FreeBSD source tree https://cgit-dev.freebsd.org/src/atom?h=releng%2F12.4 2022-10-07T13:22:10Z 2022-10-07T13:22:10Z Ed Maste emaste@FreeBSD.org 2022-04-13T20:00:56Z urn:sha1:bcfd209157947d63f959a729cfd978a6efd51a14 Release notes are available at https://www.openssh.com/txt/release-8.9 Some highlights: * ssh(1), sshd(8), ssh-add(1), ssh-agent(1): add a system for restricting forwarding and use of keys added to ssh-agent(1) * ssh(1), sshd(8): add the sntrup761x25519-sha512@openssh.com hybrid ECDH/x25519 + Streamlined NTRU Prime post-quantum KEX to the default KEXAlgorithms list (after the ECDH methods but before the prime-group DH ones). The next release of OpenSSH is likely to make this key exchange the default method. * sshd(8), portable OpenSSH only: this release removes in-built support for MD5-hashed passwords. If you require these on your system then we recommend linking against libxcrypt or similar. Future deprecation notice ========================= A near-future release of OpenSSH will switch scp(1) from using the legacy scp/rcp protocol to using SFTP by default. Legacy scp/rcp performs wildcard expansion of remote filenames (e.g. "scp host:* .") through the remote shell. This has the side effect of requiring double quoting of shell meta-characters in file names included on scp(1) command-lines, otherwise they could be interpreted as shell commands on the remote side. MFC after: 1 month Relnotes: Yes Sponsored by: The FreeBSD Foundation (cherry picked from commit 1323ec571215a77ddd21294f0871979d5ad6b992) (cherry picked from commit 58def461e256e3a05c3ff15a87ed702fe0c3662c) (cherry picked from commit 6ac1039d047aafcaae5fec13504ece8fdc764c5a) 2018-05-08T23:13:11Z Dag-Erling Smørgrav des@FreeBSD.org 2018-05-08T23:13:11Z urn:sha1:4f52dfbb8d6c4d446500c5b097e3806ec219fbd4 This completely removes client-side support for the SSH 1 protocol, which was already disabled in 12 but is still enabled in 11. For that reason, we will not be able to merge 7.6p1 or newer back to 11. 2016-03-11T00:15:29Z Dag-Erling Smørgrav des@FreeBSD.org 2016-03-11T00:15:29Z urn:sha1:acc1a9ef8333c798c210fa94be6af4d5fe2dd794 2016-01-19T18:28:23Z Dag-Erling Smørgrav des@FreeBSD.org 2016-01-19T18:28:23Z urn:sha1:bc5531debefeb54993d01d4f3c8b33ccbe0b4d95 2013-09-21T21:36:09Z Dag-Erling Smørgrav des@FreeBSD.org 2013-09-21T21:36:09Z urn:sha1:e4a9863fb76a1f6b16ecbcbd31e88f4ad9a9565e Approved by: re (gjb) 2013-03-22T17:55:38Z Dag-Erling Smørgrav des@FreeBSD.org 2013-03-22T17:55:38Z urn:sha1:6888a9be566d79246a948dcc4c0a914b1bee0c32 for a key revocation list and more fine-grained authentication control. 2011-05-04T07:34:44Z Dag-Erling Smørgrav des@FreeBSD.org 2011-05-04T07:34:44Z urn:sha1:4a421b6336e5e0c2ff27024c30fe32c6f71dcf3d 2009-10-01T17:12:52Z Dag-Erling Smørgrav des@FreeBSD.org 2009-10-01T17:12:52Z urn:sha1:7aee6ffee0748c4c6bd9d11bb2a90c7531244d63 2008-08-01T02:48:36Z Dag-Erling Smørgrav des@FreeBSD.org 2008-08-01T02:48:36Z urn:sha1:d4af9e693f15f5155095f38c7650b24fe74ae351 I have worked hard to reduce diffs against the vendor branch. One notable change in that respect is that we no longer prefer DSA over RSA - the reasons for doing so went away years ago. This may cause some surprises, as ssh will warn about unknown host keys even for hosts whose keys haven't changed. MFC after: 6 weeks 2008-08-01T01:32:56Z Dag-Erling Smørgrav des@FreeBSD.org 2008-08-01T01:32:56Z urn:sha1:7ca12ebb5535256c1215f15338e53487d3a0b2d0