapsulation mechanism (ML-KEM) combined with X25519 ECDH as described by https://datatracker.ietf.org/doc/html/draft-kampanakis-curdle-ssh-pq-ke-03 This algorithm "mlkem768x25519-sha256" is available by default. * ssh(1): the ssh_config "Include" directive can now expand environment as well as the same set of %-tokens "Match Exec" supports. * sshd(8): add a sshd_config "RefuseConnection" option that, if set will terminate the connection at the first authentication request. * sshd(8): add a "refuseconnection" penalty class to sshd_config PerSourcePenalties that is applied when a connection is dropped by the new RefuseConnection keyword. * sshd(8): add a "Match invalid-user" predicate to sshd_config Match options that matches when the target username is not valid on the server. * ssh(1), sshd(8): update the Streamlined NTRUPrime code to a substantially faster implementation. * ssh(1), sshd(8): the hybrid Streamlined NTRUPrime/X25519 key exchange algorithm now has an IANA-assigned name in addition to the "@openssh.com" vendor extension name. This algorithm is now also available under this name "sntrup761x25519-sha512" * ssh(1), sshd(8), ssh-agent(1): prevent private keys from being included in core dump files for most of their lifespans. This is in addition to pre-existing controls in ssh-agent(1) and sshd(8) that prevented coredumps. This feature is supported in OpenBSD, Linux and FreeBSD. * All: convert key handling to use the libcrypto EVP_PKEY API, with the exception of DSA. * sshd(8): add a random amount of jitter (up to 4 seconds) to the grace login time to make its expiry unpredictable. Bugfixes -------- * sshd(8): relax absolute path requirement back to what it was prior to OpenSSH 9.8, which incorrectly required that sshd was started with an absolute path in inetd mode. bz3717 * sshd(8): fix regression introduced in openssh-9.8 that swapped the order of source and destination addresses in some sshd log messages. * sshd(8): do not apply authorized_keys options when signature verification fails. Prevents more restrictive key options being incorrectly applied to subsequent keys in authorized_keys. bz3733 * ssh-keygen(1): include pathname in some of ssh-keygen passphrase prompts. Helps the user know what's going on when ssh-keygen is invoked via other tools. Requested in GHPR503 * ssh(1), ssh-add(1): make parsing user at host consistently look for the last '@' in the string rather than the first. This makes it possible to more consistently use usernames that contain '@' characters. * ssh(1), sshd(8): be more strict in parsing key type names. Only allow short names (e.g "rsa") in user-interface code and require full SSH protocol names (e.g. "ssh-rsa") everywhere else. bz3725 * regress: many performance and correctness improvements to the re-keying regression test. * ssh-keygen(1): clarify that ed25519 is the default key type generated and clarify that rsa-sha2-512 is the default signature scheme when RSA is in use. GHPR505 * sshd(8): fix minor memory leak in Subsystem option parsing; GHPR515 * All: additional hardening and consistency checks for the sshbuf code. * sshd(8): reduce default logingrace penalty to ensure that a single forgotton login that times out will be below the penalty threshold. * ssh(1): fix proxy multiplexing (-O proxy) bug. If a mux started with ControlPersist then later has a forwarding added using mux proxy connection and the forwarding was used, then when the mux proxy session terminated, the mux master process would issue a bad message that terminated the connection. Portability ----------- * sync contrib/ssh-copy-id to the latest upstream version. * regress: improve portablility for some awk(1) usage (e.g. Solaris) * In the contrib/redhat RPM spec file, without_openssl was previously incorrectly enabled unconditionally. * sshd(8) restore audit call before exit that regressed in openssh-9.8 Fixes an issue where the SSH_CONNECTION_ABANDON event was not recorded. * sshd(8): add support for class-imposed loging restrictions on FreeBSD. Allowing auth_hostok(3) and auth_timeok(3) to control logins. * Build fixes for Musl libc. * Fix detection of setres*id on GNU/Hurd OpenSSH is brought to you by Markus Friedl, Niels Provos, Theo de Raadt, Kevin Steves, Damien Miller, Darren Tucker, Jason McIntyre, Tim Rice and Ben Lindstrom.
On 9/15/24 01:11, Damien Miller wrote:> OpenSSH 9.9p1 is almost ready for release, so we would appreciate testing > on as many platforms and systems as possible. This is a bugfix release.# openssh-SNAP-20240916.tar.gz # Intel(R) Core(TM) i7-14700K # Linux 6.8.0-44-generic # Linux Mint 22 (wilma) # gcc (Ubuntu 13.2.0-23ubuntu4) 13.2.0 # OpenSSL 3.0.13 30 Jan 2024 (Library: OpenSSL 3.0.13 30 Jan 2024) Compiles (code warnings = 4), tests and runs as expected: $ ./configure && make tests ... OpenSSH has been configured with the following options: ???????????????????? User binaries: /usr/local/bin ?????????????????? System binaries: /usr/local/sbin ?????????????? Configuration files: /usr/local/etc ?????????????????? Askpass program: /usr/local/libexec/ssh-askpass ????????????????????? Manual pages: /usr/local/share/man/manX ????????????????????????? PID file: /var/run ? Privilege separation chroot path: /var/empty ??????????? sshd default user PATH: /usr/bin:/bin:/usr/sbin:/sbin:/usr/local/bin ??????????????????? Manpage format: doc ?????????????????????? PAM support: no ?????????????????? OSF SIA support: no ???????????????? KerberosV support: no ?????????????????? SELinux support: no ?????????????????? libedit support: no ?????????????????? libldns support: no ? Solaris process contract support: no ?????????? Solaris project support: no ???????? Solaris privilege support: no ?????? IP address in $DISPLAY hack: no ?????????? Translate v4 in v6 hack: yes ????????????????? BSD Auth support: no ????????????? Random number source: OpenSSL internal ONLY ???????????? Privsep sandbox style: seccomp_filter ?????????????????? PKCS#11 support: yes ????????????????? U2F/FIDO support: yes ????????????? Host: x86_64-pc-linux-gnu ????????? Compiler: cc ??? Compiler flags: -g -O2 -pipe -Wno-error=format-truncation -Wall -Wextra -Wpointer-arith -Wuninitialized -Wsign-compare -Wformat-security -Wsizeof-pointer-memaccess -Wno-pointer-sign -Wno-unused-parameter -Wno-unused-result -Wimplicit-fallthrough -Wmisleading-indentation -fno-strict-aliasing -D_FORTIFY_SOURCE=2 -ftrapv -fzero-call-used-regs=used -ftrivial-auto-var-init=zero -fno-builtin-memset -fstack-protector-strong -fPIE Preprocessor flags:? -D_XOPEN_SOURCE=600 -D_BSD_SOURCE -D_DEFAULT_SOURCE -D_GNU_SOURCE -DOPENSSL_API_COMPAT=0x10100000L ????? Linker flags:? -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -fstack-protector-strong -pie ???????? Libraries: ???? +for channels: -lcrypto? -lz ???????? +for sshd: -lcrypt ... all tests passed $ ./ssh -V OpenSSH_9.8p1-snap20240916, OpenSSL 3.0.13 30 Jan 2024 $ ./ssh localhost uname -srvmo Linux 6.8.0-44-generic #44-Ubuntu SMP PREEMPT_DYNAMIC Tue Aug 13 13:35:26 UTC 2024 x86_64 GNU/Linux -- # include <stddisclaimer.h> /* Kevin Brott<Kevin.Brott at GMail.com> */
Fedora 39: Tests are passing with DEFAULT crypto policy If crypto policy is set to DEFAULT:NO-SHA1, tests passed if OPENSSL_CONF=/dev/null variable is explicitly set. Otherwise keyscan test fails for ssh-rsa key (as sha1 in signatures is forbidden) Note that since F41 (currently in Beta stage) SHA1 signatures will be disabled by default in Fedora so some changes (e.g. explicitly using OPENSSL_CONF=/dev/null) may make sense On Sun, Sep 15, 2024 at 10:13?AM Damien Miller <djm at mindrot.org> wrote:> > Hi, > > OpenSSH 9.9p1 is almost ready for release, so we would appreciate testing > on as many platforms and systems as possible. This is a bugfix release. > > Snapshot releases for portable OpenSSH are available from > http://www.mindrot.org/openssh_snap/ > > The OpenBSD version is available in CVS HEAD: > http://www.openbsd.org/anoncvs.html > > Portable OpenSSH is also available via git using the > instructions at http://www.openssh.com/portable.html#cvs > At https://anongit.mindrot.org/openssh.git/ or via a mirror at Github: > https://github.com/openssh/openssh-portable > > Running the regression tests supplied with Portable OpenSSH does not > require installation and is a simply: > > $ ./configure && make tests > > Live testing on suitable non-production systems is also appreciated. > Please send reports of success or failure to > openssh-unix-dev at mindrot.org. Security bugs should be reported > directly to openssh at openssh.com. > > Below is a summary of changes. More detail may be found in the ChangeLog > in the portable OpenSSH tarballs. > > Thanks to the many people who contributed to this release. > > Future deprecation notice > ========================> > OpenSSH plans to remove support for the DSA signature algorithm in > early 2025. This release disables DSA by default at compile time. > > DSA, as specified in the SSHv2 protocol, is inherently weak - being > limited to a 160 bit private key and use of the SHA1 digest. Its > estimated security level is only 80 bits symmetric equivalent. > > OpenSSH has disabled DSA keys by default since 2015 but has retained > run-time optional support for them. DSA was the only mandatory-to- > implement algorithm in the SSHv2 RFCs, mostly because alternative > algorithms were encumbered by patents when the SSHv2 protocol was > specified. > > This has not been the case for decades at this point and better > algorithms are well supported by all actively-maintained SSH > implementations. We do not consider the costs of maintaining DSA > in OpenSSH to be justified and hope that removing it from OpenSSH > can accelerate its wider deprecation in supporting cryptography > libraries. > > Currently DSA is disabled at compile time by default. The final > step of removing DSA support entirely is planned for the first > OpenSSH release of 2025. > > DSA support may be re-enabled in OpenBSD by setting "DSAKEY=yes" > in Makefile.inc. To enable DSA support in portable OpenSSH, pass > the "--enable-dsa-keys" option to configure. > > Potentially-incompatible changes > -------------------------------- > > * ssh(1): remove support for pre-authentication compression. > OpenSSH has only supported post-authentication compression in > the server for some years. Compression before authentication > significantly increases the attack surface of SSH servers and risks > creating oracles that reveal information about information sent > during authentication. > > * ssh(1), sshd(8): processing of the arguments to the "Match" > configuration directive now follows more shell-like rules for > quoted strings, including allowing nested quotes and \-escaped > characters. If configurations contained workarounds for the > previous simplistic quote handling then they may need to be > adjusted. > > Changes since OpenSSH 9.8 > ========================> > This release contains a number of new features and bugfixes. > > New features > ------------ > > * ssh(1), sshd(8): add support for a new hybrid post-quantim key > exchange based on on the FIPS 203 Module-Lattice Key Enapsulation > mechanism (ML-KEM) combined with X25519 ECDH as described by > https://datatracker.ietf.org/doc/html/draft-kampanakis-curdle-ssh-pq-ke-03 > This algorithm "mlkem768x25519-sha256" is available by default. > > * ssh(1): the ssh_config "Include" directive can now expand > environment as well as the same set of %-tokens "Match Exec" > supports. > > * sshd(8): add a sshd_config "RefuseConnection" option that, if set > will terminate the connection at the first authentication request. > > * sshd(8): add a "refuseconnection" penalty class to sshd_config > PerSourcePenalties that is applied when a connection is dropped by > the new RefuseConnection keyword. > > * sshd(8): add a "Match invalid-user" predicate to sshd_config Match > options that matches when the target username is not valid on the > server. > > * ssh(1), sshd(8): update the Streamlined NTRUPrime code to a > substantially faster implementation. > > * ssh(1), sshd(8): the hybrid Streamlined NTRUPrime/X25519 key > exchange algorithm now has an IANA-assigned name in addition to > the "@openssh.com" vendor extension name. This algorithm is now > also available under this name "sntrup761x25519-sha512" > > * ssh(1), sshd(8), ssh-agent(1): prevent private keys from being > included in core dump files for most of their lifespans. This is > in addition to pre-existing controls in ssh-agent(1) and sshd(8) > that prevented coredumps. This feature is supported in OpenBSD, > Linux and FreeBSD. > > * All: convert key handling to use the libcrypto EVP_PKEY API, with > the exception of DSA. > > * sshd(8): add a random amount of jitter (up to 4 seconds) to the > grace login time to make its expiry unpredictable. > > Bugfixes > -------- > > * sshd(8): relax absolute path requirement back to what it was prior > to OpenSSH 9.8, which incorrectly required that sshd was started > with an absolute path in inetd mode. bz3717 > > * sshd(8): fix regression introduced in openssh-9.8 that swapped the > order of source and destination addresses in some sshd log messages. > > * sshd(8): do not apply authorized_keys options when signature > verification fails. Prevents more restrictive key options being > incorrectly applied to subsequent keys in authorized_keys. bz3733 > > * ssh-keygen(1): include pathname in some of ssh-keygen passphrase > prompts. Helps the user know what's going on when ssh-keygen is > invoked via other tools. Requested in GHPR503 > > * ssh(1), ssh-add(1): make parsing user at host consistently look for > the last '@' in the string rather than the first. This makes it > possible to more consistently use usernames that contain '@' > characters. > > * ssh(1), sshd(8): be more strict in parsing key type names. Only > allow short names (e.g "rsa") in user-interface code and require > full SSH protocol names (e.g. "ssh-rsa") everywhere else. bz3725 > > * regress: many performance and correctness improvements to the > re-keying regression test. > > * ssh-keygen(1): clarify that ed25519 is the default key type > generated and clarify that rsa-sha2-512 is the default signature > scheme when RSA is in use. GHPR505 > > * sshd(8): fix minor memory leak in Subsystem option parsing; GHPR515 > > * All: additional hardening and consistency checks for the sshbuf > code. > > * sshd(8): reduce default logingrace penalty to ensure that a single > forgotton login that times out will be below the penalty threshold. > > * ssh(1): fix proxy multiplexing (-O proxy) bug. If a mux started with > ControlPersist then later has a forwarding added using mux proxy > connection and the forwarding was used, then when the mux proxy > session terminated, the mux master process would issue a bad message > that terminated the connection. > > Portability > ----------- > > * sync contrib/ssh-copy-id to the latest upstream version. > > * regress: improve portablility for some awk(1) usage (e.g. Solaris) > > * In the contrib/redhat RPM spec file, without_openssl was previously > incorrectly enabled unconditionally. > > * sshd(8) restore audit call before exit that regressed in openssh-9.8 > Fixes an issue where the SSH_CONNECTION_ABANDON event was not > recorded. > > * sshd(8): add support for class-imposed loging restrictions on FreeBSD. > Allowing auth_hostok(3) and auth_timeok(3) to control logins. > > * Build fixes for Musl libc. > > * Fix detection of setres*id on GNU/Hurd > > OpenSSH is brought to you by Markus Friedl, Niels Provos, Theo de > Raadt, Kevin Steves, Damien Miller, Darren Tucker, Jason McIntyre, > Tim Rice and Ben Lindstrom. > > _______________________________________________ > openssh-unix-dev mailing list > openssh-unix-dev at mindrot.org > https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev >-- Dmitry Belyavskiy