freebsd-nq/crypto/openssh
Ed Maste 8c22023ca5 ssh: disable RSA/SHA-1 signatures
From OpenSSH 8.8p1's release notes:

---

Potentially-incompatible changes
================================

This release disables RSA signatures using the SHA-1 hash algorithm
by default. This change has been made as the SHA-1 hash algorithm is
cryptographically broken, and it is possible to create chosen-prefix
hash collisions for <USD$50K [1]

For most users, this change should be invisible and there is
no need to replace ssh-rsa keys. OpenSSH has supported RFC8332
RSA/SHA-256/512 signatures since release 7.2 and existing ssh-rsa keys
will automatically use the stronger algorithm where possible.

Incompatibility is more likely when connecting to older SSH
implementations that have not been upgraded or have not closely tracked
improvements in the SSH protocol. For these cases, it may be necessary
to selectively re-enable RSA/SHA1 to allow connection and/or user
authentication via the HostkeyAlgorithms and PubkeyAcceptedAlgorithms
options. For example, the following stanza in ~/.ssh/config will enable
RSA/SHA1 for host and user authentication for a single destination host:

    Host old-host
        HostkeyAlgorithms +ssh-rsa
	PubkeyAcceptedAlgorithms +ssh-rsa

We recommend enabling RSA/SHA1 only as a stopgap measure until legacy
implementations can be upgraded or reconfigured with another key type
(such as ECDSA or Ed25519).

[1] "SHA-1 is a Shambles: First Chosen-Prefix Collision on SHA-1 and
    Application to the PGP Web of Trust" Leurent, G and Peyrin, T
    (2020) https://eprint.iacr.org/2020/014.pdf

---

Relnotes:	Yes
Sponsored by:	The FreeBSD Foundation
2021-12-19 11:03:45 -05:00
..
.github ssh: update to OpenSSH v8.8p1 2021-12-19 11:02:02 -05:00
contrib ssh: update to OpenSSH v8.8p1 2021-12-19 11:02:02 -05:00
m4 openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
openbsd-compat ssh: update to OpenSSH v8.8p1 2021-12-19 11:02:02 -05:00
regress ssh: disable RSA/SHA-1 signatures 2021-12-19 11:03:45 -05:00
.depend openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
.gitignore openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
.skipped-commit-ids openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
aclocal.m4 openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
addr.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
addr.h openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
addrmatch.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
atomicio.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
atomicio.h openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
audit-bsm.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
audit-linux.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
audit.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
audit.h openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
auth2-chall.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
auth2-gss.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
auth2-hostbased.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
auth2-kbdint.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
auth2-none.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
auth2-passwd.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
auth2-pubkey.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
auth2.c openssh: pass ssh context to BLACKLIST_NOTIFY 2021-09-14 13:44:39 -04:00
auth-bsdauth.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
auth-krb5.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
auth-options.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
auth-options.h openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
auth-pam.c ssh: update to OpenSSH v8.8p1 2021-12-19 11:02:02 -05:00
auth-pam.h openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
auth-passwd.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
auth-rhosts.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
auth-shadow.c Upgrade to OpenSSH 7.8p1. 2018-09-10 16:20:12 +00:00
auth-sia.c Upgrade to OpenSSH 7.8p1. 2018-09-10 16:20:12 +00:00
auth-sia.h
auth.c openssh: pass ssh context to BLACKLIST_NOTIFY 2021-09-14 13:44:39 -04:00
auth.h openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
authfd.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
authfd.h openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
authfile.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
authfile.h openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
bitmap.c Upgrade to OpenSSH 7.7p1. 2018-05-11 13:22:43 +00:00
bitmap.h Upgrade to OpenSSH 7.7p1. 2018-05-11 13:22:43 +00:00
blacklist_client.h openssh: pass ssh context to BLACKLIST_NOTIFY 2021-09-14 13:44:39 -04:00
blacklist.c openssh: pass ssh context to BLACKLIST_NOTIFY 2021-09-14 13:44:39 -04:00
buildpkg.sh.in openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
canohost.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
canohost.h Upgrade to OpenSSH 7.3p1. 2017-03-02 00:11:32 +00:00
chacha.c
chacha.h openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
ChangeLog ssh: update to OpenSSH v8.8p1 2021-12-19 11:02:02 -05:00
channels.c ssh: update to OpenSSH v8.8p1 2021-12-19 11:02:02 -05:00
channels.h openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
cipher-aes.c
cipher-aesctr.c Upgrade to OpenSSH 6.8p1. 2016-01-19 18:28:23 +00:00
cipher-aesctr.h Upgrade to OpenSSH 6.7p1, retaining libwrap support (which has been removed 2016-01-19 16:18:26 +00:00
cipher-chachapoly-libcrypto.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
cipher-chachapoly.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
cipher-chachapoly.h openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
cipher-ctr.c Upgrade to OpenSSH 6.8p1. 2016-01-19 18:28:23 +00:00
cipher.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
cipher.h openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
cleanup.c
clientloop.c ssh: update to OpenSSH v8.8p1 2021-12-19 11:02:02 -05:00
clientloop.h openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
compat.c ssh: update to OpenSSH v8.8p1 2021-12-19 11:02:02 -05:00
compat.h openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
config.guess openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
config.h ssh: update to OpenSSH v8.8p1 2021-12-19 11:02:02 -05:00
config.sub openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
configure.ac ssh: update to OpenSSH v8.8p1 2021-12-19 11:02:02 -05:00
CREDITS openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
crypto_api.h openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
defines.h openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
dh.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
dh.h openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
digest-libc.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
digest-openssl.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
digest.h Upgrade to OpenSSH 7.6p1. This will be followed shortly by 7.7p1. 2018-05-08 23:13:11 +00:00
dispatch.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
dispatch.h openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
dns.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
dns.h openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
ed25519.c
entropy.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
entropy.h Upgrade to OpenSSH 7.8p1. 2018-09-10 16:20:12 +00:00
fatal.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
fe25519.c
fe25519.h
fixalgorithms
fixpaths
freebsd-configure.sh ssh: disble internal security key support in generated config.h 2021-11-01 15:45:37 -04:00
freebsd-namespace.sh openssh: tag generated file with @generated 2021-09-02 09:44:58 -04:00
freebsd-post-merge.sh
freebsd-pre-merge.sh openssh: port upgrade doc and script to git 2021-02-14 16:41:11 -05:00
FREEBSD-upgrade ssh: mention nanobsd config files in upgrade instructions 2021-11-20 16:38:18 -05:00
ge25519_base.data
ge25519.c
ge25519.h Upgrade to OpenSSH 6.8p1. 2016-01-19 18:28:23 +00:00
groupaccess.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
groupaccess.h
gss-genr.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
gss-serv-krb5.c Upgrade to OpenSSH 7.8p1. 2018-09-10 16:20:12 +00:00
gss-serv.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
hash.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
hmac.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
hmac.h Upgrade to OpenSSH 6.7p1, retaining libwrap support (which has been removed 2016-01-19 16:18:26 +00:00
hostfile.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
hostfile.h openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
includes.h Upgrade to OpenSSH 7.6p1. This will be followed shortly by 7.7p1. 2018-05-08 23:13:11 +00:00
INSTALL openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
install-sh Upgrade to OpenSSH 7.7p1. 2018-05-11 13:22:43 +00:00
int32_minmax.inc openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
kex.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
kex.h openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
kexc25519.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
kexdh.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
kexecdh.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
kexgen.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
kexgex.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
kexgexc.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
kexgexs.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
kexsntrup761x25519.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
krb5_config.h
krl.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
krl.h openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
LICENCE openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
log.c ssh: update to OpenSSH v8.8p1 2021-12-19 11:02:02 -05:00
log.h openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
loginrec.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
loginrec.h openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
logintest.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
mac.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
mac.h Upgrade to OpenSSH 7.3p1. 2017-03-02 00:11:32 +00:00
Makefile.in openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
match.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
match.h openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
md5crypt.c Upgrade to OpenSSH 7.7p1. 2018-05-11 13:22:43 +00:00
md5crypt.h Upgrade to OpenSSH 7.4p1. 2017-03-06 01:37:05 +00:00
mdoc2man.awk Upgrade to OpenSSH 7.7p1. 2018-05-11 13:22:43 +00:00
misc.c OpenSSH: cherry-pick "need initgroups() before setresgid()" 2021-10-08 21:29:25 -04:00
misc.h openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
mkinstalldirs Upgrade to OpenSSH 7.7p1. 2018-05-11 13:22:43 +00:00
moduli openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
moduli.5
moduli.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
monitor_fdpass.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
monitor_fdpass.h
monitor_wrap.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
monitor_wrap.h openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
monitor.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
monitor.h openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
msg.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
msg.h Upgrade to OpenSSH 6.8p1. 2016-01-19 18:28:23 +00:00
mux.c openssh: remove unnecessary $FreeBSD$ tags 2021-09-07 21:52:06 -04:00
myproposal.h ssh: disable RSA/SHA-1 signatures 2021-12-19 11:03:45 -05:00
nchan2.ms
nchan.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
nchan.ms
openssh.xml.in
opensshd.init.in ssh: update to OpenSSH v8.8p1 2021-12-19 11:02:02 -05:00
OVERVIEW openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
packet.c openssh: pass ssh context to BLACKLIST_NOTIFY 2021-09-14 13:44:39 -04:00
packet.h openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
pathnames.h openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
pkcs11.h
platform-misc.c Upgrade to OpenSSH 7.6p1. This will be followed shortly by 7.7p1. 2018-05-08 23:13:11 +00:00
platform-pledge.c Upgrade to OpenSSH 7.2p2. 2016-03-11 00:15:29 +00:00
platform-tracing.c ssh: update to OpenSSH v8.8p1 2021-12-19 11:02:02 -05:00
platform.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
platform.h Upgrade to OpenSSH 7.4p1. 2017-03-06 01:37:05 +00:00
poly1305.c
poly1305.h Upgrade to OpenSSH 6.7p1, retaining libwrap support (which has been removed 2016-01-19 16:18:26 +00:00
progressmeter.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
progressmeter.h openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
PROTOCOL openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
PROTOCOL.agent openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
PROTOCOL.certkeys openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
PROTOCOL.chacha20poly1305 openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
PROTOCOL.key openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
PROTOCOL.krl Upgrade to OpenSSH 7.9p1. 2020-02-14 19:06:59 +00:00
PROTOCOL.mux openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
PROTOCOL.sshsig openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
PROTOCOL.u2f openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
readconf.c ssh: update to OpenSSH v8.8p1 2021-12-19 11:02:02 -05:00
readconf.h ssh: update to OpenSSH v8.8p1 2021-12-19 11:02:02 -05:00
README ssh: update to OpenSSH v8.8p1 2021-12-19 11:02:02 -05:00
README.dns openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
README.md openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
README.platform openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
README.privsep openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
README.tun
readpass.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
rijndael.c Upgrade to OpenSSH 6.9p1. 2016-01-19 18:55:44 +00:00
rijndael.h Upgrade to OpenSSH 6.7p1, retaining libwrap support (which has been removed 2016-01-19 16:18:26 +00:00
sandbox-capsicum.c sshd: address capsicum issues 2018-10-06 21:32:55 +00:00
sandbox-darwin.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
sandbox-null.c
sandbox-pledge.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
sandbox-rlimit.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
sandbox-seccomp-filter.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
sandbox-solaris.c Upgrade to OpenSSH 7.6p1. This will be followed shortly by 7.7p1. 2018-05-08 23:13:11 +00:00
sandbox-systrace.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
sc25519.c
sc25519.h
scp.1 ssh: update to OpenSSH v8.8p1 2021-12-19 11:02:02 -05:00
scp.c ssh: update to OpenSSH v8.8p1 2021-12-19 11:02:02 -05:00
servconf.c ssh: update to OpenSSH v8.8p1 2021-12-19 11:02:02 -05:00
servconf.h openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
serverloop.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
serverloop.h Upgrade to OpenSSH 7.6p1. This will be followed shortly by 7.7p1. 2018-05-08 23:13:11 +00:00
session.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
session.h Upgrade to OpenSSH 7.9p1. 2020-02-14 19:06:59 +00:00
sftp-client.c ssh: update to OpenSSH v8.8p1 2021-12-19 11:02:02 -05:00
sftp-client.h openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
sftp-common.c openssh: remove unnecessary $FreeBSD$ tags 2021-09-07 21:52:06 -04:00
sftp-common.h Upgrade to OpenSSH 6.8p1. 2016-01-19 18:28:23 +00:00
sftp-glob.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
sftp-realpath.c ssh: update to OpenSSH v8.8p1 2021-12-19 11:02:02 -05:00
sftp-server-main.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
sftp-server.8 openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
sftp-server.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
sftp.1 openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
sftp.c ssh: update to OpenSSH v8.8p1 2021-12-19 11:02:02 -05:00
sftp.h
sk-api.h openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
sk-usbhid.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
smult_curve25519_ref.c
sntrup761.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
sntrup761.sh openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
srclimit.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
srclimit.h openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
ssh2.h openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
ssh_api.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
ssh_api.h Upgrade to OpenSSH 7.8p1. 2018-09-10 16:20:12 +00:00
ssh_config ssh: update to OpenSSH v8.8p1 2021-12-19 11:02:02 -05:00
ssh_config.5 ssh: disable RSA/SHA-1 signatures 2021-12-19 11:03:45 -05:00
ssh_namespace.h ssh: update to OpenSSH v8.8p1 2021-12-19 11:02:02 -05:00
ssh-add.1 openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
ssh-add.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
ssh-agent.1 openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
ssh-agent.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
ssh-dss.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
ssh-ecdsa-sk.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
ssh-ecdsa.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
ssh-ed25519-sk.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
ssh-ed25519.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
ssh-gss.h openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
ssh-keygen.1 openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
ssh-keygen.c ssh: update to OpenSSH v8.8p1 2021-12-19 11:02:02 -05:00
ssh-keyscan.1 openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
ssh-keyscan.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
ssh-keysign.8 openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
ssh-keysign.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
ssh-pkcs11-client.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
ssh-pkcs11-helper.8 openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
ssh-pkcs11-helper.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
ssh-pkcs11.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
ssh-pkcs11.h openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
ssh-rsa.c openssh: cherry-pick OpenSSL 1.1.1 compatibility 2018-10-06 14:38:34 +00:00
ssh-sandbox.h
ssh-sk-client.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
ssh-sk-helper.8 openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
ssh-sk-helper.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
ssh-sk.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
ssh-sk.h openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
ssh-xmss.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
ssh.1 ssh: update to OpenSSH v8.8p1 2021-12-19 11:02:02 -05:00
ssh.c ssh: update to OpenSSH v8.8p1 2021-12-19 11:02:02 -05:00
ssh.h openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
sshbuf-getput-basic.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
sshbuf-getput-crypto.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
sshbuf-io.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
sshbuf-misc.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
sshbuf.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
sshbuf.h openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
sshconnect2.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
sshconnect.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
sshconnect.h openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
sshd_config ssh: update to OpenSSH v8.8p1 2021-12-19 11:02:02 -05:00
sshd_config.5 ssh: update to OpenSSH v8.8p1 2021-12-19 11:02:02 -05:00
sshd.8 ssh: update to OpenSSH v8.8p1 2021-12-19 11:02:02 -05:00
sshd.c openssh: use global state for blacklist in grace_alarm_handler 2021-09-16 14:10:11 -04:00
ssherr.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
ssherr.h openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
sshkey-xmss.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
sshkey-xmss.h openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
sshkey.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
sshkey.h openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
sshlogin.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
sshlogin.h
sshpty.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
sshpty.h Upgrade to OpenSSH 7.4p1. 2017-03-06 01:37:05 +00:00
sshsig.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
sshsig.h openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
sshtty.c
survey.sh.in
TODO Upgrade to OpenSSH 7.8p1. 2018-09-10 16:20:12 +00:00
ttymodes.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
ttymodes.h Upgrade to OpenSSH 7.6p1. This will be followed shortly by 7.7p1. 2018-05-08 23:13:11 +00:00
uidswap.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
uidswap.h Upgrade to OpenSSH 7.8p1. 2018-09-10 16:20:12 +00:00
umac128.c Upgrade to OpenSSH 7.7p1. 2018-05-11 13:22:43 +00:00
umac.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
umac.h openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
utf8.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
utf8.h openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
verify.c
version.h ssh: update to OpenSSH v8.8p1 2021-12-19 11:02:02 -05:00
xmalloc.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
xmalloc.h openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
xmss_commons.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
xmss_commons.h Upgrade to OpenSSH 7.7p1. 2018-05-11 13:22:43 +00:00
xmss_fast.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
xmss_fast.h Upgrade to OpenSSH 7.7p1. 2018-05-11 13:22:43 +00:00
xmss_hash_address.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
xmss_hash_address.h Upgrade to OpenSSH 7.7p1. 2018-05-11 13:22:43 +00:00
xmss_hash.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
xmss_hash.h Upgrade to OpenSSH 7.7p1. 2018-05-11 13:22:43 +00:00
xmss_wots.c openssh: update to OpenSSH v8.7p1 2021-09-07 21:05:51 -04:00
xmss_wots.h Upgrade to OpenSSH 7.7p1. 2018-05-11 13:22:43 +00:00

Portable OpenSSH

C/C++ CI Fuzzing Status

OpenSSH is a complete implementation of the SSH protocol (version 2) for secure remote login, command execution and file transfer. It includes a client ssh and server sshd, file transfer utilities scp and sftp as well as tools for key generation (ssh-keygen), run-time key storage (ssh-agent) and a number of supporting programs.

This is a port of OpenBSD's OpenSSH to most Unix-like operating systems, including Linux, OS X and Cygwin. Portable OpenSSH polyfills OpenBSD APIs that are not available elsewhere, adds sshd sandboxing for more operating systems and includes support for OS-native authentication and auditing (e.g. using PAM).

Documentation

The official documentation for OpenSSH are the man pages for each tool:

Stable Releases

Stable release tarballs are available from a number of download mirrors. We recommend the use of a stable release for most users. Please read the release notes for details of recent changes and potential incompatibilities.

Building Portable OpenSSH

Dependencies

Portable OpenSSH is built using autoconf and make. It requires a working C compiler, standard library and headers.

libcrypto from either LibreSSL or OpenSSL may also be used, but OpenSSH may be built without it supporting a subset of crypto algorithms.

zlib is optional; without it transport compression is not supported.

FIDO security token support needs libfido2 and its dependencies. Also, certain platforms and build-time options may require additional dependencies; see README.platform for details.

Building a release

Releases include a pre-built copy of the configure script and may be built using:

tar zxvf openssh-X.YpZ.tar.gz
cd openssh
./configure # [options]
make && make tests

See the Build-time Customisation section below for configure options. If you plan on installing OpenSSH to your system, then you will usually want to specify destination paths.

Building from git

If building from git, you'll need autoconf installed to build the configure script. The following commands will check out and build portable OpenSSH from git:

git clone https://github.com/openssh/openssh-portable # or https://anongit.mindrot.org/openssh.git
cd openssh-portable
autoreconf
./configure
make && make tests

Build-time Customisation

There are many build-time customisation options available. All Autoconf destination path flags (e.g. --prefix) are supported (and are usually required if you want to install OpenSSH).

For a full list of available flags, run configure --help but a few of the more frequently-used ones are described below. Some of these flags will require additional libraries and/or headers be installed.

Flag Meaning
--with-pam Enable PAM support. OpenPAM, Linux PAM and Solaris PAM are supported.
--with-libedit Enable libedit support for sftp.
--with-kerberos5 Enable Kerberos/GSSAPI support. Both Heimdal and MIT Kerberos implementations are supported.
--with-selinux Enable SELinux support.
--with-security-key-builtin Include built-in support for U2F/FIDO2 security keys. This requires libfido2 be installed.

Development

Portable OpenSSH development is discussed on the openssh-unix-dev mailing list (archive mirror). Bugs and feature requests are tracked on our Bugzilla.

Reporting bugs

Non-security bugs may be reported to the developers via Bugzilla or via the mailing list above. Security bugs should be reported to openssh@openssh.com.