OpenSSH is a free version of SSH (Secure SHell), a program for logging
into and executing commands on a remote machine. ssh-keysign is a
helper program used for host-based authentication disabled by default.
Provides
Requires
License
BSD-3-Clause AND BSD-2-Clause AND ISC AND SSH-OpenSSH AND ssh-keyscan AND sprintf AND LicenseRef-Fedora-Public-Domain AND X11-distribute-modifications-variant
Changelog
* Mon Sep 15 2025 Dmitry Belyavskiy <dbelyavs@redhat.com> - 10.0p1-7
- rebuilt
* Thu Aug 28 2025 Dmitry Belyavskiy <dbelyavs@redhat.com> - 10.0p1-6
- Enable GSS KEX in FIPS mode
* Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 10.0p1-5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
* Fri Jun 27 2025 Dmitry Belyavskiy <dbelyavs@redhat.com> - 10.0p1-4
- Update sshd@.service to follow upstream, mostly support ephemeral sshd keys
Submitted by Allison Karlitskaya (https://src.fedoraproject.org/rpms/openssh/pull-request/101)
Needs a SELinux counterpart.
Related: rhbz#2374928
* Mon Jun 09 2025 Dmitry Belyavskiy <dbelyavs@redhat.com> - 10.0p1-3
- Apply patches forgot in previous respin
* Mon May 19 2025 Dmitry Belyavskiy <dbelyavs@redhat.com> - 10.0p1-2
- Provide better diagnostics for non-supported private keys
(https://github.com/openssh/openssh-portable/pull/564)
- Ignore too short hostkeys in known_hosts file
(https://github.com/openssh/openssh-portable/pull/567)
- Switch to systemd-socket activation for ssh-agent
Resolves: rhbz#2181353
* Fri May 16 2025 Dmitry Belyavskiy <dbelyavs@redhat.com> - 10.0p1-1
- Rebase to OpenSSH 10.0p1
* Thu Apr 17 2025 Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.9p1-15
- Require OpenSSL 3.5 to support PQ crypto
- Suppress systemd warning on restart sshd
* Tue Mar 18 2025 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 9.9p1-14
- Remove /usr/local/sbin from the default path too
* Tue Mar 18 2025 Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.9p1-13
- Remove /usr/sbin from the default path
Resolves: rhbz#2352387
- Export and accept COLORTERM
Resolves: rhbz#2352653
* Thu Mar 06 2025 Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.9p1-12
- Update ssh-keysign permission for RPM linter
* Wed Mar 05 2025 Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.9p1-11
- Use OpenSSL ML-KEM implementation instead of the native one
* Tue Feb 25 2025 Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.9p1-10
- Some minor fixes from Rocky Linux
https://www.openwall.com/lists/oss-security/2025/02/22/1
* Tue Feb 18 2025 Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.9p1-9
- Fix regression of Match directive processing
- Fix missing error codes set and invalid error code checks in OpenSSH. It
prevents memory exhaustion attack and a MITM attack when VerifyHostKeyDNS
is on (CVE-2025-26465, CVE-2025-26466).
* Sat Feb 01 2025 Björn Esser <besser82@fedoraproject.org> - 9.9p1-8.1
- Add explicit BR: libxcrypt-devel
* Wed Jan 29 2025 FeRD (Frank Dana) <ferdnyc@gmail.com> - 9.9p1-8
- Replace deprecated (since 8.7) ChallengeResponseAuthentication
with KbdInteractiveAuthentication, in redhat sshd config
* Mon Jan 27 2025 Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.9p1-7
- Fix regression of Match directive processing
Resolves: rhbz#2341769
* Mon Jan 27 2025 Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.9p1-6
- Remove pam-ssh-agent subcomponent
Resolves: rhbz#2338440
* Fri Jan 17 2025 Fedora Release Engineering <releng@fedoraproject.org> - 9.9p1-5.1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
* Mon Oct 28 2024 Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.9p1-5
- Fix MLKEM for BE platforms
* Wed Oct 16 2024 Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.9p1-4
- Resolve memory management issues after rebase
- Define OPTIONS env in systemd modules (https://src.fedoraproject.org/rpms/openssh/pull-request/92)
* Fri Oct 11 2024 Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.9p1-3
- Separate ssh-keysign to a dedicated package
- Use FIPS KEX defaults in FIPS mode
* Thu Oct 10 2024 Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.9p1-2
- Update version of pam_ssh_agent_auth
* Tue Oct 08 2024 Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.9p1-1
- Update to OpenSSH 9.9p1
* Tue Sep 03 2024 Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.8p1-4
- Synchronize patches from Red Hat
* Mon Aug 05 2024 Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.8p1-3
- Sshd now proposes to enter password again when a non-existing user is specified
* Fri Jul 26 2024 Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.8p1-2
- Change default key type in FIPS mode
* Mon Jul 22 2024 Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.8p1-1
- Update to OpenSSH 9.8p1
* Thu Jul 18 2024 Fedora Release Engineering <releng@fedoraproject.org> - 9.6p1-1.14
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
* Tue Jul 02 2024 Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.6p1-1.13
- rebuilt
* Mon Jul 01 2024 Gordon Messmer <gordon.messmer@gmail.com> - 9.6p1-12
- Patch 9.6p1 for CVE-2024-6387
* Mon Jul 01 2024 Gordon Messmer <gordon.messmer@gmail.com> - 9.6p1-11
- Shorten paths used for parallel tests to fix BZ#2295117
* Thu May 09 2024 Zoltan Fridrich <zfridric@redhat.com> - 9.6p1-10
- Correctly audit hostname and IP address
- Make default key sizes configurable in sshd-keygen
* Wed Apr 24 2024 Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.6p1-1.9
- Use OpenSSL SSH KDF implementation - s390x fixup
* Wed Apr 24 2024 Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.6p1-1.8
- Use OpenSSL SSH KDF implementation
* Wed Apr 17 2024 Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.6p1-1.7
- Only set PAM_RHOST if the remote host is not "UNKNOWN"
https://src.fedoraproject.org/rpms/openssh/pull-request/71
Patch by Daan De Meyer <daan.j.demeyer@gmail.com>
- Some spec cleanup
https://src.fedoraproject.org/rpms/openssh/pull-request/74
by Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>
* Thu Apr 04 2024 Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.6p1-1.6
- rebuilt
* Thu Apr 04 2024 Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.6p1-1.5
- rebuilt
* Tue Apr 02 2024 Gordon Messmer <gordon.messmer@gmail.com> - 9.6p1-1.4
- Build OpenSSH without libsystemd dependency, using reference implementation
* Wed Mar 13 2024 Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.6p1-1.3
- Build OpenSSH without engine support
- Make tests run at build phase (using parallel run mechanism by Alexander Sosedkin)
* Thu Jan 25 2024 Fedora Release Engineering <releng@fedoraproject.org> - 9.6p1-1.2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
* Sun Jan 21 2024 Fedora Release Engineering <releng@fedoraproject.org> - 9.6p1-1.1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
* Tue Dec 26 2023 Daniel Milnes <daniel@daniel-milnes.uk> - 9.6p1-1
- Update to OpenSSH 9.6
Original patches from https://src.fedoraproject.org/rpms/openssh/pull-request/63
Tuned by Dmitry Belyavskiy for GSS and PKCS#11 URI processing
* Fri Dec 22 2023 Florian Weimer <fweimer@redhat.com> - 9.3p1-13.1
- Fix type errors in downstream gssapi-keyex patch
* Mon Oct 16 2023 Mattias Ellert <