FreeBSD source tree https://cgit-dev.freebsd.org/src/atom?h=releng%2F12.4 2022-10-31T17:15:47Z 2022-10-31T17:15:47Z Ed Maste emaste@FreeBSD.org 2022-10-19T14:27:11Z urn:sha1:50cb877af1fb6de40baa305dca93afdbd4de6568 Release notes are available at https://www.openssh.com/txt/release-9.1 9.1 contains fixes for three minor memory safety problems; these have lready been merged to the copy of OpenSSH 9.0 that is in the FreeBSD base system. Some highlights copied from the release notes: Potentially-incompatible changes -------------------------------- * ssh(1), sshd(8): SetEnv directives in ssh_config and sshd_config are now first-match-wins to match other directives. Previously if an environment variable was multiply specified the last set value would have been used. bz3438 * ssh-keygen(8): ssh-keygen -A (generate all default host key types) will no longer generate DSA keys, as these are insecure and have not been used by default for some years. New features ------------ * ssh(1), sshd(8): add a RequiredRSASize directive to set a minimum RSA key length. Keys below this length will be ignored for user authentication and for host authentication in sshd(8). * sftp-server(8): add a "users-groups-by-id@openssh.com" extension request that allows the client to obtain user/group names that correspond to a set of uids/gids. * sftp(1): use "users-groups-by-id@openssh.com" sftp-server extension (when available) to fill in user/group names for directory listings. * sftp-server(8): support the "home-directory" extension request defined in draft-ietf-secsh-filexfer-extensions-00. This overlaps a bit with the existing "expand-path@openssh.com", but some other clients support it. * ssh-keygen(1), sshd(8): allow certificate validity intervals, sshsig verification times and authorized_keys expiry-time options to accept dates in the UTC time zone in addition to the default of interpreting them in the system time zone. YYYYMMDD and YYMMDDHHMM[SS] dates/times will be interpreted as UTC if suffixed with a 'Z' character. Also allow certificate validity intervals to be specified in raw seconds-since-epoch as hex value, e.g. -V 0x1234:0x4567890. This is intended for use by regress tests and other tools that call ssh-keygen as part of a CA workflow. bz3468 * sftp(1): allow arguments to the sftp -D option, e.g. sftp -D "/usr/libexec/sftp-server -el debug3" * ssh-keygen(1): allow the existing -U (use agent) flag to work with "-Y sign" operations, where it will be interpreted to require that the private keys is hosted in an agent; bz3429 MFC after: 2 weeks Relnotes: Yes Sponsored by: The FreeBSD Foundation (cherry picked from commit 38a52bd3b5cac3da6f7f6eef3dd050e6aa08ebb3) (cherry picked from commit ac5c465b9fdff74d1a73f63d157820887ff1787f) (cherry picked from commit 4aee71578a60981de9296451b7a995b180ae23db) Approved by: re (gjb) 2022-10-07T13:22:10Z Ed Maste emaste@FreeBSD.org 2022-04-15T14:41:08Z urn:sha1:d1fe5b3045b9963dc26380333f4d5a51ae446c78 Release notes are available at https://www.openssh.com/txt/release-9.0 Some highlights: * ssh(1), sshd(8): use the hybrid Streamlined NTRU Prime + x25519 key exchange method by default ("sntrup761x25519-sha512@openssh.com"). The NTRU algorithm is believed to resist attacks enabled by future quantum computers and is paired with the X25519 ECDH key exchange (the previous default) as a backstop against any weaknesses in NTRU Prime that may be discovered in the future. The combination ensures that the hybrid exchange offers at least as good security as the status quo. * sftp-server(8): support the "copy-data" extension to allow server- side copying of files/data, following the design in draft-ietf-secsh-filexfer-extensions-00. bz2948 * sftp(1): add a "cp" command to allow the sftp client to perform server-side file copies. This commit excludes the scp(1) change to use the SFTP protocol by default; that change will immediately follow. MFC after: 1 month Relnotes: Yes Sponsored by: The FreeBSD Foundation (cherry picked from commit 87c1498d1a7473ff983e5c0456f30608f3f1e601) (cherry picked from commit 9fce8d4140370ca8bc03d6a5668fb64a040c00fc) (cherry picked from commit e2cec5ba2c4385eec0b76d07469ec11d3ce3d6e2) (cherry picked from commit 8449ae9c7668075c9a4ff7d503bf72a1f12445dd) 2022-10-07T13:22:10Z Ed Maste emaste@FreeBSD.org 2022-04-13T20:00:56Z urn:sha1:bcfd209157947d63f959a729cfd978a6efd51a14 Release notes are available at https://www.openssh.com/txt/release-8.9 Some highlights: * ssh(1), sshd(8), ssh-add(1), ssh-agent(1): add a system for restricting forwarding and use of keys added to ssh-agent(1) * ssh(1), sshd(8): add the sntrup761x25519-sha512@openssh.com hybrid ECDH/x25519 + Streamlined NTRU Prime post-quantum KEX to the default KEXAlgorithms list (after the ECDH methods but before the prime-group DH ones). The next release of OpenSSH is likely to make this key exchange the default method. * sshd(8), portable OpenSSH only: this release removes in-built support for MD5-hashed passwords. If you require these on your system then we recommend linking against libxcrypt or similar. Future deprecation notice ========================= A near-future release of OpenSSH will switch scp(1) from using the legacy scp/rcp protocol to using SFTP by default. Legacy scp/rcp performs wildcard expansion of remote filenames (e.g. "scp host:* .") through the remote shell. This has the side effect of requiring double quoting of shell meta-characters in file names included on scp(1) command-lines, otherwise they could be interpreted as shell commands on the remote side. MFC after: 1 month Relnotes: Yes Sponsored by: The FreeBSD Foundation (cherry picked from commit 1323ec571215a77ddd21294f0871979d5ad6b992) (cherry picked from commit 58def461e256e3a05c3ff15a87ed702fe0c3662c) (cherry picked from commit 6ac1039d047aafcaae5fec13504ece8fdc764c5a) 2022-05-01T19:37:10Z Ed Maste emaste@FreeBSD.org 2022-04-23T19:52:03Z urn:sha1:eb845555fd0a678cc0916ce392444fe2f2a2ec10 With the upgrade to OpenSSH 6.7p1 in commit a0ee8cc636cd we replaced WITH_OPENSSL ifdefs with an OPENSSL_VERSION macro, later changing it to OPENSSL_VERSION_STRING. A few years later OpenSSH made an equivalent change (with a different macro name), in commit 4d94b031ff88. Switch to the macro name they chose. MFC after: 1 week Sponsored by: The FreeBSD Foundation (cherry picked from commit 6e24fe61287b02600be19042a6f6ce939aabfaa6) (cherry picked from commit 41406f9251c0e186fe820f70e9da0606bff71dae) 2022-04-25T01:05:33Z Ed Maste emaste@FreeBSD.org 2022-04-18T21:20:25Z urn:sha1:776b9127edb1c9a9b91f39ec9328f302c21ca36a Reported by: allanjude (in review D29953) Fixes: 462c32cb8d7a ("Upgrade OpenSSH to 6.1p1.") MFC after: 1 week Sponsored by: The FreeBSD Foundation (cherry picked from commit 613b4b79713e294140757270f02a8aa6273be3d4) 2022-02-14T20:26:46Z Ed Maste emaste@FreeBSD.org 2021-12-19T16:02:02Z urn:sha1:273cf7f3b32b124c2b85d6ab30c3bfaa0bd7f2b9 OpenSSH v8.8p1 was motivated primarily by a security update and deprecation of RSA/SHA1 signatures. It also has a few minor bug fixes. The security update was already applied to FreeBSD as an independent change, and the RSA/SHA1 deprecation is excluded from this commit but will immediately follow. MFC after: 1 month Relnotes: Yes Sponsored by: The FreeBSD Foundation (cherry picked from commit e9e8876a4d6afc1ad5315faaa191b25121a813d7) (cherry picked from commit 2ffb13149c8e46cb7d7e891b237255615906dc60) (cherry picked from commit f40841ea9e70c8605dad4e8693fd6a8689b5e324) 2022-02-11T00:42:03Z Ed Maste emaste@FreeBSD.org 2021-09-08T01:05:51Z urn:sha1:bb83bdac03e92c8efcd991de8caccc5ec2ddcb20 Some notable changes, from upstream's release notes: - sshd(8): Remove support for obsolete "host/port" syntax. - ssh(1): When prompting whether to record a new host key, accept the key fingerprint as a synonym for "yes". - ssh-keygen(1): when acting as a CA and signing certificates with an RSA key, default to using the rsa-sha2-512 signature algorithm. - ssh(1), sshd(8), ssh-keygen(1): this release removes the "ssh-rsa" (RSA/SHA1) algorithm from those accepted for certificate signatures. - ssh-sk-helper(8): this is a new binary. It is used by the FIDO/U2F support to provide address-space isolation for token middleware libraries (including the internal one). - ssh(1): this release enables UpdateHostkeys by default subject to some conservative preconditions. - scp(1): this release changes the behaviour of remote to remote copies (e.g. "scp host-a:/path host-b:") to transfer through the local host by default. - scp(1): experimental support for transfers using the SFTP protocol as a replacement for the venerable SCP/RCP protocol that it has traditionally used. Additional integration work is needed to support FIDO/U2F in the base system. Deprecation Notice ------------------ OpenSSH will disable the ssh-rsa signature scheme by default in the next release. Reviewed by: imp MFC after: 1 month Relnotes: Yes Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D29985 (cherry picked from commit 19261079b74319502c6ffa1249920079f0f69a72) (cherry picked from commit f448c3ed4ae1281861913a56377f9d93d49f8e8e) (cherry picked from commit 1f290c707a19d1695c303e6c8ead9cc414ccc6dc) (cherry picked from commit 0f9bafdfc325779e4ecc5154d5bb06c752297138) (cherry picked from commit adb56e58e8db84d8087ebe3d3e7def0074cb5a90) (cherry picked from commit 576b58108c1723c85e4dd00355e29bfe301dab11) (cherry picked from commit 1c99af1ebe61cbaf633792941640dcd254acf921) (cherry picked from commit 87152f34054921632016bc5eb4ab9f836fbaa522) (cherry picked from commit 172fa4aa7577915bf5ace5783251821d3774dc05) (cherry picked from commit 317a38ab65334cbd24bd020b20b11041423d142f) 2020-04-25T15:38:48Z Ed Maste emaste@FreeBSD.org 2020-04-25T15:38:48Z urn:sha1:7ef62633487140273237eb4479279c104a839b4b Sponsored by: The FreeBSD Foundation 2018-09-19T20:52:47Z Ed Maste emaste@FreeBSD.org 2018-09-19T20:52:47Z urn:sha1:c6de6086cfc759413dd95b5fa549fe7eebca801a Local changes introduced an OPENSSH_VERSION macro, but this conflicts with a macro of the same name introduced with OepnsSL 1.1.1 Reviewed by: des Approved by: re (gjb) MFC after: 1 week Sponsored by: The FreeBSD Foundation 2018-09-10T16:20:12Z Dag-Erling Smørgrav des@FreeBSD.org 2018-09-10T16:20:12Z urn:sha1:190cef3d52236565eb22e18b33e9e865ec634aa3 Approved by: re (kib@)