| Index | index by Group | index by Distribution | index by Vendor | index by creation date | index by Name | Mirrors | Help | Search |
| Name: openssh-cavs | Distribution: openSUSE Tumbleweed |
| Version: 10.0p2 | Vendor: openSUSE |
| Release: 4.1 | Build date: Mon Sep 22 10:44:33 2025 |
| Group: Productivity/Networking/SSH | Build host: reproducible |
| Size: 213356 | Source RPM: openssh-10.0p2-4.1.src.rpm |
| Packager: http://bugs.opensuse.org | |
| Url: https://www.openssh.com/ | |
| Summary: OpenSSH FIPS crypto module CAVS tests | |
This package contains the FIPS-140 CAVS (Cryptographic Algorithm Validation Program/Suite) related tests of OpenSSH.
BSD-2-Clause AND MIT
* Mon Sep 22 2025 Antonio Larrosa <alarrosa@suse.com>
- Add patch to relax the openssl 3.x version check so that we
don't identify a mismatch between released and pre-release
versions as incompatible when we already identify the whole
3.x versions as compatible (boo#1250115):
* openssh-10.0p2-relax-openssl-version-check.patch
- Run some of the tests to check there are no regressions.
* Tue Sep 09 2025 Luna D Dragon <luna.dragon@suse.com>
- Update sshd@.service to match upstream more closely, to enable
support for ephemeral sshd keys.
- Add openssh-9.6p1-pam-rhost.patch which fixes a performance issue
where pam can do a reverse dns query of "UNKNOWN" which times out
multiple times, causing a substantial slowdown when logging in
(bsc#1249352).
* Tue May 13 2025 Antonio Larrosa <alarrosa@suse.com>
- Enable --with-logind to call the SetTTY dbus method in systemd
in SLE15 too. This allows "wall" to print messages in ssh ttys
(bsc#1239671)
- Small fixes to unref the dbus session when any error occurs:
* logind_set_tty.patch
* Tue Apr 22 2025 Hans Petter Jansson <hpj@suse.com>
- Add openssh-send-extra-term-env.patch, which appends a few
environment variables useful for terminal identification to the
default send and accept lists.
* Thu Apr 10 2025 Antonio Larrosa <alarrosa@suse.com>
- "Update" to openssh 10.0p2:
- There was an issue during the packaging of 10.0p1 which made it
identify itself as 10.0p2 so 10.0p1 is now considered identical
to 10.0p2 and upstream won't release a separate 10.0p2 package.
* Wed Apr 09 2025 Antonio Larrosa <alarrosa@suse.com>
- Update to openssh 10.0p1:
= Potentially-incompatible changes
* This release removes support for the weak DSA signature
algorithm, completing the deprecation process that began in
2015 (when DSA was disabled by default) and repeatedly warned
over the last 12 months.
* scp(1), sftp(1): pass "ControlMaster no" to ssh when invoked by
scp & sftp. This disables implicit session creation by these
tools when ControlMaster was set to yes/auto by configuration,
which some users found surprising. This change will not prevent
scp/sftp from using an existing multiplexing session if one had
already been created. GHPR557
* This release has the version number 10.0 and announces itself
as "SSH-2.0-OpenSSH_10.0". Software that naively matches
versions using patterns like "OpenSSH_1*" may be confused by
this.
* sshd(8): this release removes the code responsible for the
user authentication phase of the protocol from the per-
connection sshd-session binary to a new sshd-auth binary.
Splitting this code into a separate binary ensures that the
crucial pre-authentication attack surface has an entirely
disjoint address space from the code used for the rest of the
connection. It also yields a small runtime memory saving as the
authentication code will be unloaded after the authentication
phase completes. This change should be largely invisible to
users, though some log messages may now come from "sshd-auth"
instead of "sshd-session". Downstream distributors of OpenSSH
will need to package the sshd-auth binary.
* sshd(8): this release disables finite field (a.k.a modp)
Diffie-Hellman key exchange in sshd by default. Specifically,
this removes the "diffie-hellman-group*" and
"diffie-hellman-group-exchange-*" methods from the default
KEXAlgorithms list. The client is unchanged and continues to
support these methods by default. Finite field Diffie Hellman
is slow and computationally expensive for the same security
level as Elliptic Curve DH or PQ key agreement while offering
no redeeming advantages. ECDH has been specified for the SSH
protocol for 15 years and some form of ECDH has been the
default key exchange in OpenSSH for the last 14 years.
* sshd(8): this release removes the implicit fallback to
compiled-in groups for Diffie-Hellman Group Exchange KEX when
the moduli file exists but does not contain moduli within the
client-requested range. The fallback behaviour remains for the
case where the moduli file does not exist at all. This allows
administrators more explicit control over which DH groups will
be selected, but can lead to connection failures if the moduli
file is edited incorrectly. bz#2793
= Security
* sshd(8): fix the DisableForwarding directive, which was failing
to disable X11 forwarding and agent forwarding as documented.
X11 forwarding is disabled by default in the server and agent
forwarding is off by default in the client (bsc#1241012,
CVE-2025-32728)
= New features
* ssh(1): the hybrid post-quantum algorithm mlkem768x25519-sha256
is now used by default for key agreement. This algorithm is
considered to be safe against attack by quantum computers,
is guaranteed to be no less strong than the popular
curve25519-sha256 algorithm, has been standardised by NIST
and is considerably faster than the previous default.
* ssh(1): prefer AES-GCM to AES-CTR mode when selecting a cipher
for the connection. The default cipher preference list is now
Chacha20/Poly1305, AES-GCM (128/256) followed by AES-CTR
(128/192/256).
* ssh(1): add %-token and environment variable expansion to the
ssh_config SetEnv directive.
* ssh(1): allow %-token and environment variable expansion in
the ssh_config User directive, with the exception of %r and %C
which would be self-referential. bz#3477
* ssh(1), sshd(8): add "Match version" support to ssh_config and
sshd_config. Allows matching on the local version of OpenSSH,
e.g. "Match version OpenSSH_10.*".
* ssh(1): add support for "Match sessiontype" to ssh_config.
Allows matching on the type of session initially requested,
either "shell" for interactive sessions, "exec" for command
execution sessions, "subsystem" for subsystem requests, such as
sftp, or "none" for transport/forwarding-only sessions.
* ssh(1): add support for "Match command ..." support to
ssh_config, allowing matching on the remote command as
specified on the command-line.
* ssh(1): allow 'Match tagged ""' and 'Match command ""' to match
empty tag and command values respectively.
* sshd(8): allow glob(3) patterns to be used in sshd_config
AuthorizedKeysFile and AuthorizedPrincipalsFile directives.
bz2755
* sshd(1): support the VersionAddendum in the client, mirroring
the option of the same name in the server; bz2745
* ssh-agent(1): the agent will now delete all loaded keys when
signaled with SIGUSR1. This allows deletion of keys without
having access to $SSH_AUTH_SOCK.
* Portable OpenSSH, ssh-agent(1): support systemd-style socket
activation in ssh-agent using the LISTEN_PID/LISTEN_FDS
mechanism. Activated when these environment variables are set,
the agent is started with the -d or -D option and no socket
path is set. GHPR502
* ssh-keygen(1): support FIDO tokens that return no attestation
data, e.g. recent WinHello. GHPR542
* ssh-agent(1): add a "-Owebsafe-allow=..." option to allow the
default FIDO application ID allow-list to be overridden.
* Add a work-in-progress tool to verify FIDO attestation blobs
that ssh-keygen can optionally write when enrolling FIDO keys.
This tool is available under
regress/misc/ssh-verify-attestation for experimentation but is
not installed by "make install".
* ssh-keygen(1): allow "-" as output file for moduli screening.
GHPR393
= Bugfixes
* sshd(8): remove assumption that the sshd_config and any configs
it includes can fit in a (possibly enlarged) socket buffer.
Previously it was possible to create a sufficiently large
configuration that could cause sshd to fail to accept any
connection. sshd(8) will now actively manage sending its config
to the sshd-session sub-process.
* ssh(1): don't start the ObscureKeystrokeTiming mitigations if
there has been traffic on a X11 forwarding channel recently.
Should fix X11 forwarding performance problems when this
setting is enabled. bz3655
* ssh(1): prohibit the comma character in hostnames accepted, but
allow an underscore as the first character in a hostname.
* sftp(1): set high-water when resuming a "put". Prevents bogus
"server reordered acks" debug message.
* ssh(1), sshd(8): fix regression in openssh-9.8, which would
fail to accept "Match criteria=argument" as well as the
documented "Match criteria argument" syntax in ssh_config and
sshd_config. bz3739
* sftp(1), ssh(1): fix a number possible NULL dereference bugs,
including Coverity CIDs 405019 and 477813.
* sshd(8): fix PerSourcePenalty incorrectly using "crash" penalty
when LoginGraceTime was exceeded. bz3797
* sshd(8): fix "Match invalid-user" from incorrectly being
activated in initial configuration pass when no other
predicates were present on the match line
* sshd(8): fix debug logging of user specific delay. GHPR#552
* sshd(8): improve debug logging across sub-process boundaries.
Previously some log messages were lost early in the sshd-auth
and sshd-session processes' life.
* ssh(1): require control-escape character sequences passed via
the '-e ^x' command-line to be exactly two characters long.
Avoids one byte out-of-bounds read if ssh is invoked as
"ssh -e^ ..." GHPR368
* ssh(1), sshd(8): prevent integer overflow in x11 port handling.
These are theoretically possible if the admin misconfigured
X11DisplayOffset or the user misconfigures their own $DISPLAY,
but don't happen in normal operation. bz#3730
* ssh-keygen(1): don't mess up ssh-keygen -l output when the file
contains CR characters; GHPR236 bz3385.
* sshd(8): add rate limits to logging of connections dropped by
PerSourcePenalties. Previously these could be noisy in logs.
* ssh(1): fix argument of "Compression" directive in ssh -G
config dump, which regressed in openssh-9.8.
* sshd(8): fix a corner-case triggered by UpdateHostKeys when
sshd refuses to accept the signature returned by an agent
holding host keys during the hostkey rotation sub-protocol.
This situation could occur in situations where a PKCS#11
smartcard that lacked support for particular signature
algorithms was used to store host keys.
* ssh-keygen(1): when using RSA keys to sign messages with
"ssh-keygen -Y", select the signature algorithm based on the
requested hash algorithm ("-Ohashalg=xxx"). This allows using
something other than the default of rsa-sha2-512, which may not
be supported on all signing backends, e.g. some smartcards only
support SHA256.
* ssh(1), sshd(8), ssh-keyscan(1): fix ML-KEM768x25519 KEX on
big-endian systems.
* Many regression and interop test improvements.
= Portability
* All: add support for AWS-LC (AWS libcrypto). bz3784
* sshd(8): add wtmpdb support as a Y2038 safe wtmp replacement.
* sshd(8): add support for locking sshd into memory, enabled with
the --with-linux-memlock-onfault configure flag.
* Add support for building a standalone sk-libfido2 library,
enabled by --with-security-key-standalone
* ssh(1), sshd(8), ssh-keyscan(1): include __builtin_popcount
replacement function. for compilers that lack it.
* All: Check for and replace le32toh, le64toh, htole64
separately. It appears that at least some versions of endian.h
in glibc do not have the latter two. bz#3794
* Remove ancient RHL 6.x config in RPM spec.
- Rebase patches:
* openssh-7.7p1-fips.patch
* openssh-7.7p1-cavstest-ctr.patch
* openssh-7.7p1-cavstest-kdf.patch
* openssh-7.7p1-fips_checks.patch
* openssh-8.0p1-gssapi-keyex.patch
* openssh-8.1p1-audit.patch
* openssh-7.7p1-ldap.patch
* openssh-reenable-dh-group14-sha1-default.patch
* openssh-8.4p1-vendordir.patch
* logind_set_tty.patch
* openssh-mitigate-lingering-secrets.patch
* openssh-7.8p1-role-mls.patch
* openssh-6.6p1-privsep-selinux.patch
* openssh-6.6.1p1-selinux-contexts.patch
* openssh-9.6p1-crypto-policies-man.patch
* openssh-7.6p1-cleanup-selinux.patch
- Drop patches now included upstream:
* wtmpdb.patch
* fix-x11-regression-bsc1229449.patch
* fix-nopie-flag.patch
- Drop patch since SHA-1 isn't considered secure and the default
kex list comes from crypto-policies anyway:
* openssh-reenable-dh-group14-sha1-default.patch
* Mon Apr 07 2025 Antonio Larrosa <alarrosa@suse.com>
- Do not try to create /etc/ssh in sshd-gen-keys-start
(bsc#1238191). sshd-gen-keys-start transitions to a SELinux
domain that doesn't have the necessary permissions. Based on
a SR by Johannes Segitz <jsegitz@suse.com>.
* Wed Apr 02 2025 Antonio Larrosa <alarrosa@suse.com>
- Add patch to fix parsing of CFLAGS with duplicated -pie flags,
which break 'make tests'. Submitted to upstream in
https://bugzilla.mindrot.org/show_bug.cgi?id=3806 .
* fix-nopie-flag.patch
* Tue Mar 18 2025 Hillwood Yang <hillwood@opensuse.org>
- Disable seccomp_filter and rlimitsandbox sandbox for loongarch.
seccomp_filter and rlimitsandbox not supported on loongarch64 yet.
* Wed Feb 19 2025 Dirk Müller <dmueller@suse.com>
- merge openssh-fips into the main openssh package (bsc#1185116)
* Tue Feb 18 2025 Antonio Larrosa <alarrosa@suse.com>
- Update to openssh 9.9p2:
= Security
* Fix CVE-2025-26465 - ssh(1) in OpenSSH versions 6.8p1 to 9.9p1
(inclusive) contained a logic error that allowed an on-path
attacker (a.k.a MITM) to impersonate any server when the
VerifyHostKeyDNS option is enabled. This option is off by
default.
* Fix CVE-2025-26466 - sshd(8) in OpenSSH versions 9.5p1 to 9.9p1
(inclusive) is vulnerable to a memory/CPU denial-of-service
related to the handling of SSH2_MSG_PING packets. This
condition may be mitigated using the existing
PerSourcePenalties feature.
Both vulnerabilities were discovered and demonstrated to be
exploitable by the Qualys Security Advisory team. The openSSH
team thanks them for their detailed review of OpenSSH.
= Bugfixes
* ssh(1), sshd(8): fix regression in Match directive that caused
failures when predicates and their arguments were separated by
'=' characters instead of whitespace (bz3739).
* sshd(8): fix the "Match invalid-user" predicate, which was
matching incorrectly in the initial pass of config evaluation.
* ssh(1), sshd(8), ssh-keyscan(1): fix mlkem768x25519-sha256 key
exchange on big-endian systems.
* Fix a number of build problems on particular operating systems
and configurations.
- Remove patches that are already included in 9.9p2:
* 0001-fix-utmpx-ifdef.patch
* 0002-upstream-fix-regression-introduced-when-I-switched-the-Match.patch
* 0003-upstream-fix-previous-change-to-ssh_config-Match_-which-broken-on.patch
* 0004-upstream-fix-ML-KEM768x25519-KEX-on-big-endian-systems-spotted-by.patch
* fix-CVE-2025-26465-and-CVE-2025-26466.patch
* Thu Feb 13 2025 Antonio Larrosa <alarrosa@suse.com>
- Fix a MitM attack against OpenSSH's VerifyHostKeyDNS-enabled
client and a DoS attack against OpenSSH's client and server
(bsc#1237040, CVE-2025-26465, bsc#1237041, CVE-2025-26466):
* fix-CVE-2025-26465-and-CVE-2025-26466.patch
* Wed Jan 22 2025 Dominique Leuenberger <dimstar@opensuse.org>
- Drop rcFOO symlinks for CODE16 (PED-266).
* Mon Oct 28 2024 Antonio Larrosa <alarrosa@suse.com>
- Don't force using gcc11 on SLFO/ALP which have a newer version.
* Mon Oct 28 2024 Antonio Larrosa <alarrosa@suse.com>
- Add patches from upstream:
- To fix a copy&paste oversight in an ifdef :
* 0001-fix-utmpx-ifdef.patch
- To fix a regression introduced when the "Match" criteria
tokenizer was modified since it stopped supporting the
"Match criteria=argument" format:
* 0002-upstream-fix-regression-introduced-when-I-switched-the-Match.patch
- To fix the previous patch which broke on negated Matches:
* 0003-upstream-fix-previous-change-to-ssh_config-Match_-which-broken-on.patch
- To fix the ML-KEM768x25519 kex algorithm on big-endian systems:
* 0004-upstream-fix-ML-KEM768x25519-KEX-on-big-endian-systems-spotted-by.patch
* Mon Oct 14 2024 Antonio Larrosa <alarrosa@suse.com>
- Use %{with ...} instead of 0%{with ...}
* Fri Oct 11 2024 Antonio Larrosa <alarrosa@suse.com>
- Add a patch to fix a regression introduced in 9.6 that makes X11
forwarding very slow. Submitted to upstream in
https://bugzilla.mindrot.org/show_bug.cgi?id=3655#c4 . Fixes
bsc#1229449:
* fix-x11-regression-bsc1229449.patch
- Remove empty line at the end of sshd-sle.pamd (bsc#1227456)
* Wed Sep 25 2024 Antonio Larrosa <alarrosa@suse.com>
- Add a const to the openssl 1.1/RSA section of sshkey_is_private
to keep it similar to what it used before the 9.9 rebase:
* openssh-8.1p1-audit.patch
- Add a openssl11 bcond to the spec file for the SLE12 case
instead of checking suse_version in different parts.
- Move conditional patches to a number >= 1000.
* Mon Sep 23 2024 Antonio Larrosa <alarrosa@suse.com>
- Update to openssh 9.9p1:
= Future deprecation notice
* OpenSSH plans to remove support for the DSA signature algorithm
in early 2025. This release disables DSA by default at compile
time. DSA, as specified in the SSHv2 protocol, is inherently
weak - being limited to a 160 bit private key and use of the
SHA1 digest. Its estimated security level is only 80 bits
symmetric equivalent.
OpenSSH has disabled DSA keys by default since 2015 but has
retained run-time optional support for them. DSA was the only
mandatory-to-implement algorithm in the SSHv2 RFCs, mostly
because alternative algorithms were encumbered by patents when
the SSHv2 protocol was specified.
This has not been the case for decades at this point and better
algorithms are well supported by all actively-maintained SSH
implementations. We do not consider the costs of maintaining
DSA in OpenSSH to be justified and hope that removing it from
OpenSSH can accelerate its wider deprecation in supporting
cryptography libraries.
= Potentially-incompatible changes
* ssh(1): remove support for pre-authentication compression.
OpenSSH has only supported post-authentication compression in
the server for some years. Compression before authentication
significantly increases the attack surface of SSH servers and
risks creating oracles that reveal information about
information sent during authentication.
* ssh(1), sshd(8): processing of the arguments to the "Match"
configuration directive now follows more shell-like rules for
quoted strings, including allowing nested quotes and \-escaped
characters. If configurations contained workarounds for the
previous simplistic quote handling then they may need to be
adjusted. If this is the case, it's most likely to be in the
arguments to a "Match exec" confition. In this case, moving the
command to be evaluated from the Match line to an external
shell script is easiest way to preserve compatibility with both
the old and new versions.
= New features
* ssh(1), sshd(8): add support for a new hybrid post-quantum key
exchange based on the FIPS 203 Module-Lattice Key Enapsulation
mechanism (ML-KEM) combined with X25519 ECDH as described by
https://datatracker.ietf.org/doc/html/draft-kampanakis-curdle-ssh-pq-ke-03
This algorithm "mlkem768x25519-sha256" is available by default.
* ssh(1): the ssh_config "Include" directive can now expand
environment as well as the same set of %-tokens "Match Exec"
supports.
* sshd(8): add a sshd_config "RefuseConnection" option that, if
set will terminate the connection at the first authentication
request.
* sshd(8): add a "refuseconnection" penalty class to sshd_config
PerSourcePenalties that is applied when a connection is dropped
by the new RefuseConnection keyword.
* sshd(8): add a "Match invalid-user" predicate to sshd_config
Match options that matches when the target username is not
valid on the server.
* ssh(1), sshd(8): update the Streamlined NTRUPrime code to a
substantially faster implementation.
* ssh(1), sshd(8): the hybrid Streamlined NTRUPrime/X25519 key
exchange algorithm now has an IANA-assigned name in addition to
the "@openssh.com" vendor extension name. This algorithm is now
also available under this name "sntrup761x25519-sha512"
* ssh(1), sshd(8), ssh-agent(1): prevent private keys from being
included in core dump files for most of their lifespans. This
is in addition to pre-existing controls in ssh-agent(1) and
sshd(8) that prevented coredumps. This feature is supported on
OpenBSD, Linux and FreeBSD.
* All: convert key handling to use the libcrypto EVP_PKEY API,
with the exception of DSA.
* sshd(8): add a random amount of jitter (up to 4 seconds) to the
grace login time to make its expiry unpredictable.
= Bugfixes
* sshd(8): relax absolute path requirement back to what it was
prior to OpenSSH 9.8, which incorrectly required that sshd was
started with an absolute path in inetd mode. bz3717
* sshd(8): fix regression introduced in openssh-9.8 that swapped
the order of source and destination addresses in some sshd log
messages.
* sshd(8): do not apply authorized_keys options when signature
verification fails. Prevents more restrictive key options being
incorrectly applied to subsequent keys in authorized_keys.
bz3733
* ssh-keygen(1): include pathname in some of ssh-keygen's
passphrase prompts. Helps the user know what's going on when
ssh-keygen is invoked via other tools. Requested in GHPR503
* ssh(1), ssh-add(1): make parsing user@host consistently look
for the last '@' in the string rather than the first. This
makes it possible to more consistently use usernames that
contain '@' characters.
* ssh(1), sshd(8): be more strict in parsing key type names. Only
allow short names (e.g "rsa") in user-interface code and
require full SSH protocol names (e.g. "ssh-rsa") everywhere
else. bz3725
* regress: many performance and correctness improvements to the
re-keying regression test.
* ssh-keygen(1): clarify that ed25519 is the default key type
generated and clarify that rsa-sha2-512 is the default
signature scheme when RSA is in use. GHPR505
* sshd(8): fix minor memory leak in Subsystem option parsing;
GHPR515
* All: additional hardening and consistency checks for the sshbuf
code.
* sshd(8): reduce default logingrace penalty to ensure that a
single forgotton login that times out will be below the penalty
threshold.
* ssh(1): fix proxy multiplexing (-O proxy) bug. If a mux started
with ControlPersist then later has a forwarding added using mux
proxy connection and the forwarding was used, then when the mux
proxy session terminated, the mux master process would issue a
bad message that terminated the connection.
= Portability
* sync contrib/ssh-copy-id to the latest upstream version.
* regress: improve portablility for some awk(1) usage
(e.g. Solaris)
* In the contrib/redhat RPM spec file, without_openssl was
previously incorrectly enabled unconditionally.
* sshd(8) restore audit call before exit that regressed in
openssh-9.8. Fixes an issue where the SSH_CONNECTION_ABANDON
event was not recorded.
* sshd(8): add support for class-imposed loging restrictions on
FreeBSD. Allowing auth_hostok(3) and auth_timeok(3) to control
logins.
* Build fixes for Musl libc.
* Fix detection of setres*id on GNU/Hurd
- Drop patches that were already merged by upstream:
* fix-memleak-in-process_server_config_line_depth.patch
* fix-audit-fail-attempt.patch
- Rebase patch with significant changes:
* openssh-8.1p1-audit.patch
- Rebase patches with context or trivial changes:
* openssh-7.7p1-fips.patch
* openssh-8.0p1-gssapi-keyex.patch
* openssh-9.6p1-crypto-policies-man.patch
* openssh-mitigate-lingering-secrets.patch
- Several spec file fixes so the package builds and can be
installed in SLE 15 SP5 and SLE 12 SP5
- Use gcc11 when building in SLE12 and SLE15.
* Thu Sep 12 2024 Antonio Larrosa <alarrosa@suse.com>
- Drop most of openssh-6.6p1-keycat.patch (actually, it was just
commented out). The keycat binary isn't really installed nor
supported, so we can drop it, except for the code that is used
by other SELinux patches, which is what I kept from that patch
(boo#1229072).
- Add patch submitted to upstream to fix RFC4256 implementation
so that keyboard-interactive authentication method can send
instructions and sshd shows them to users even before a prompt
is requested. This fixes MFA push notifications (boo#1229010).
* 0001-auth-pam-Immediately-report-instructions-to-clients-and-fix-handling-in-ssh-client.patch
* Fri Aug 23 2024 Antonio Larrosa <alarrosa@suse.com>
- Add patch to fix sshd not logging in the audit failed login
attempts (submitted to upstream in
https://github.com/openssh/openssh-portable/pull/516):
* fix-audit-fail-attempt.patch
- Use --enable-dsa-keys when building openssh. It's required if
the user sets the crypto-policy mode to LEGACY, where DSA keys
should be allowed. The option was added by upstream in 9.7 and
set to disabled by default.
- These two changes fix 2 of the 3 issues reported in bsc#1229650.
* Mon Aug 12 2024 Antonio Larrosa <alarrosa@suse.com>
- Fix a dbus connection leaked in the logind patch that was
missing a sd_bus_unref call (found by Matthias Gerstner):
* logind_set_tty.patch
- Add a patch that fixes a small memory leak when parsing the
subsystem configuration option:
* fix-memleak-in-process_server_config_line_depth.patch
* Thu Aug 01 2024 Antonio Larrosa <alarrosa@suse.com>
- Update to openssh 9.8p1:
= Security
* 1) Race condition in sshd(8) (bsc#1226642, CVE-2024-6387).
A critical vulnerability in sshd(8) was present in Portable
OpenSSH versions between 8.5p1 and 9.7p1 (inclusive) that may
allow arbitrary code execution with root privileges.
Successful exploitation has been demonstrated on 32-bit
Linux/glibc systems with ASLR. Under lab conditions, the attack
requires on average 6-8 hours of continuous connections up to
the maximum the server will accept. Exploitation on 64-bit
systems is believed to be possible but has not been
demonstrated at this time. It's likely that these attacks will
be improved upon.
Exploitation on non-glibc systems is conceivable but has not
been examined. Systems that lack ASLR or users of downstream
Linux distributions that have modified OpenSSH to disable
per-connection ASLR re-randomisation (yes - this is a thing, no
- we don't understand why) may potentially have an easier path
to exploitation. OpenBSD is not vulnerable.
We thank the Qualys Security Advisory Team for discovering,
reporting and demonstrating exploitability of this problem, and
for providing detailed feedback on additional mitigation
measures.
* 2) Logic error in ssh(1) ObscureKeystrokeTiming (bsc#1227318,
CVE-2024-39894).
In OpenSSH version 9.5 through 9.7 (inclusive), when connected
to an OpenSSH server version 9.5 or later, a logic error in the
ssh(1) ObscureKeystrokeTiming feature (on by default) rendered
this feature ineffective - a passive observer could still
detect which network packets contained real keystrokes when the
countermeasure was active because both fake and real keystroke
packets were being sent unconditionally.
This bug was found by Philippos Giavridis and also
independently by Jacky Wei En Kung, Daniel Hugenroth and
Alastair Beresford of the University of Cambridge Computer Lab.
Worse, the unconditional sending of both fake and real
keystroke packets broke another long-standing timing attack
mitigation. Since OpenSSH 2.9.9 sshd(8) has sent fake keystoke
echo packets for traffic received on TTYs in echo-off mode,
such as when entering a password into su(8) or sudo(8). This
bug rendered these fake keystroke echoes ineffective and could
allow a passive observer of a SSH session to once again detect
when echo was off and obtain fairly limited timing information
about keystrokes in this situation (20ms granularity by
default).
This additional implication of the bug was identified by
Jacky Wei En Kung, Daniel Hugenroth and Alastair Beresford and
we thank them for their detailed analysis.
This bug does not affect connections when
ObscureKeystrokeTiming was disabled or sessions where no TTY
was requested.
= Future deprecation notice
* OpenSSH plans to remove support for the DSA signature algorithm
in early 2025. This release disables DSA by default at compile
time.
DSA, as specified in the SSHv2 protocol, is inherently weak -
being limited to a 160 bit private key and use of the SHA1
digest. Its estimated security level is only 80 bits symmetric
equivalent.
OpenSSH has disabled DSA keys by default since 2015 but has
retained run-time optional support for them. DSA was the only
mandatory-to-implement algorithm in the SSHv2 RFCs, mostly
because alternative algorithms were encumbered by patents when
the SSHv2 protocol was specified.
This has not been the case for decades at this point and better
algorithms are well supported by all actively-maintained SSH
implementations. We do not consider the costs of maintaining
DSA in OpenSSH to be justified and hope that removing it from
OpenSSH can accelerate its wider deprecation in supporting
cryptography libraries.
This release, and its deactivation of DSA by default at
compile-time, marks the second step in our timeline to finally
deprecate DSA. The final step of removing DSA support entirely
is planned for the first OpenSSH release of 2025.
DSA support may be re-enabled in OpenBSD by setting
"DSAKEY=yes" in Makefile.inc. To enable DSA support in
portable OpenSSH, pass the "--enable-dsa-keys" option to
configure.
= Potentially-incompatible changes
* all: as mentioned above, the DSA signature algorithm is now
disabled at compile time.
* sshd(8): the server will now block client addresses that
repeatedly fail authentication, repeatedly connect without ever
completing authentication or that crash the server. See the
discussion of PerSourcePenalties below for more information.
Operators of servers that accept connections from many users,
or servers that accept connections from addresses behind NAT or
proxies may need to consider these settings.
* sshd(8): the server has been split into a listener binary,
sshd(8), and a per-session binary "sshd-session". This allows
for a much smaller listener binary, as it no longer needs to
support the SSH protocol. As part of this work, support for
disabling privilege separation (which previously required code
changes to disable) and disabling re-execution of sshd(8) has
been removed. Further separation of sshd-session into
additional, minimal binaries is planned for the future.
* sshd(8): several log messages have changed. In particular, some
log messages will be tagged with as originating from a process
named "sshd-session" rather than "sshd".
* ssh-keyscan(1): this tool previously emitted comment lines
containing the hostname and SSH protocol banner to standard
error. This release now emits them to standard output, but adds
a new "-q" flag to silence them altogether.
* sshd(8): (portable OpenSSH only) sshd will no longer use
argv[0] as the PAM service name. A new "PAMServiceName"
sshd_config(5) directive allows selecting the service name at
runtime. This defaults to "sshd". bz2101
* (portable OpenSSH only) Automatically-generated files, such as
configure, config.h.in, etc will now be checked in to the
portable OpenSSH git release branch (e.g. V_9_8). This should
ensure that the contents of the signed release branch exactly
match the contents of the signed release tarball.
= New features
* sshd(8): as described above, sshd(8) will now penalise client
addresses that, for various reasons, do not successfully
complete authentication. This feature is controlled by a new
sshd_config(5) PerSourcePenalties option and is on by default.
sshd(8) will now identify situations where the session did not
authenticate as expected. These conditions include when the
client repeatedly attempted authentication unsucessfully
(possibly indicating an attack against one or more accounts,
e.g. password guessing), or when client behaviour caused sshd
to crash (possibly indicating attempts to exploit bugs in
sshd).
When such a condition is observed, sshd will record a penalty
of some duration (e.g. 30 seconds) against the client's
address. If this time is above a minimum configurable
threshold, then all connections from the client address will be
refused (along with any others in the same
PerSourceNetBlockSize CIDR range) until the penalty expire.
Repeated offenses by the same client address will accrue
greater penalties, up to a configurable maximum. Address ranges
may be fully exempted from penalties, e.g. to guarantee access
from a set of trusted management addresses, using the new
sshd_config(5) PerSourcePenaltyExemptList option.
We hope these options will make it significantly more difficult
for attackers to find accounts with weak/guessable passwords or
exploit bugs in sshd(8) itself. This option is enabled by
default.
* ssh(8): allow the HostkeyAlgorithms directive to disable the
implicit fallback from certificate host key to plain host keys.
= Bugfixes
* misc: fix a number of inaccuracies in the PROTOCOL.*
documentation files. GHPR430 GHPR487
* all: switch to strtonum(3) for more robust integer parsing in
most places.
* ssh(1), sshd(8): correctly restore sigprocmask around ppoll()
* ssh-keysign(8): stricter validation of messaging socket fd
GHPR492
* sftp(1): flush stdout after writing "sftp>" prompt when not
using editline. GHPR480
* sftp-server(8): fix home-directory extension implementation,
it previously always returned the current user's home directory
contrary to the spec. GHPR477
* ssh-keyscan(1): do not close stdin to prevent error messages
when stdin is read multiple times. E.g.
echo localhost | ssh-keyscan -f - -f -
* regression tests: fix rekey test that was testing the same KEX
algorithm repeatedly instead of testing all of them. bz3692
* ssh_config(5), sshd_config(5): clarify the KEXAlgorithms
directive documentation, especially around what is supported
vs available. bz3701.
= Portability
* sshd(8): expose SSH_AUTH_INFO_0 always to PAM auth modules
unconditionally. The previous behaviour was to expose it only
when particular authentication methods were in use.
* build: fix OpenSSL ED25519 support detection. An incorrect
function signature in configure.ac previously prevented
enabling the recently added support for ED25519 private keys in
PEM PKCS8 format.
* ssh(1), ssh-agent(8): allow the presence of the WAYLAND_DISPLAY
environment variable to enable SSH_ASKPASS, similarly to the
X11 DISPLAY environment variable. GHPR479
* build: improve detection of the -fzero-call-used-regs compiler
flag. bz3673.
* build: relax OpenSSL version check to accept all OpenSSL 3.x
versions.
* sshd(8): add support for notifying systemd on server listen and
reload, using a standalone implementation that doesn't depend
on libsystemd. bz2641
- Update to openssh 9.7p1:
= New features
* ssh(1), sshd(8): add a "global" ChannelTimeout type that
watches all open channels and will close all open channels if
there is no traffic on any of them for the specified interval.
This is in addition to the existing per-channel timeouts added
recently.
This supports situations like having both session and x11
forwarding channels open where one may be idle for an extended
period but the other is actively used. The global timeout could
close both channels when both have been idle for too long.
* All: make DSA key support compile-time optional, defaulting to
on.
= Bugfixes
* sshd(8): don't append an unnecessary space to the end of
subsystem arguments (bz3667)
* ssh(1): fix the multiplexing "channel proxy" mode, broken when
keystroke timing obfuscation was added. (GHPR#463)
* ssh(1), sshd(8): fix spurious configuration parsing errors when
options that accept array arguments are overridden (bz3657).
* ssh-agent(1): fix potential spin in signal handler (bz3670)
* Many fixes to manual pages and other documentation, including
GHPR#462, GHPR#454, GHPR#442 and GHPR#441.
* Greatly improve interop testing against PuTTY.
= Portability
* Improve the error message when the autoconf OpenSSL header
check fails (bz#3668)
* Improve detection of broken toolchain -fzero-call-used-regs
support (bz3645).
* Fix regress/misc/fuzz-harness fuzzers and make them compile
without warnings when using clang16
- Use gcc-11 in SLE to avoid a "parameter name omitted" error
- Rebase patches:
* logind_set_tty.patch
* openssh-6.6.1p1-selinux-contexts.patch
* openssh-6.6p1-keycat.patch
* openssh-6.6p1-privsep-selinux.patch
* openssh-7.6p1-cleanup-selinux.patch
* openssh-7.7p1-cavstest-ctr.patch
* openssh-7.7p1-cavstest-kdf.patch
* openssh-7.7p1-fips.patch
* openssh-7.7p1-fips_checks.patch
* openssh-7.7p1-ldap.patch
* openssh-7.7p1-pam_check_locks.patch
* openssh-7.7p1-systemd-notify.patch
* openssh-7.8p1-role-mls.patch
* openssh-8.0p1-gssapi-keyex.patch
* openssh-8.1p1-audit.patch
* openssh-8.4p1-vendordir.patch
* openssh-9.6p1-crypto-policies-man.patch
* openssh-mitigate-lingering-secrets.patch
* openssh-reenable-dh-group14-sha1-default.patch
* wtmpdb.patch
- Thanks to Fedora developers for an initial version of the
rebase of the following patches:
* openssh-8.0p1-gssapi-keyex.patch
* openssh-7.8p1-role-mls.patch
* openssh-8.1p1-audit.patch
- Remove patches that are already included in 9.8p1:
* fix-CVE-2024-6387.patch
* 0001-upstream-fix-proxy-multiplexing-mode_-broken-when-keystroke.patch
* 0001-upstream-correctly-restore-sigprocmask-around-ppoll.patch
* 0001-upstream-when-sending-ObscureKeystrokeTiming-chaff-packets_.patch
- Remove patch that is now merged into
openssh-7.7p1-cavstest-ctr.patch and
openssh-7.7p1-cavstest-kdf.patch where it belongs:
* fix-missing-lz.patch
* Mon Jul 15 2024 Antonio Larrosa <alarrosa@suse.com>
- Add sshd.socket and sshd@.service units as alternative to the
sshd.service that makes systemd listen to the ssh port
and run sshd per incoming connection. To enable this,
disable sshd.service and enable sshd.socket . If you want to
use a non standard sshd port with sshd.socket you can do
"systemctl edit sshd.socket" and add something like:
[Socket]
ListenStream=8022
which listens on port 8022 as well as on port 22. If you want
to reset the list of listened ports and just use 8022, use:
[Socket]
ListenStream=
ListenStream=8022
- To enable a vsock listener in sshd (which allows to connect to
libvirt VMs), the systemd-experimental package needs to be
installed in the guest system, the libvirt-ssh-proxy package
needs to be installed in the host and the vm needs to have
vsock support (in virt-manager, click in "Add hardware" and
add "VSOCK VirtIO").
* Fri Jul 05 2024 Antonio Larrosa <alarrosa@suse.com>
- Add patch from upstream to fix proxy multiplexing mode:
* 0001-upstream-fix-proxy-multiplexing-mode_-broken-when-keystroke.patch
- Add patch from upstream to restore correctly sigprocmask
* 0001-upstream-correctly-restore-sigprocmask-around-ppoll.patch
- Add patch from upstream to fix a logic error in
ObscureKeystrokeTiming that rendered this feature ineffective,
allowing a passive observer to detect which network packets
contained real keystrokes (bsc#1227318, CVE-2024-39894):
* 0001-upstream-when-sending-ObscureKeystrokeTiming-chaff-packets_.patch
* Wed Jul 03 2024 Antonio Larrosa <alarrosa@suse.com>
- Add obsoletes for openssh-server-config-rootlogin since that
package existed for a brief period of time during SLE 15 SP6/
Leap 15.6 development but even if it was removed from the
repositories before GM, some users might have it in their
systems from having tried a beta/RC release (boo#1227350).
* Mon Jul 01 2024 Antonio Larrosa <alarrosa@suse.com>
- Add patch to fix a race condition in a signal handler by removing
the async-signal-unsafe code (CVE-2024-6387, bsc#1226642):
* fix-CVE-2024-6387.patch
* Mon Jun 10 2024 Antonio Larrosa <alarrosa@suse.com>
- Add #include <stdlib.h> in some files added by the ldap patch to
fix build with gcc14 (boo#1225904).
* openssh-7.7p1-ldap.patch
* Fri May 17 2024 Antonio Larrosa <alarrosa@suse.com>
- Remove the recommendation for openssh-server-config-rootlogin
from openssh-server. Since the default for that config option
was changed in SLE it's not needed anymore in SLE nor in TW
(boo#1224392).
* Tue May 14 2024 Antonio Larrosa <alarrosa@suse.com>
- Add a warning in %post of openssh-clients, openssh-server and
openssh-server-config-disallow-rootlogin to warn the user if
the /etc/ssh/(ssh_config.d|sshd_config.d) directories are not
being used (bsc#1223486).
* Mon May 13 2024 Antonio Larrosa <alarrosa@suse.com>
- Only for SLE15, restore the patch file removed in
Thu Feb 18 13:54:44 UTC 2021 to restore the previous behaviour
from SP5 of having root password login allowed by default
(fixes bsc#1223486, related to bsc#1173067):
* openssh-7.7p1-allow_root_password_login.patch
- Since the default value for this config option is now set to
permit root to use password logins in SLE15, the
openssh-server-config-rootlogin subpackage isn't useful there so
we now create an openssh-server-config-disallow-rootlogin
subpackage that sets the configuration the other way around
than openssh-server-config-rootlogin.
* Mon Apr 15 2024 Marcus Meissner <meissner@suse.com>
- openssh-8.0p1-gssapi-keyex.patch: Added missing struct initializer,
added missing parameter (bsc#1222840)
* Fri Apr 12 2024 Antonio Larrosa <alarrosa@suse.com>
- Make openssh-server recommend the openssh-server-config-rootlogin
package in SLE in order to keep the same behaviour of previous
SPs where the PermitRootLogin default was set to yes
(bsc#1221005).
- Fix crypto-policies requirement to be set by openssh-server, not
the config-rootlogin subpackage.
- Add back %config(noreplace) tag for more config files that were
already set like this in previous SPs.
* Thu Apr 11 2024 Arnav Singh <opensuse@arnavion.dev>
- Fix duplicate loading of dropins. (boo#1222467)
* Fri Apr 05 2024 Antonio Larrosa <alarrosa@suse.com>
- Add missing bugzilla/CVE references to the changelog
* Thu Apr 04 2024 Antonio Larrosa <alarrosa@suse.com>
- Add patch from SLE which was missing in Factory:
* Mon Jun 7 20:54:09 UTC 2021 - Hans Petter Jansson <hpj@suse.com>
- Add openssh-mitigate-lingering-secrets.patch (bsc#1186673), which
attempts to mitigate instances of secrets lingering in memory
after a session exits. (bsc#1213004 bsc#1213008)
- Rebase patch:
* openssh-6.6p1-privsep-selinux.patch
* Tue Apr 02 2024 Martin Sirringhaus <martin.sirringhaus@suse.com>
- Rebase openssh-7.7p1-fips.patch (bsc#1221928)
Remove OPENSSL_HAVE_EVPGCM-ifdef, which is no longer supported by
upstream
* Tue Apr 02 2024 Antonio Larrosa <alarrosa@suse.com>
- Use %config(noreplace) for sshd_config . In any case, it's
recommended to drop a file in sshd_config.d instead of editing
sshd_config (bsc#1221063)
- Use %{_libexecdir} when removing ssh-keycat instead of the
hardcoded path so it works in TW and SLE.
* Mon Mar 04 2024 Pedro Monreal <pmonreal@suse.com>
- Add crypto-policies support [bsc#1211301]
* Add patches:
- openssh-9.6p1-crypto-policies.patch
- openssh-9.6p1-crypto-policies-man.patch
* Sun Feb 25 2024 Hans Petter Jansson <hpj@suse.com>
- Update to openssh 9.6p1:
= Security
* ssh(1), sshd(8): implement protocol extensions to thwart the
so-called "Terrapin attack" discovered by Fabian Bäumer, Marcus
Brinkmann and Jörg Schwenk. This attack allows a MITM to effect a
limited break of the integrity of the early encrypted SSH transport
protocol by sending extra messages prior to the commencement of
encryption, and deleting an equal number of consecutive messages
immediately after encryption starts. A peer SSH client/server
would not be able to detect that messages were deleted
(bsc#1217950, CVE-2023-48795).
* ssh-agent(1): when adding PKCS#11-hosted private keys while
specifying destination constraints, if the PKCS#11 token returned
multiple keys then only the first key had the constraints applied.
Use of regular private keys, FIDO tokens and unconstrained keys
are unaffected.
* ssh(1): if an invalid user or hostname that contained shell
metacharacters was passed to ssh(1), and a ProxyCommand,
LocalCommand directive or "match exec" predicate referenced the
user or hostname via %u, %h or similar expansion token, then
an attacker who could supply arbitrary user/hostnames to ssh(1)
could potentially perform command injection depending on what
quoting was present in the user-supplied ssh_config(5) directive
(bsc#1218215, CVE-2023-51385).
= Potentially incompatible changes
* ssh(1), sshd(8): the RFC4254 connection/channels protocol provides
a TCP-like window mechanism that limits the amount of data that
can be sent without acceptance from the peer. In cases where this
limit was exceeded by a non-conforming peer SSH implementation,
ssh(1)/sshd(8) previously discarded the extra data. From OpenSSH
9.6, ssh(1)/sshd(8) will now terminate the connection if a peer
exceeds the window limit by more than a small grace factor. This
change should have no effect of SSH implementations that follow
the specification.
= New features
* ssh(1): add a %j token that expands to the configured ProxyJump
hostname (or the empty string if this option is not being used)
that can be used in a number of ssh_config(5) keywords. bz3610
* ssh(1): add ChannelTimeout support to the client, mirroring the
same option in the server and allowing ssh(1) to terminate
quiescent channels.
* ssh(1), sshd(8), ssh-add(1), ssh-keygen(1): add support for
reading ED25519 private keys in PEM PKCS8 format. Previously
only the OpenSSH private key format was supported.
* ssh(1), sshd(8): introduce a protocol extension to allow
renegotiation of acceptable signature algorithms for public key
authentication after the server has learned the username being
used for authentication. This allows varying sshd_config(5)
PubkeyAcceptedAlgorithms in a "Match user" block.
* ssh-add(1), ssh-agent(1): add an agent protocol extension to allow
specifying certificates when loading PKCS#11 keys. This allows the
use of certificates backed by PKCS#11 private keys in all OpenSSH
tools that support ssh-agent(1). Previously only ssh(1) supported
this use-case.
= Bugfixes
* ssh(1): when deciding whether to enable the keystroke timing
obfuscation, enable it only if a channel with a TTY is active.
* ssh(1): switch mainloop from poll(3) to ppoll(3) and mask signals
before checking flags set in signal handler. Avoids potential
race condition between signaling ssh to exit and polling. bz3531
* ssh(1): when connecting to a destination with both the
AddressFamily and CanonicalizeHostname directives in use,
the AddressFamily directive could be ignored. bz5326
* sftp(1): correct handling of the limits@openssh.com option when
the server returned an unexpected message.
* A number of fixes to the PuTTY and Dropbear regress/integration
tests.
* ssh(1): release GSS OIDs only at end of authentication, avoiding
unnecessary init/cleanup cycles. bz2982
* ssh_config(5): mention "none" is a valid argument to IdentityFile
in the manual. bz3080
* scp(1): improved debugging for paths from the server rejected for
not matching the client's glob(3) pattern in old SCP/RCP protocol
mode.
* ssh-agent(1): refuse signing operations on destination-constrained
keys if a previous session-bind operation has failed. This may
prevent a fail-open situation in future if a user uses a mismatched
ssh(1) client and ssh-agent(1) where the client supports a key type
that the agent does not support.
- Update to openssh 9.5p1:
= Potentially incompatible changes
* ssh-keygen(1): generate Ed25519 keys by default. Ed25519 public keys
are very convenient due to their small size. Ed25519 keys are
specified in RFC 8709 and OpenSSH has supported them since version 6.5
(January 2014).
* sshd(8): the Subsystem directive now accurately preserves quoting of
subsystem commands and arguments. This may change behaviour for exotic
configurations, but the most common subsystem configuration
(sftp-server) is unlikely to be affected.
= New features
* ssh(1): add keystroke timing obfuscation to the client. This attempts
to hide inter-keystroke timings by sending interactive traffic at
fixed intervals (default: every 20ms) when there is only a small
amount of data being sent. It also sends fake "chaff" keystrokes for
a random interval after the last real keystroke. These are
controlled by a new ssh_config ObscureKeystrokeTiming keyword.
* ssh(1), sshd(8): Introduce a transport-level ping facility. This adds
a pair of SSH transport protocol messages SSH2_MSG_PING/PONG to
implement a ping capability. These messages use numbers in the "local
extensions" number space and are advertised using a "ping@openssh.com"
ext-info message with a string version number of "0".
* sshd(8): allow override of Subsystem directives in sshd Match blocks.
= Bugfixes
* scp(1): fix scp in SFTP mode recursive upload and download of
directories that contain symlinks to other directories. In scp mode,
the links would be followed, but in SFTP mode they were not. bz3611
* ssh-keygen(1): handle cr+lf (instead of just cr) line endings in
sshsig signature files.
* ssh(1): interactive mode for ControlPersist sessions if they
originally requested a tty.
* sshd(8): make PerSourceMaxStartups first-match-wins
* sshd(8): limit artificial login delay to a reasonable maximum (5s)
and don't delay at all for the "none" authentication mechanism.
bz3602
* sshd(8): Log errors in kex_exchange_identification() with level
verbose instead of error to reduce preauth log spam. All of those
get logged with a more generic error message by sshpkt_fatal().
* sshd(8): correct math for ClientAliveInterval that caused the probes
to be sent less frequently than configured.
* ssh(1): fix regression in OpenSSH 9.4 (mux.c r1.99) that caused
multiplexed sessions to ignore SIGINT under some circumstances.
- Update to openssh 9.4p1:
= Potentially incompatible changes
* This release removes support for older versions of libcrypto.
OpenSSH now requires LibreSSL >= 3.1.0 or OpenSSL >= 1.1.1.
Note that these versions are already deprecated by their upstream
vendors.
* ssh-agent(1): PKCS#11 modules must now be specified by their full
paths. Previously dlopen(3) could search for them in system
library directories.
= New features
* ssh(1): allow forwarding Unix Domain sockets via ssh -W.
* ssh(1): add support for configuration tags to ssh(1).
This adds a ssh_config(5) "Tag" directive and corresponding
"Match tag" predicate that may be used to select blocks of
configuration similar to the pf.conf(5) keywords of the same
name.
* ssh(1): add a "match localnetwork" predicate. This allows matching
on the addresses of available network interfaces and may be used to
vary the effective client configuration based on network location.
* ssh(1), sshd(8), ssh-keygen(1): infrastructure support for KRL
extensions. This defines wire formats for optional KRL extensions
and implements parsing of the new submessages. No actual extensions
are supported at this point.
* sshd(8): AuthorizedPrincipalsCommand and AuthorizedKeysCommand now
accept two additional %-expansion sequences: %D which expands to
the routing domain of the connected session and %C which expands
to the addresses and port numbers for the source and destination
of the connection.
* ssh-keygen(1): increase the default work factor (rounds) for the
bcrypt KDF used to derive symmetric encryption keys for passphrase
protected key files by 50%.
= Bugfixes
* ssh-agent(1): improve isolation between loaded PKCS#11 modules
by running separate ssh-pkcs11-helpers for each loaded provider.
* ssh(1): make -f (fork after authentication) work correctly with
multiplexed connections, including ControlPersist. bz3589 bz3589
* ssh(1): make ConnectTimeout apply to multiplexing sockets and not
just to network connections.
* ssh-agent(1), ssh(1): improve defences against invalid PKCS#11
modules being loaded by checking that the requested module
contains the required symbol before loading it.
* sshd(8): fix AuthorizedPrincipalsCommand when AuthorizedKeysCommand
appears before it in sshd_config. Since OpenSSH 8.7 the
AuthorizedPrincipalsCommand directive was incorrectly ignored in
this situation. bz3574
* sshd(8), ssh(1), ssh-keygen(1): remove vestigal support for KRL
signatures When the KRL format was originally defined, it included
support for signing of KRL objects. However, the code to sign KRLs
and verify KRL signatues was never completed in OpenSSH. This
release removes the partially-implemented code to verify KRLs.
All OpenSSH tools now ignore KRL_SECTION_SIGNATURE sections in
KRL files.
* All: fix a number of memory leaks and unreachable/harmless integer
overflows.
* ssh-agent(1), ssh(1): don't truncate strings logged from PKCS#11
modules; GHPR406
* sshd(8), ssh(1): better validate CASignatureAlgorithms in
ssh_config and sshd_config. Previously this directive would accept
certificate algorithm names, but these were unusable in practice as
OpenSSH does not support CA chains. bz3577
* ssh(1): make `ssh -Q CASignatureAlgorithms` only list signature
algorithms that are valid for CA signing. Previous behaviour was
to list all signing algorithms, including certificate algorithms.
* ssh-keyscan(1): gracefully handle systems where rlimits or the
maximum number of open files is larger than INT_MAX; bz3581
* ssh-keygen(1): fix "no comment" not showing on when running
`ssh-keygen -l` on multiple keys where one has a comment and other
following keys do not. bz3580
* scp(1), sftp(1): adjust ftruncate() logic to handle servers that
reorder requests. Previously, if the server reordered requests then
the resultant file would be erroneously truncated.
* ssh(1): don't incorrectly disable hostname canonicalization when
CanonicalizeHostname=yes and ProxyJump was expicitly set to
"none". bz3567
* scp(1): when copying local->remote, check that the source file
exists before opening an SFTP connection to the server. Based on
GHPR#370
- Dropped patches:
* cb4ed12f.patch - implemented upstream.
* openssh-cve-2023-48795.patch - implemented upstream.
- Rebased patches:
* openssh-6.6p1-selinux-contexts.patch
* openssh-7.7p1-fips.patch
* openssh-7.8p1-role-mls.patch
* openssh-8.0p1-gssapi-keyex.patch
* Tue Dec 19 2023 Hans Petter Jansson <hpj@suse.com>
- Added openssh-cve-2023-48795.patch (bsc#1217950, CVE-2023-48795).
This mitigates a prefix truncation attack that could be used to
undermine channel security.
* Fri Nov 03 2023 Johannes Segitz <jsegitz@suse.com>
- Enhanced SELinux functionality. Added
* openssh-7.8p1-role-mls.patch
Proper handling of MLS systems and basis for other SELinux
improvements
* openssh-6.6p1-privsep-selinux.patch
Properly set contexts during privilege separation
* openssh-6.6p1-keycat.patch
Add ssh-keycat command to allow retrival of authorized_keys
on MLS setups with polyinstantiation
* openssh-6.6.1p1-selinux-contexts.patch
Additional changes to set the proper context during privilege
separation
* openssh-7.6p1-cleanup-selinux.patch
Various changes and putting the pieces together
For now we don't ship the ssh-keycat command, but we need the patch
for the other SELinux infrastructure
This change fixes issues like bsc#1214788, where the ssh daemon
needs to act on behalf of a user and needs a proper context for this
* Tue Oct 24 2023 Dominique Leuenberger <dimstar@opensuse.org>
- Add cb4ed12f.patch: Fix build using zlib 1.3. The check expected
a version in the form a.b.c[.d], which no longer matches 1.3.
* Wed Sep 27 2023 Thorsten Kukuk <kukuk@suse.com>
- Disable SLP by default for Factory and ALP (bsc#1214884)
* Fri Jul 21 2023 Simon Lees <sflees@suse.de>
- Update to openssh 9.3p2:
Security
========
Fix a condition where specific libaries loaded via
ssh-agent(1)'s PKCS#11 support could be abused to achieve remote
code execution via a forwarded agent socket if the following
conditions are met (bsc#1213504, CVE-2023-38408):
* Exploitation requires the presence of specific libraries on
the victim system.
* Remote exploitation requires that the agent was forwarded
to an attacker-controlled system.
Exploitation can also be prevented by starting ssh-agent(1) with an
empty PKCS#11/FIDO allowlist (ssh-agent -P '') or by configuring
an allowlist that contains only specific provider libraries.
This vulnerability was discovered and demonstrated to be exploitable
by the Qualys Security Advisory team.
In addition to removing the main precondition for exploitation,
this release removes the ability for remote ssh-agent(1) clients
to load PKCS#11 modules by default (see below).
Potentially-incompatible changes
- -------------------------------
* ssh-agent(8): the agent will now refuse requests to load PKCS#11
modules issued by remote clients by default. A flag has been added
to restore the previous behaviour "-Oallow-remote-pkcs11".
Note that ssh-agent(8) depends on the SSH client to identify
requests that are remote. The OpenSSH >=8.9 ssh(1) client does
this, but forwarding access to an agent socket using other tools
may circumvent this restriction.
* Wed Jun 21 2023 Thorsten Kukuk <kukuk@suse.com>
- Disable old lastlog, we use pam_lastlog2
- openssh-8.4p1-pam_motd.patch: adjust to remove PrintLastLog
* Thu Jun 15 2023 Thorsten Kukuk <kukuk@suse.com>
- logind_set_tty.patch: tell systemd-logind our current TTY
* Thu May 11 2023 Antonio Larrosa <alarrosa@suse.com>
- Update to openssh 9.3p1:
= Security
* ssh-add(1): when adding smartcard keys to ssh-agent(1) with the
per-hop destination constraints (ssh-add -h ...) added in
OpenSSH 8.9, a logic error prevented the constraints from being
communicated to the agent. This resulted in the keys being added
without constraints. The common cases of non-smartcard keys and
keys without destination constraints are unaffected. This
problem was reported by Luci Stanescu.
* ssh(1): Portable OpenSSH provides an implementation of the
getrrsetbyname(3) function if the standard library does not
provide it, for use by the VerifyHostKeyDNS feature. A
specifically crafted DNS response could cause this function to
perform an out-of-bounds read of adjacent stack data, but this
condition does not appear to be exploitable beyond denial-of-
service to the ssh(1) client.
The getrrsetbyname(3) replacement is only included if the
system's standard library lacks this function and portable
OpenSSH was not compiled with the ldns library (--with-ldns).
getrrsetbyname(3) is only invoked if using VerifyHostKeyDNS to
fetch SSHFP records. This problem was found by the Coverity
static analyzer.
= New features
* ssh-keygen(1), ssh-keyscan(1): accept -Ohashalg=sha1|sha256
when outputting SSHFP fingerprints to allow algorithm
selection. bz3493
* sshd(8): add a `sshd -G` option that parses and prints the
effective configuration without attempting to load private keys
and perform other checks. This allows usage of the option
before keys have been generated and for configuration
evaluation and verification by unprivileged users.
= Bugfixes
* scp(1), sftp(1): fix progressmeter corruption on wide displays;
bz3534
* ssh-add(1), ssh-keygen(1): use RSA/SHA256 when testing
usability of private keys as some systems are starting to
disable RSA/SHA1 in libcrypto.
* sftp-server(8): fix a memory leak. GHPR363
* ssh(1), sshd(8), ssh-keyscan(1): remove vestigal protocol
compatibility code and simplify what's left.
* Fix a number of low-impact Coverity static analysis findings.
These include several reported via bz2687
* ssh_config(5), sshd_config(5): mention that some options are
not first-match-wins.
* Rework logging for the regression tests. Regression tests will
now capture separate logs for each ssh and sshd invocation in
a test.
* ssh(1): make `ssh -Q CASignatureAlgorithms` work as the manpage
says it should; bz3532.
* ssh(1): ensure that there is a terminating newline when adding
a new entry to known_hosts; bz3529
= Portability
* sshd(8): harden Linux seccomp sandbox. Move to an allowlist of
mmap(2), madvise(2) and futex(2) flags, removing some
concerning kernel attack surface.
* sshd(8): improve Linux seccomp-bpf sandbox for older systems;
bz3537
- Update to openssh 9.2p1:
= Security
* sshd(8): fix a pre-authentication double-free memory fault
introduced in OpenSSH 9.1. This is not believed to be
exploitable, and it occurs in the unprivileged pre-auth process
that is subject to chroot(2) and is further sandboxed on most
major platforms.
* ssh(8): in OpenSSH releases after 8.7, the PermitRemoteOpen
option would ignore its first argument unless it was one of the
special keywords "any" or "none", causing the permission list
to fail open if only one permission was specified. bz3515
* ssh(1): if the CanonicalizeHostname and
CanonicalizePermittedCNAMEs options were enabled, and the
system/libc resolver did not check that names in DNS responses
were valid, then use of these options could allow an attacker
with control of DNS to include invalid characters (possibly
including wildcards) in names added to known_hosts files when
they were updated. These names would still have to match the
CanonicalizePermittedCNAMEs allow-list, so practical
exploitation appears unlikely.
= Potentially-incompatible changes
* ssh(1): add a new EnableEscapeCommandline ssh_config(5) option
that controls whether the client-side ~C escape sequence that
provides a command-line is available. Among other things, the
~C command-line could be used to add additional port-forwards
at runtime.
This option defaults to "no", disabling the ~C command-line
that was previously enabled by default. Turning off the
command-line allows platforms that support sandboxing of the
ssh(1) client (currently only OpenBSD) to use a stricter
default sandbox policy.
= New features
* sshd(8): add support for channel inactivity timeouts via a new
sshd_config(5) ChannelTimeout directive. This allows channels
that have not seen traffic in a configurable interval to be
automatically closed. Different timeouts may be applied to
session, X11, agent and TCP forwarding channels.
* sshd(8): add a sshd_config UnusedConnectionTimeout option to
terminate client connections that have no open channels for a
length of time. This complements the ChannelTimeout option
above.
* sshd(8): add a -V (version) option to sshd like the ssh client
has.
* ssh(1): add a "Host" line to the output of ssh -G showing the
original hostname argument. bz3343
* scp(1), sftp(1): add a -X option to both scp(1) and sftp(1) to
allow control over some SFTP protocol parameters: the copy
buffer length and the number of in-flight requests, both of
which are used during upload/download. Previously these could
be controlled in sftp(1) only. This makes them available in
both SFTP protocol clients using the same option character
sequence.
* ssh-keyscan(1): allow scanning of complete CIDR address ranges,
e.g. "ssh-keyscan 192.168.0.0/24". If a CIDR range is passed,
then it will be expanded to all possible addresses in the range
including the all-0s and all-1s addresses. bz#976
* ssh(1): support dynamic remote port forwarding in escape
command-line's -R processing. bz#3499
= Bugfixes
* ssh(1): when restoring non-blocking mode to stdio fds, restore
exactly the flags that ssh started with and don't just clobber
them with zero, as this could also remove the append flag from
the set. bz3523
* ssh(1): avoid printf("%s", NULL) if using
UserKnownHostsFile=none and a hostkey in one of the system
known hosts file changes.
* scp(1): switch scp from using pipes to a socket-pair for
communication with its ssh sub-processes, matching how sftp(1)
operates.
* sshd(8): clear signal mask early in main(); sshd may have been
started with one or more signals masked (sigprocmask(2) is not
cleared on fork/exec) and this could interfere with various
things, e.g. the login grace timer. Execution environments that
fail to clear the signal mask before running sshd are clearly
broken, but apparently they do exist.
* ssh(1): warn if no host keys for hostbased auth can be loaded.
* sshd(8): Add server debugging for hostbased auth that is queued
and sent to the client after successful authentication, but
also logged to assist in diagnosis of HostbasedAuthentication
problems. bz3507
* ssh(1): document use of the IdentityFile option as being usable
to list public keys as well as private keys. GHPR352
* sshd(8): check for and disallow MaxStartups values less than or
equal to zero during config parsing, rather than failing later
at runtime. bz3489
* ssh-keygen(1): fix parsing of hex cert expiry times specified
on the command-line when acting as a CA.
* scp(1): when scp(1) is using the SFTP protocol for transport
(the default), better match scp/rcp's handling of globs that
don't match the globbed characters but do match literally (e.g.
trying to transfer a file named "foo.[1]"). Previously scp(1)
in SFTP mode would not match these pathnames but legacy scp/rcp
mode would. bz3488
* ssh-agent(1): document the "-O no-restrict-websafe"
command-line option.
* ssh(1): honour user's umask(2) if it is more restrictive then
the ssh default (022).
= Portability
* sshd(8): allow writev(2) in the Linux seccomp sandbox. This
seems to be used by recent glibcs at least in some
configurations during error conditions. bz3512.
* sshd(8): simply handling of SSH_CONNECTION PAM env var,
removing global variable and checking the return value from
pam_putenv. bz3508
* sshd(8): disable SANDBOX_SECCOMP_FILTER_DEBUG that was
mistakenly enabled during the OpenSSH 9.1 release cycle.
* misc: update autotools and regenerate the config files using
the latest autotools
* all: use -fzero-call-used-regs=used on clang 15 instead of
- fzero-call-used-reg=all, as some versions of clang 15 have
miscompile code when it was enabled. bz3475
* sshd(8): defer PRNG seeding until after the initial
closefrom(2) call. PRNG seeding will initialize OpenSSL, and
some engine providers (e.g. Intel's QAT) will open descriptors
for their own use that closefrom(2) could clobber. bz3483
* misc: in the poll(2)/ppoll(2) compatibility code, avoid
assuming the layout of fd_set.
* sftp-server(8), ssh-agent(1): fix ptrace(2) disabling on older
FreeBSD kernels. Some versions do not support using id 0 to
refer to the current PID for procctl, so try again with
getpid() explicitly before failing.
* configure.ac: fix -Wstrict-prototypes in configure test code.
Clang 16 now warns on this and legacy prototypes will be
removed in C23. GHPR355
* configure.ac: fix setres*id checks to work with clang-16. glibc
has the prototypes for setresuid behind _GNU_SOURCE, and
clang 16 will error out on implicit function definitions.
bz3497
- Update to openssh 9.1p1:
= Security
* ssh-keyscan(1): fix a one-byte overflow in SSH- banner
processing.
Reported by Qualys
* ssh-keygen(1): double free() in error path of file hashing step
in signing/verify code; GHPR333
* ssh-keysign(8): double-free in error path introduced in
openssh-8.9
= Potentially-incompatible changes
* The portable OpenSSH project now signs commits and release tags
using git's recent SSH signature support. The list of developer
signing keys is included in the repository as
.git_allowed_signers and is cross-signed using the PGP key that
is still used to sign release artifacts:
https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/RELEASE_KEY.asc
* ssh(1), sshd(8): SetEnv directives in ssh_config and
sshd_config are now first-match-wins to match other directives.
Previously if an environment variable was multiply specified
the last set value would have been used. bz3438
* ssh-keygen(8): ssh-keygen -A (generate all default host key
types) will no longer generate DSA keys, as these are insecure
and have not been used by default for some years.
= New features
* ssh(1), sshd(8): add a RequiredRSASize directive to set a
minimum RSA key length. Keys below this length will be ignored
for user authentication and for host authentication in sshd(8).
ssh(1) will terminate a connection if the server offers an RSA
key that falls below this limit, as the SSH protocol does not
include the ability to retry a failed key exchange.
* sftp-server(8): add a "users-groups-by-id@openssh.com"
extension request that allows the client to obtain user/group
names that correspond to a set of uids/gids.
* sftp(1): use "users-groups-by-id@openssh.com" sftp-server
extension (when available) to fill in user/group names for
directory listings.
* sftp-server(8): support the "home-directory" extension request
defined in draft-ietf-secsh-filexfer-extensions-00. This
overlaps a bit with the existing "expand-path@openssh.com", but
some other clients support it.
* ssh-keygen(1), sshd(8): allow certificate validity intervals,
sshsig verification times and authorized_keys expiry-time
options to accept dates in the UTC time zone in addition to the
default of interpreting them in the system time zone. YYYYMMDD
and YYMMDDHHMM[SS] dates/times will be interpreted as UTC if
suffixed with a 'Z' character.
Also allow certificate validity intervals to be specified in
raw seconds-since-epoch as hex value, e.g. -V 0x1234:0x4567890.
This is intended for use by regress tests and other tools that
call ssh-keygen as part of a CA workflow. bz3468
* sftp(1): allow arguments to the sftp -D option, e.g. sftp -D
"/usr/libexec/sftp-server -el debug3"
* ssh-keygen(1): allow the existing -U (use agent) flag to work
with "-Y sign" operations, where it will be interpreted to
require that the private keys is hosted in an agent; bz3429
= Bugfixes
* ssh-keygen(1): implement the "verify-required" certificate
option.
This was already documented when support for user-verified FIDO
keys was added, but the ssh-keygen(1) code was missing.
* ssh-agent(1): hook up the restrict_websafe command-line flag;
previously the flag was accepted but never actually used.
* sftp(1): improve filename tab completions: never try to
complete names to non-existent commands, and better match the
completion type (local or remote filename) against the argument
position being completed.
* ssh-keygen(1), ssh(1), ssh-agent(1): several fixes to FIDO key
handling, especially relating to keys that request
user-verification. These should reduce the number of
unnecessary PIN prompts for keys that support intrinsic user
verification. GHPR302, GHPR329
* ssh-keygen(1): when enrolling a FIDO resident key, check if a
credential with matching application and user ID strings
already exists and, if so, prompt the user for confirmation
before overwriting the credential. GHPR329
* sshd(8): improve logging of errors when opening authorized_keys
files. bz2042
* ssh(1): avoid multiplexing operations that could cause SIGPIPE
from causing the client to exit early. bz3454
* ssh_config(5), sshd_config(5): clarify that the RekeyLimit
directive applies to both transmitted and received data.
GHPR328
* ssh-keygen(1): avoid double fclose() in error path.
* sshd(8): log an error if pipe() fails while accepting a
connection. bz3447
* ssh(1), ssh-keygen(1): fix possible NULL deref when built
without FIDO support. bz3443
* ssh-keyscan(1): add missing *-sk types to ssh-keyscan manpage.
GHPR294.
* sshd(8): ensure that authentication passwords are cleared from
memory in error paths. GHPR286
* ssh(1), ssh-agent(1): avoid possibility of notifier code
executing kill(-1). GHPR286
* ssh_config(5): note that the ProxyJump directive also accepts
the same tokens as ProxyCommand. GHPR305.
* scp(1): do not not ftruncate(3) files early when in sftp mode.
The previous behaviour of unconditionally truncating the
destination file would cause "scp ~/foo localhost:foo" and the
reverse "scp localhost:foo ~/foo" to delete all the contents of
their destination. bz3431
* ssh-keygen(1): improve error message when 'ssh-keygen -Y sign'
is unable to load a private key; bz3429
* sftp(1), scp(1): when performing operations that glob(3) a
remote path, ensure that the implicit working directory used to
construct that path escapes glob(3) characters. This prevents
glob characters from being processed in places they shouldn't,
e.g. "cd /tmp/a*/", "get *.txt" should have the get operation
treat the path "/tmp/a*" literally and not attempt to expand
it.
* ssh(1), sshd(8): be stricter in which characters will be
accepted in specifying a mask length; allow only 0-9. GHPR278
* ssh-keygen(1): avoid printing hash algorithm twice when dumping
a KRL
* ssh(1), sshd(8): continue running local I/O for open channels
during SSH transport rekeying. This should make ~-escapes work
in the client (e.g. to exit) if the connection happened to have
stalled during a rekey event.
* ssh(1), sshd(8): avoid potential poll() spin during rekeying
* Further hardening for sshbuf internals: disallow "reparenting"
a hierarchical sshbuf and zero the entire buffer if
reallocation fails. GHPR287
= Portability
* ssh(1), ssh-keygen(1), sshd(8): automatically enable the
built-in FIDO security key support if libfido2 is found and
usable, unless --without-security-key-builtin was requested.
* ssh(1), ssh-keygen(1), sshd(8): many fixes to make the WinHello
FIDO device usable on Cygwin. The windows://hello FIDO device
will be automatically used by default on this platform unless
requested otherwise, or when probing resident FIDO credentials
(an operation not currently supported by WinHello).
* Portable OpenSSH: remove workarounds for obsolete and
unsupported versions of OpenSSL libcrypto. In particular, this
release removes fallback support for OpenSSL that lacks AES-CTR
or AES-GCM. Those AES cipher modes were added to OpenSSL prior
to the minimum version currently supported by OpenSSH, so this
is not expected to impact any currently supported
configurations.
* sshd(8): fix SANDBOX_SECCOMP_FILTER_DEBUG on current
Linux/glibc
* All: resync and clean up internal CSPRNG code.
* scp(1), sftp(1), sftp-server(8): avoid linking these programs
with unnecessary libraries. They are no longer linked against
libz and libcrypto. This may be of benefit to space constrained
systems using any of those components in isolation.
* sshd(8): add AUDIT_ARCH_PPC to supported seccomp sandbox
architectures.
* configure: remove special casing of crypt(). configure will no
longer search for crypt() in libcrypto, as it was removed from
there years ago. configure will now only search libc and
libcrypt.
* configure: refuse to use OpenSSL 3.0.4 due to potential RCE in
its RSA implementation (CVE-2022-2274) on x86_64.
* All: request 1.1x API compatibility for OpenSSL >=3.x; GHPR322
* ssh(1), ssh-keygen(1), sshd(8): fix a number of missing
includes required by the XMSS code on some platforms.
* sshd(8): cache timezone data in capsicum sandbox.
- Update to openssh 9.0p1:
= Potentially-incompatible changes
* This release switches scp(1) from using the legacy scp/rcp
protocol to using the SFTP protocol by default.
Legacy scp/rcp performs wildcard expansion of remote filenames
(e.g. "scp host:* .") through the remote shell. This has the
side effect of requiring double quoting of shell
meta-characters in file names included on scp(1) command-lines,
otherwise they could be interpreted as shell commands on the
remote side.
This creates one area of potential incompatibility: scp(1) when
using the SFTP protocol no longer requires this finicky and
brittle quoting, and attempts to use it may cause transfers to
fail. We consider the removal of the need for double-quoting
shell characters in file names to be a benefit and do not
intend to introduce bug-compatibility for legacy scp/rcp in
scp(1) when using the SFTP protocol.
Another area of potential incompatibility relates to the use of
remote paths relative to other user's home directories, for
example - "scp host:~user/file /tmp". The SFTP protocol has no
native way to expand a ~user path. However, sftp-server(8) in
OpenSSH 8.7 and later support a protocol extension
"expand-path@openssh.com" to support this.
In case of incompatibility, the scp(1) client may be instructed
to use the legacy scp/rcp using the -O flag.
= New features
* ssh(1), sshd(8): use the hybrid Streamlined NTRU Prime + x25519
key exchange method by default
("sntrup761x25519-sha512@openssh.com"). The NTRU algorithm is
believed to resist attacks enabled by future quantum computers
and is paired with the X25519 ECDH key exchange (the previous
default) as a backstop against any weaknesses in NTRU Prime
that may be discovered in the future. The combination ensures
that the hybrid exchange offers at least as good security as
the status quo.
We are making this change now (i.e. ahead of cryptographically-
relevant quantum computers) to prevent "capture now, decrypt
later" attacks where an adversary who can record and store SSH
session ciphertext would be able to decrypt it once a
sufficiently advanced quantum computer is available.
* sftp-server(8): support the "copy-data" extension to allow
server-side copying of files/data, following the design in
draft-ietf-secsh-filexfer-extensions-00. bz2948
* sftp(1): add a "cp" command to allow the sftp client to perform
server-side file copies.
= Bugfixes
* ssh(1), sshd(8): upstream: fix poll(2) spin when a channel's
output fd closes without data in the channel buffer. bz3405 and
bz3411
* sshd(8): pack pollfd array in server listen/accept loop. Could
cause the server to hang/spin when MaxStartups > RLIMIT_NOFILE
* ssh-keygen(1): avoid NULL deref via the find-principals and
check-novalidate operations. bz3409 and GHPR307 respectively.
* scp(1): fix a memory leak in argument processing. bz3404
* sshd(8): don't try to resolve ListenAddress directives in the
sshd re-exec path. They are unused after re-exec and parsing
errors (possible for example if the host's network
configuration changed) could prevent connections from being
accepted.
* sshd(8): when refusing a public key authentication request from
a client for using an unapproved or unsupported signature
algorithm include the algorithm name in the log message to make
debugging easier.
= Portability
* sshd(8): refactor platform-specific locked account check,
fixing an incorrect free() on platforms with both libiaf and
shadow passwords (probably only Unixware) GHPR284,
* ssh(1), sshd(8): Fix possible integer underflow in
scan_scaled(3) parsing of K/M/G/etc quantities. bz#3401.
* sshd(8): provide killpg implementation (mostly for Tandem
NonStop) GHPR301.
* Check for missing ftruncate prototype. GHPR301
* sshd(8): default to not using sandbox when cross compiling. On
most systems poll(2) does not work when the number of FDs is
reduced with setrlimit, so assume it doesn't when cross
compiling and we can't run the test. bz#3398.
* sshd(8): allow ppoll_time64 in seccomp sandbox. Should fix
sandbox violations on some (at least i386 and armhf) 32bit
Linux platforms. bz#3396.
* Improve detection of -fzero-call-used-regs=all support in
configure script.
- Add patch that explicitly adds -lz in Makefile.in to some
binaries which need it:
* fix-missing-lz.patch
- Rebase patches:
* openssh-7.7p1-fips.patch
* openssh-7.7p1-fips_checks.patch
* openssh-7.7p1-ldap.patch
* openssh-7.7p1-pam_check_locks.patch
* openssh-7.7p1-seccomp_ipc_flock.patch
* openssh-7.7p1-sftp_print_diagnostic_messages.patch
* openssh-7.7p1-systemd-notify.patch
* openssh-8.0p1-gssapi-keyex.patch
* openssh-8.1p1-audit.patch
* openssh-8.1p1-ed25519-use-openssl-rng.patch
* openssh-8.4p1-vendordir.patch
* openssh-reenable-dh-group14-sha1-default.patch
* openssh-whitelist-syscalls.patch
* wtmpdb.patch
- Fix setting libexec dir in the LDAP patch.
- Fix build in Leap 15.x which doesn't use %{_distconfdir}
* Fri May 05 2023 Dominique Leuenberger <dimstar@opensuse.org>
- Add _multibuild to define 2nd spec file as additional flavor.
Eliminates the need for source package links in OBS.
* Mon Apr 17 2023 Thorsten Kukuk <kukuk@suse.com>
- wtmpdb.patch: add support for wtmpdb to sshd [jsc#PED-3144]
* Mon Mar 27 2023 Thorsten Kukuk <kukuk@suse.com>
- Rename sshd.pamd to sshd-sle.pamd and fix order of pam_keyinit
- Add new sshd.pamd including postlogin-* config files
* Wed Feb 15 2023 Thorsten Kukuk <kukuk@suse.com>
- Remove BuildRequires for libtirpc, we don't use it
* Tue Feb 14 2023 Thorsten Kukuk <kukuk@suse.com>
- Remove pam_lastlog from sshd PAM config. sshd is doing the same,
too, which leads to e.g. duplicate entries in wtmp [bsc#1208243]
* Mon Dec 19 2022 Otto Hollmann <otto.hollmann@suse.com>
- Adapt OpenSSH to build with OpenSSL 3, use new KDF API (bsc#1205042)
Add openssh-openssl-3.patch
* Thu Dec 15 2022 Dirk Müller <dmueller@suse.com>
- limit to openssl < 3.0 as this version is not compatible (bsc#1205042)
next version update will fix it
* Thu Nov 10 2022 Hans Petter Jansson <hpj@suse.com>
- Update openssh-8.1p1-audit.patch: Merge fix for race condition
(bsc#1115550, bsc#1174162).
- Add openssh-do-not-send-empty-message.patch, which prevents
superfluous newlines with empty MOTD files (bsc#1192439).
* Mon Aug 08 2022 Thorsten Kukuk <kukuk@suse.com>
- Use %_pam_vendordir
* Wed Jul 06 2022 Adam Majer <adam.majer@suse.de>
- openssh-8.4p1-ssh_config_d.patch: admin overrides should take
priority (listed first) over package defaults
* Mon Mar 28 2022 Ludwig Nussel <lnussel@suse.de>
- read ssh and sshd config file also from /usr/etc
- add openssh-server-config-rootlogin subpackage that enabled PermitRootLogin
* Mon Mar 07 2022 Hans Petter Jansson <hpj@suse.com>
- Version update to 8.9p1:
= Security
* sshd(8): fix an integer overflow in the user authentication path
that, in conjunction with other logic errors, could have yielded
unauthenticated access under difficult to exploit conditions.
This situation is not exploitable because of independent checks in
the privilege separation monitor. Privilege separation has been
enabled by default in since openssh-3.2.2 (released in 2002) and
has been mandatory since openssh-7.5 (released in 2017). Moreover,
portable OpenSSH has used toolchain features available in most
modern compilers to abort on signed integer overflow since
openssh-6.5 (released in 2014).
Thanks to Malcolm Stagg for finding and reporting this bug.
= Potentially-incompatible changes
* sshd(8), portable OpenSSH only: this release removes in-built
support for MD5-hashed passwords. If you require these on your
system then we recommend linking against libxcrypt or similar.
* This release modifies the FIDO security key middleware interface
and increments SSH_SK_VERSION_MAJOR.
= New features
* ssh(1), sshd(8), ssh-add(1), ssh-agent(1): add a system for
restricting forwarding and use of keys added to ssh-agent(1)
A detailed description of the feature is available at
https://www.openssh.com/agent-restrict.html and the protocol
extensions are documented in the PROTOCOL and PROTOCOL.agent
files in the source release.
* ssh(1), sshd(8): add the sntrup761x25519-sha512@openssh.com hybrid
ECDH/x25519 + Streamlined NTRU Prime post-quantum KEX to the
default KEXAlgorithms list (after the ECDH methods but before the
prime-group DH ones). The next release of OpenSSH is likely to
make this key exchange the default method.
* ssh-keygen(1): when downloading resident keys from a FIDO token,
pass back the user ID that was used when the key was created and
append it to the filename the key is written to (if it is not the
default). Avoids keys being clobbered if the user created multiple
resident keys with the same application string but different user
IDs.
* ssh-keygen(1), ssh(1), ssh-agent(1): better handling for FIDO keys
on tokens that provide user verification (UV) on the device itself,
including biometric keys, avoiding unnecessary PIN prompts.
* ssh-keygen(1): add "ssh-keygen -Y match-principals" operation to
perform matching of principals names against an allowed signers
file. To be used towards a TOFU model for SSH signatures in git.
* ssh-add(1), ssh-agent(1): allow pin-required FIDO keys to be added
to ssh-agent(1). $SSH_ASKPASS will be used to request the PIN at
authentication time.
* ssh-keygen(1): allow selection of hash at sshsig signing time
(either sha512 (default) or sha256).
* ssh(1), sshd(8): read network data directly to the packet input
buffer instead of indirectly via a small stack buffer. Provides a
modest performance improvement.
* ssh(1), sshd(8): read data directly to the channel input buffer,
providing a similar modest performance improvement.
* ssh(1): extend the PubkeyAuthentication configuration directive to
accept yes|no|unbound|host-bound to allow control over one of the
protocol extensions used to implement agent-restricted keys.
= Bugfixes
* sshd(8): document that CASignatureAlgorithms, ExposeAuthInfo and
PubkeyAuthOptions can be used in a Match block. PR277.
* sshd(8): fix possible string truncation when constructing paths to
.rhosts/.shosts files with very long user home directory names.
* ssh-keysign(1): unbreak for KEX algorithms that use SHA384/512
exchange hashes
* ssh(1): don't put the TTY into raw mode when SessionType=none,
avoids ^C being unable to kill such a session. bz3360
* scp(1): fix some corner-case bugs in SFTP-mode handling of
~-prefixed paths.
* ssh(1): unbreak hostbased auth using RSA keys. Allow ssh(1) to
select RSA keys when only RSA/SHA2 signature algorithms are
configured (this is the default case). Previously RSA keys were
not being considered in the default case.
* ssh-keysign(1): make ssh-keysign use the requested signature
algorithm and not the default for the key type. Part of unbreaking
hostbased auth for RSA/SHA2 keys.
* ssh(1): stricter UpdateHostkey signature verification logic on
the client- side. Require RSA/SHA2 signatures for RSA hostkeys
except when RSA/SHA1 was explicitly negotiated during initial
KEX; bz3375
* ssh(1), sshd(8): fix signature algorithm selection logic for
UpdateHostkeys on the server side. The previous code tried to
prefer RSA/SHA2 for hostkey proofs of RSA keys, but missed some
cases. This will use RSA/SHA2 signatures for RSA keys if the
client proposed these algorithms in initial KEX. bz3375
* All: convert all uses of select(2)/pselect(2) to poll(2)/ppoll(2).
This includes the mainloops in ssh(1), ssh-agent(1), ssh-agent(1)
and sftp-server(8), as well as the sshd(8) listen loop and all
other FD read/writability checks. On platforms with missing or
broken poll(2)/ppoll(2) syscalls a select(2)-based compat shim is
available.
* ssh-keygen(1): the "-Y find-principals" command was verifying key
validity when using ca certs but not with simple key lifetimes
within the allowed signers file.
* ssh-keygen(1): make sshsig verify-time argument parsing optional
* sshd(8): fix truncation in rhosts/shosts path construction.
* ssh(1), ssh-agent(1): avoid xmalloc(0) for PKCS#11 keyid for ECDSA
keys (we already did this for RSA keys). Avoids fatal errors for
PKCS#11 libraries that return empty keyid, e.g. Microchip ATECC608B
"cryptoauthlib"; bz#3364
* ssh(1), ssh-agent(1): improve the testing of credentials against
inserted FIDO: ask the token whether a particular key belongs to
it in cases where the token supports on-token user-verification
(e.g. biometrics) rather than just assuming that it will accept it.
Will reduce spurious "Confirm user presence" notifications for key
handles that relate to FIDO keys that are not currently inserted in at
least some cases. bz3366
* ssh(1), sshd(8): correct value for IPTOS_DSCP_LE. It needs to
allow for the preceding two ECN bits. bz#3373
* ssh-keygen(1): add missing -O option to usage() for the "-Y sign"
option.
* ssh-keygen(1): fix a NULL deref when using the find-principals
function, when matching an allowed_signers line that contains a
namespace restriction, but no restriction specified on the
command-line
* ssh-agent(1): fix memleak in process_extension(); oss-fuzz
issue #42719
* ssh(1): suppress "Connection to xxx closed" messages when LogLevel
is set to "error" or above. bz3378
* ssh(1), sshd(8): use correct zlib flags when inflate(3)-ing
compressed packet data. bz3372
* scp(1): when recursively transferring files in SFTP mode, create the
destination directory if it doesn't already exist to match scp(1) in
legacy RCP mode behaviour.
* scp(1): many improvements in error message consistency between scp(1)
in SFTP mode vs legacy RCP mode.
* sshd(8): fix potential race in SIGTERM handling PR289
* ssh(1), ssh(8): since DSA keys are deprecated, move them to the
end of the default list of public keys so that they will be tried
last. PR295
* ssh-keygen(1): allow 'ssh-keygen -Y find-principals' to match
wildcard principals in allowed_signers files
= Portability
* ssh(1), sshd(8): don't trust closefrom(2) on Linux. glibc's
implementation does not work in a chroot when the kernel does not
have close_range(2). It tries to read from /proc/self/fd and when
that fails dies with an assertion of sorts. Instead, call
close_range(2) directly from our compat code and fall back if
that fails. bz#3349,
* OS X poll(2) is broken; use compat replacement. For character-
special devices like /dev/null, Darwin's poll(2) returns POLLNVAL
when polled with POLLIN. Apparently this is Apple bug 3710161 -
not public but a websearch will find other OSS projects
rediscovering it periodically since it was first identified in
2005.
* Correct handling of exceptfds/POLLPRI in our select(2)-based
poll(2)/ppoll(2) compat implementation.
* Cygwin: correct checking of mbstowcs() return value.
* Add a basic SECURITY.md that refers people to the openssh.com
website.
* Enable additional compiler warnings and toolchain hardening flags,
including -Wbitwise-instead-of-logical, -Wmisleading-indentation,
- fzero-call-used-regs and -ftrivial-auto-var-init.
* HP/UX. Use compat getline(3) on HP-UX 10.x, where the libc version
is not reliable.
- Rebased patches:
* openssh-7.7p1-ldap.patch
* openssh-8.0p1-gssapi-keyex.patch
* openssh-8.1p1-audit.patch
* openssh-8.4p1-vendordir.patch
* openssh-reenable-dh-group14-sha1-default.patch
/usr/libexec/ssh/cavs_driver-ssh.pl /usr/libexec/ssh/cavstest-ctr /usr/libexec/ssh/cavstest-kdf
Generated by rpm2html 1.8.1
Fabrice Bellet, Thu Oct 23 22:49:34 2025