ssh: Update to OpenSSH 9.5p1

Excerpts from the release notes:

Potentially incompatible changes
--------------------------------

* ssh-keygen(1): generate Ed25519 keys by default.
[NOTE: This c

ssh: Update to OpenSSH 9.5p1

Excerpts from the release notes:

Potentially incompatible changes
--------------------------------

* ssh-keygen(1): generate Ed25519 keys by default.
[NOTE: This change was already merged into FreeBSD.]

* sshd(8): the Subsystem directive now accurately preserves quoting of
subsystem commands and arguments.

New features
------------

* ssh(1): add keystroke timing obfuscation to the client.

* ssh(1), sshd(8): Introduce a transport-level ping facility.

* sshd(8): allow override of Sybsystem directives in sshd Match blocks.

Full release notes at https://www.openssh.com/txt/release-9.5

Relnotes: Yes
Sponsored by: The FreeBSD Foundation

show more ...

ssh: update to OpenSSH 9.2p1

Release notes are available at https://www.openssh.com/txt/release-9.2

OpenSSH 9.2 contains fixes for two security problems and a memory safety
problem. The memory saf

ssh: update to OpenSSH 9.2p1

Release notes are available at https://www.openssh.com/txt/release-9.2

OpenSSH 9.2 contains fixes for two security problems and a memory safety
problem. The memory safety problem is not believed to be exploitable.
These fixes have already been committed to OpenSSH 9.1 in FreeBSD.

Some other notable items from the release notes:

* ssh(1): add a new EnableEscapeCommandline ssh_config(5) option that
controls whether the client-side ~C escape sequence that provides a
command-line is available. Among other things, the ~C command-line
could be used to add additional port-forwards at runtime.

* sshd(8): add support for channel inactivity timeouts via a new
sshd_config(5) ChannelTimeout directive. This allows channels that
have not seen traffic in a configurable interval to be
automatically closed. Different timeouts may be applied to session,
X11, agent and TCP forwarding channels.

* sshd(8): add a sshd_config UnusedConnectionTimeout option to
terminate client connections that have no open channels for a
length of time. This complements the ChannelTimeout option above.

* sshd(8): add a -V (version) option to sshd like the ssh client has.

* scp(1), sftp(1): add a -X option to both scp(1) and sftp(1) to
allow control over some SFTP protocol parameters: the copy buffer
length and the number of in-flight requests, both of which are used
during upload/download. Previously these could be controlled in
sftp(1) only. This makes them available in both SFTP protocol
clients using the same option character sequence.

* ssh-keyscan(1): allow scanning of complete CIDR address ranges,
e.g. "ssh-keyscan 192.168.0.0/24". If a CIDR range is passed, then
it will be expanded to all possible addresses in the range
including the all-0s and all-1s addresses. bz#976

* ssh(1): support dynamic remote port forwarding in escape
command-line's -R processing. bz#3499

MFC after: 1 week
Sponsored by: The FreeBSD Foundation

show more ...

ssh: update to OpenSSH v9.0p1

Release notes are available at https://www.openssh.com/txt/release-9.0

Some highlights:

* ssh(1), sshd(8): use the hybrid Streamlined NTRU Prime + x25519 key
exch

ssh: update to OpenSSH v9.0p1

Release notes are available at https://www.openssh.com/txt/release-9.0

Some highlights:

* ssh(1), sshd(8): use the hybrid Streamlined NTRU Prime + x25519 key
exchange method by default ("sntrup761x25519-sha512@openssh.com").
The NTRU algorithm is believed to resist attacks enabled by future
quantum computers and is paired with the X25519 ECDH key exchange
(the previous default) as a backstop against any weaknesses in
NTRU Prime that may be discovered in the future. The combination
ensures that the hybrid exchange offers at least as good security
as the status quo.

* sftp-server(8): support the "copy-data" extension to allow server-
side copying of files/data, following the design in
draft-ietf-secsh-filexfer-extensions-00. bz2948

* sftp(1): add a "cp" command to allow the sftp client to perform
server-side file copies.

This commit excludes the scp(1) change to use the SFTP protocol by
default; that change will immediately follow.

MFC after: 1 month
Relnotes: Yes
Sponsored by: The FreeBSD Foundation

show more ...

openssh: update to OpenSSH v8.7p1

Some notable changes, from upstream's release notes:

- sshd(8): Remove support for obsolete "host/port" syntax.
- ssh(1): When prompting whether to record a new ho

openssh: update to OpenSSH v8.7p1

Some notable changes, from upstream's release notes:

- sshd(8): Remove support for obsolete "host/port" syntax.
- ssh(1): When prompting whether to record a new host key, accept the key
fingerprint as a synonym for "yes".
- ssh-keygen(1): when acting as a CA and signing certificates with an RSA
key, default to using the rsa-sha2-512 signature algorithm.
- ssh(1), sshd(8), ssh-keygen(1): this release removes the "ssh-rsa"
(RSA/SHA1) algorithm from those accepted for certificate signatures.
- ssh-sk-helper(8): this is a new binary. It is used by the FIDO/U2F
support to provide address-space isolation for token middleware
libraries (including the internal one).
- ssh(1): this release enables UpdateHostkeys by default subject to some
conservative preconditions.
- scp(1): this release changes the behaviour of remote to remote copies
(e.g. "scp host-a:/path host-b:") to transfer through the local host
by default.
- scp(1): experimental support for transfers using the SFTP protocol as
a replacement for the venerable SCP/RCP protocol that it has
traditionally used.

Additional integration work is needed to support FIDO/U2F in the base
system.

Deprecation Notice
------------------

OpenSSH will disable the ssh-rsa signature scheme by default in the
next release.

Reviewed by: imp
MFC after: 1 month
Relnotes: Yes
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D29985

show more ...

Merge ^/head r294169 through r294598.

MFH @r294567

MFH

Sponsored by: The FreeBSD Foundation

Upgrade to OpenSSH 6.8p1.

MFC @ r266724

An SVM update will follow this.

Merge head

IFC @264767

MFH: tracking commit

Sponsored by: The FreeBSD Foundation

Merge head up to r262222 (last merge was incomplete).

MFC @ r259205 in preparation for some SVM updates. (for real this time)

Upgrade to OpenSSH 6.5p1.

Merge head r232040 through r258006.

MFV r257952:

Upgrade to OpenSSH 6.4p1.

Bump VersionAddendum.

Approved by: des

MFC @ r256071

This is just prior to the bhyve_npt_pmap import so will allow
just the change to be merged for easier debug.

Merge head r233826 through r256722.

Merge head@256284

IFC @256277

Approved by: ken (mentor)

MFC - tracking update.

Upgrade to 6.3p1.

Approved by: re (gjb)

MFC @ r241285

IFC @ r242684