FreeBSD source tree https://cgit-dev.freebsd.org/src/atom?h=release%2F13.2.0 2023-02-07T22:40:12Z 2023-02-07T22:40:12Z Jung-uk Kim jkim@FreeBSD.org 2023-02-07T19:01:15Z urn:sha1:4f0087aa7c0d7a57c39f7ca8f6c6784ebd5e0b85 (cherry picked from commit eb9b98fb5aea1b20d71b0be948454f472b024da7) 2022-11-18T02:43:54Z Jung-uk Kim jkim@FreeBSD.org 2022-11-01T23:38:40Z urn:sha1:f529bc93a4be0a64ae1d8065300fc8cbe97c7124 (cherry picked from commit 93381ae06bb043a85d6b26459b511ccacc2045e2) 2022-10-26T16:42:37Z Ed Maste emaste@FreeBSD.org 2022-10-19T14:27:11Z urn:sha1:75f9d5c7e36b452f4f76356dfeb8bba51d64e51b Release notes are available at https://www.openssh.com/txt/release-9.1 9.1 contains fixes for three minor memory safety problems; these have lready been merged to the copy of OpenSSH 9.0 that is in the FreeBSD base system. Some highlights copied from the release notes: Potentially-incompatible changes -------------------------------- * ssh(1), sshd(8): SetEnv directives in ssh_config and sshd_config are now first-match-wins to match other directives. Previously if an environment variable was multiply specified the last set value would have been used. bz3438 * ssh-keygen(8): ssh-keygen -A (generate all default host key types) will no longer generate DSA keys, as these are insecure and have not been used by default for some years. New features ------------ * ssh(1), sshd(8): add a RequiredRSASize directive to set a minimum RSA key length. Keys below this length will be ignored for user authentication and for host authentication in sshd(8). * sftp-server(8): add a "users-groups-by-id@openssh.com" extension request that allows the client to obtain user/group names that correspond to a set of uids/gids. * sftp(1): use "users-groups-by-id@openssh.com" sftp-server extension (when available) to fill in user/group names for directory listings. * sftp-server(8): support the "home-directory" extension request defined in draft-ietf-secsh-filexfer-extensions-00. This overlaps a bit with the existing "expand-path@openssh.com", but some other clients support it. * ssh-keygen(1), sshd(8): allow certificate validity intervals, sshsig verification times and authorized_keys expiry-time options to accept dates in the UTC time zone in addition to the default of interpreting them in the system time zone. YYYYMMDD and YYMMDDHHMM[SS] dates/times will be interpreted as UTC if suffixed with a 'Z' character. Also allow certificate validity intervals to be specified in raw seconds-since-epoch as hex value, e.g. -V 0x1234:0x4567890. This is intended for use by regress tests and other tools that call ssh-keygen as part of a CA workflow. bz3468 * sftp(1): allow arguments to the sftp -D option, e.g. sftp -D "/usr/libexec/sftp-server -el debug3" * ssh-keygen(1): allow the existing -U (use agent) flag to work with "-Y sign" operations, where it will be interpreted to require that the private keys is hosted in an agent; bz3429 MFC after: 2 weeks Relnotes: Yes Sponsored by: The FreeBSD Foundation (cherry picked from commit 38a52bd3b5cac3da6f7f6eef3dd050e6aa08ebb3) 2022-07-05T16:27:33Z Jung-uk Kim jkim@FreeBSD.org 2022-07-05T16:01:07Z urn:sha1:7b456c97430589df5ebc742a78ecd58e781628bc (cherry picked from commit 25fb2515923796b329329b5c1c17d200ff416e84) 2022-06-21T22:49:31Z Jung-uk Kim jkim@FreeBSD.org 2022-06-21T18:22:28Z urn:sha1:5ecc007e426bab52c918745e1bb3585d77ffc40c (cherry picked from commit b4bdc8f9253d9db46f598f17cc546c2fe0f8038d) 2022-05-03T19:56:09Z Jung-uk Kim jkim@FreeBSD.org 2022-05-03T19:12:42Z urn:sha1:225a1494a5538364cddf9080b57d65277c6bfdf4 (cherry picked from commit 9a3583bfbd1740a158b3916432286190e0f2bf60) 2022-03-15T23:48:04Z Jung-uk Kim jkim@FreeBSD.org 2022-03-15T23:35:22Z urn:sha1:97fe61d5bfdee2adc4d6ffb9b65a0cfb5bc5d317 (cherry picked from commit 5ac766ab8ec23e780f108b7903d46e553d5e39d1) 2022-02-09T19:53:11Z Ed Maste emaste@FreeBSD.org 2021-09-08T01:05:51Z urn:sha1:317a38ab65334cbd24bd020b20b11041423d142f Some notable changes, from upstream's release notes: - sshd(8): Remove support for obsolete "host/port" syntax. - ssh(1): When prompting whether to record a new host key, accept the key fingerprint as a synonym for "yes". - ssh-keygen(1): when acting as a CA and signing certificates with an RSA key, default to using the rsa-sha2-512 signature algorithm. - ssh(1), sshd(8), ssh-keygen(1): this release removes the "ssh-rsa" (RSA/SHA1) algorithm from those accepted for certificate signatures. - ssh-sk-helper(8): this is a new binary. It is used by the FIDO/U2F support to provide address-space isolation for token middleware libraries (including the internal one). - ssh(1): this release enables UpdateHostkeys by default subject to some conservative preconditions. - scp(1): this release changes the behaviour of remote to remote copies (e.g. "scp host-a:/path host-b:") to transfer through the local host by default. - scp(1): experimental support for transfers using the SFTP protocol as a replacement for the venerable SCP/RCP protocol that it has traditionally used. Additional integration work is needed to support FIDO/U2F in the base system. Deprecation Notice ------------------ OpenSSH will disable the ssh-rsa signature scheme by default in the next release. Reviewed by: imp MFC after: 1 month Relnotes: Yes Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D29985 (cherry picked from commit 19261079b74319502c6ffa1249920079f0f69a72) (cherry picked from commit f448c3ed4ae1281861913a56377f9d93d49f8e8e) (cherry picked from commit 1f290c707a19d1695c303e6c8ead9cc414ccc6dc) (cherry picked from commit 0f9bafdfc325779e4ecc5154d5bb06c752297138) (cherry picked from commit adb56e58e8db84d8087ebe3d3e7def0074cb5a90) (cherry picked from commit 576b58108c1723c85e4dd00355e29bfe301dab11) (cherry picked from commit 1c99af1ebe61cbaf633792941640dcd254acf921) (cherry picked from commit 87152f34054921632016bc5eb4ab9f836fbaa522) (cherry picked from commit 172fa4aa7577915bf5ace5783251821d3774dc05) 2021-12-14T22:43:19Z Jung-uk Kim jkim@FreeBSD.org 2021-12-14T21:01:07Z urn:sha1:aeef12228a4574609c37560c3a89f0bc63bee5b8 (cherry picked from commit 754c4757c9cb225c66eb3297f2a8be198786fcc9) 2021-11-08T21:24:09Z Ed Maste emaste@FreeBSD.org 2021-11-02T18:48:33Z urn:sha1:a0880129a545dbb7ff35b456429b12e55146ef5d This moves SSHDIR and ssh_namespace.h handling to a common location, and will simplify future work such as adding U2F support (D32509). Reviewed by: kevans MFC after: 1 week Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D32808 (cherry picked from commit 9d63429fa16352f58037ac2aa6ddc734b25e8331)