en Copyright 2025 Java http://opengrok.net:8080/history/src/crypto/openssh/contrib/ssh-copy-id#3d9fd9fcb432750f3716b28f6ccb0104cd9d351a openssh: Update to 9.9p1Highlights from the release notes are reproduced below. Bug fixes andimprovements that were previously merged into FreeBSD have been elided.See the upstream release notes for full details of the 9.9p1 release(https://www.openssh.com/releasenotes.html).---Future deprecation notice=========================OpenSSH plans to remove support for the DSA signature algorithm inearly 2025.Potentially-incompatible changes-------------------------------- * ssh(1): remove support for pre-authentication compression. * ssh(1), sshd(8): processing of the arguments to the "Match" configuration directive now follows more shell-like rules for quoted strings, including allowing nested quotes and \-escaped characters.New features------------ * ssh(1), sshd(8): add support for a new hybrid post-quantum key exchange based on the FIPS 203 Module-Lattice Key Enapsulation mechanism (ML-KEM) combined with X25519 ECDH as described by https://datatracker.ietf.org/doc/html/draft-kampanakis-curdle-ssh-pq-ke-03 This algorithm "mlkem768x25519-sha256" is available by default. * ssh(1), sshd(8), ssh-agent(1): prevent private keys from being included in core dump files for most of their lifespans. This is in addition to pre-existing controls in ssh-agent(1) and sshd(8) that prevented coredumps. This feature is supported on OpenBSD, Linux and FreeBSD. * All: convert key handling to use the libcrypto EVP_PKEY API, with the exception of DSA.Bugfixes-------- * sshd(8): do not apply authorized_keys options when signature verification fails. Prevents more restrictive key options being incorrectly applied to subsequent keys in authorized_keys. bz3733 * ssh-keygen(1): include pathname in some of ssh-keygen's passphrase prompts. Helps the user know what's going on when ssh-keygen is invoked via other tools. Requested in GHPR503 * ssh(1), ssh-add(1): make parsing user@host consistently look for the last '@' in the string rather than the first. This makes it possible to more consistently use usernames that contain '@' characters. * ssh(1), sshd(8): be more strict in parsing key type names. Only allow short names (e.g "rsa") in user-interface code and require full SSH protocol names (e.g. "ssh-rsa") everywhere else. bz3725 * ssh-keygen(1): clarify that ed25519 is the default key type generated and clarify that rsa-sha2-512 is the default signature scheme when RSA is in use. GHPR505---Reviewed by: jlduran (build infrastructure)Reviewed by: cy (build infrastructure)Sponsored by: The FreeBSD FoundationDifferential Revision: https://reviews.freebsd.org/D48947 List of files: /src/crypto/openssh/contrib/ssh-copy-id Wed, 19 Feb 2025 19:08:59 +0000 Ed Maste <emaste@FreeBSD.org> http://opengrok.net:8080/history/src/crypto/openssh/contrib/ssh-copy-id#535af610a4fdace6d50960c0ad9be0597eea7a1b ssh: Update to OpenSSH 9.4p1Excerpts from the release notes: * ssh-agent(1): PKCS#11 modules must now be specified by their full paths. Previously dlopen(3) could search for them in system library directories. * ssh(1): allow forwarding Unix Domain sockets via ssh -W. * ssh(1): add support for configuration tags to ssh(1). This adds a ssh_config(5) "Tag" directive and corresponding "Match tag" predicate that may be used to select blocks of configuration similar to the pf.conf(5) keywords of the same name. * ssh(1): add a "match localnetwork" predicate. This allows matching on the addresses of available network interfaces and may be used to vary the effective client configuration based on network location. * ssh-agent(1): improve isolation between loaded PKCS#11 modules by running separate ssh-pkcs11-helpers for each loaded provider. * ssh-agent(1), ssh(1): improve defences against invalid PKCS#11 modules being loaded by checking that the requested module contains the required symbol before loading it. * ssh(1): don't incorrectly disable hostname canonicalization when CanonicalizeHostname=yes and ProxyJump was expicitly set to "none". bz3567Full release notes at https://www.openssh.com/txt/release-9.4Relnotes: YesSponsored by: The FreeBSD Foundation List of files: /src/crypto/openssh/contrib/ssh-copy-id Fri, 11 Aug 2023 03:10:18 +0000 Ed Maste <emaste@FreeBSD.org> http://opengrok.net:8080/history/src/crypto/openssh/contrib/ssh-copy-id#19261079b74319502c6ffa1249920079f0f69a72 openssh: update to OpenSSH v8.7p1Some notable changes, from upstream's release notes:- sshd(8): Remove support for obsolete "host/port" syntax.- ssh(1): When prompting whether to record a new host key, accept the key fingerprint as a synonym for "yes".- ssh-keygen(1): when acting as a CA and signing certificates with an RSA key, default to using the rsa-sha2-512 signature algorithm.- ssh(1), sshd(8), ssh-keygen(1): this release removes the "ssh-rsa" (RSA/SHA1) algorithm from those accepted for certificate signatures.- ssh-sk-helper(8): this is a new binary. It is used by the FIDO/U2F support to provide address-space isolation for token middleware libraries (including the internal one).- ssh(1): this release enables UpdateHostkeys by default subject to some conservative preconditions.- scp(1): this release changes the behaviour of remote to remote copies (e.g. "scp host-a:/path host-b:") to transfer through the local host by default.- scp(1): experimental support for transfers using the SFTP protocol as a replacement for the venerable SCP/RCP protocol that it has traditionally used.Additional integration work is needed to support FIDO/U2F in the basesystem.Deprecation Notice------------------OpenSSH will disable the ssh-rsa signature scheme by default in thenext release.Reviewed by: impMFC after: 1 monthRelnotes: YesSponsored by: The FreeBSD FoundationDifferential Revision: https://reviews.freebsd.org/D29985 List of files: /src/crypto/openssh/contrib/ssh-copy-id Wed, 08 Sep 2021 01:05:51 +0000 Ed Maste <emaste@FreeBSD.org> http://opengrok.net:8080/history/src/crypto/openssh/contrib/ssh-copy-id#3d9fd9fcb432750f3716b28f6ccb0104cd9d351a openssh: Update to 9.9p1Highlights from the release notes are reproduced below. Bug fixes andimprovements that were previously merged into FreeBSD have been elided.See the upstream release notes for full details of the 9.9p1 release(https://www.openssh.com/releasenotes.html).---Future deprecation notice=========================OpenSSH plans to remove support for the DSA signature algorithm inearly 2025.Potentially-incompatible changes-------------------------------- * ssh(1): remove support for pre-authentication compression. * ssh(1), sshd(8): processing of the arguments to the "Match" configuration directive now follows more shell-like rules for quoted strings, including allowing nested quotes and \-escaped characters.New features------------ * ssh(1), sshd(8): add support for a new hybrid post-quantum key exchange based on the FIPS 203 Module-Lattice Key Enapsulation mechanism (ML-KEM) combined with X25519 ECDH as described by https://datatracker.ietf.org/doc/html/draft-kampanakis-curdle-ssh-pq-ke-03 This algorithm "mlkem768x25519-sha256" is available by default. * ssh(1), sshd(8), ssh-agent(1): prevent private keys from being included in core dump files for most of their lifespans. This is in addition to pre-existing controls in ssh-agent(1) and sshd(8) that prevented coredumps. This feature is supported on OpenBSD, Linux and FreeBSD. * All: convert key handling to use the libcrypto EVP_PKEY API, with the exception of DSA.Bugfixes-------- * sshd(8): do not apply authorized_keys options when signature verification fails. Prevents more restrictive key options being incorrectly applied to subsequent keys in authorized_keys. bz3733 * ssh-keygen(1): include pathname in some of ssh-keygen's passphrase prompts. Helps the user know what's going on when ssh-keygen is invoked via other tools. Requested in GHPR503 * ssh(1), ssh-add(1): make parsing user@host consistently look for the last '@' in the string rather than the first. This makes it possible to more consistently use usernames that contain '@' characters. * ssh(1), sshd(8): be more strict in parsing key type names. Only allow short names (e.g "rsa") in user-interface code and require full SSH protocol names (e.g. "ssh-rsa") everywhere else. bz3725 * ssh-keygen(1): clarify that ed25519 is the default key type generated and clarify that rsa-sha2-512 is the default signature scheme when RSA is in use. GHPR505---Reviewed by: jlduran (build infrastructure)Reviewed by: cy (build infrastructure)Sponsored by: The FreeBSD FoundationDifferential Revision: https://reviews.freebsd.org/D48947 List of files: /src/crypto/openssh/contrib/ssh-copy-id Wed, 19 Feb 2025 19:08:59 +0000 Ed Maste <emaste@FreeBSD.org> http://opengrok.net:8080/history/src/crypto/openssh/contrib/ssh-copy-id#535af610a4fdace6d50960c0ad9be0597eea7a1b ssh: Update to OpenSSH 9.4p1Excerpts from the release notes: * ssh-agent(1): PKCS#11 modules must now be specified by their full paths. Previously dlopen(3) could search for them in system library directories. * ssh(1): allow forwarding Unix Domain sockets via ssh -W. * ssh(1): add support for configuration tags to ssh(1). This adds a ssh_config(5) "Tag" directive and corresponding "Match tag" predicate that may be used to select blocks of configuration similar to the pf.conf(5) keywords of the same name. * ssh(1): add a "match localnetwork" predicate. This allows matching on the addresses of available network interfaces and may be used to vary the effective client configuration based on network location. * ssh-agent(1): improve isolation between loaded PKCS#11 modules by running separate ssh-pkcs11-helpers for each loaded provider. * ssh-agent(1), ssh(1): improve defences against invalid PKCS#11 modules being loaded by checking that the requested module contains the required symbol before loading it. * ssh(1): don't incorrectly disable hostname canonicalization when CanonicalizeHostname=yes and ProxyJump was expicitly set to "none". bz3567Full release notes at https://www.openssh.com/txt/release-9.4Relnotes: YesSponsored by: The FreeBSD Foundation List of files: /src/crypto/openssh/contrib/ssh-copy-id Fri, 11 Aug 2023 03:10:18 +0000 Ed Maste <emaste@FreeBSD.org> http://opengrok.net:8080/history/src/crypto/openssh/contrib/ssh-copy-id#19261079b74319502c6ffa1249920079f0f69a72 openssh: update to OpenSSH v8.7p1Some notable changes, from upstream's release notes:- sshd(8): Remove support for obsolete "host/port" syntax.- ssh(1): When prompting whether to record a new host key, accept the key fingerprint as a synonym for "yes".- ssh-keygen(1): when acting as a CA and signing certificates with an RSA key, default to using the rsa-sha2-512 signature algorithm.- ssh(1), sshd(8), ssh-keygen(1): this release removes the "ssh-rsa" (RSA/SHA1) algorithm from those accepted for certificate signatures.- ssh-sk-helper(8): this is a new binary. It is used by the FIDO/U2F support to provide address-space isolation for token middleware libraries (including the internal one).- ssh(1): this release enables UpdateHostkeys by default subject to some conservative preconditions.- scp(1): this release changes the behaviour of remote to remote copies (e.g. "scp host-a:/path host-b:") to transfer through the local host by default.- scp(1): experimental support for transfers using the SFTP protocol as a replacement for the venerable SCP/RCP protocol that it has traditionally used.Additional integration work is needed to support FIDO/U2F in the basesystem.Deprecation Notice------------------OpenSSH will disable the ssh-rsa signature scheme by default in thenext release.Reviewed by: impMFC after: 1 monthRelnotes: YesSponsored by: The FreeBSD FoundationDifferential Revision: https://reviews.freebsd.org/D29985 List of files: /src/crypto/openssh/contrib/ssh-copy-id Wed, 08 Sep 2021 01:05:51 +0000 Ed Maste <emaste@FreeBSD.org> http://opengrok.net:8080/history/src/crypto/openssh/contrib/ssh-copy-id#4f52dfbb8d6c4d446500c5b097e3806ec219fbd4 Upgrade to OpenSSH 7.6p1. This will be followed shortly by 7.7p1.This completely removes client-side support for the SSH 1 protocol,which was already disabled in 12 but is still enabled in 11. For thatreason, we will not be able to merge 7.6p1 or newer back to 11. List of files: /src/crypto/openssh/contrib/ssh-copy-id Tue, 08 May 2018 23:13:11 +0000 Dag-Erling Smørgrav <des@FreeBSD.org> http://opengrok.net:8080/history/src/crypto/openssh/contrib/ssh-copy-id#076ad2f836d5f49dc1375f1677335a48fe0d4b82 Upgrade to OpenSSH 7.3p1. List of files: /src/crypto/openssh/contrib/ssh-copy-id Thu, 02 Mar 2017 00:11:32 +0000 Dag-Erling Smørgrav <des@FreeBSD.org> http://opengrok.net:8080/history/src/crypto/openssh/contrib/ssh-copy-id#538354481ef7dbcd76ebc7334512a9d60994b84e MFHSponsored by: The FreeBSD Foundation List of files: /src/crypto/openssh/contrib/ssh-copy-id Mon, 14 Mar 2016 18:54:29 +0000 Glen Barber <gjb@FreeBSD.org> http://opengrok.net:8080/history/src/crypto/openssh/contrib/ssh-copy-id#acc1a9ef8333c798c210fa94be6af4d5fe2dd794 Upgrade to OpenSSH 7.2p2. List of files: /src/crypto/openssh/contrib/ssh-copy-id Fri, 11 Mar 2016 00:15:29 +0000 Dag-Erling Smørgrav <des@FreeBSD.org> http://opengrok.net:8080/history/src/crypto/openssh/contrib/ssh-copy-id#064bee341e6c590dedc1d33eb6025e1f446f33a6 MFC @ r256071This is just prior to the bhyve_npt_pmap import so will allowjust the change to be merged for easier debug. List of files: /src/crypto/openssh/contrib/ssh-copy-id Wed, 30 Oct 2013 00:05:02 +0000 Peter Grehan <grehan@FreeBSD.org> http://opengrok.net:8080/history/src/crypto/openssh/contrib/ssh-copy-id#0bfd163f522701b486e066fa2e56624c02f5081a Merge head r233826 through r256722. List of files: /src/crypto/openssh/contrib/ssh-copy-id Fri, 18 Oct 2013 09:32:02 +0000 Gleb Smirnoff <glebius@FreeBSD.org> http://opengrok.net:8080/history/src/crypto/openssh/contrib/ssh-copy-id#3caf0790a80c2e10c82a3a07719cddb2065c65d1 Merge head@256284 List of files: /src/crypto/openssh/contrib/ssh-copy-id Sun, 13 Oct 2013 02:35:19 +0000 Simon J. Gerraty <sjg@FreeBSD.org> http://opengrok.net:8080/history/src/crypto/openssh/contrib/ssh-copy-id#1ccca3b5e8e31290b0932dbead89e6e31af184c7 IFC @256277Approved by: ken (mentor) List of files: /src/crypto/openssh/contrib/ssh-copy-id Thu, 10 Oct 2013 21:46:43 +0000 Alan Somers <asomers@FreeBSD.org> http://opengrok.net:8080/history/src/crypto/openssh/contrib/ssh-copy-id#27650413eae21a4cb2b48f13148125eb94b40ea9 MFC - tracking update. List of files: /src/crypto/openssh/contrib/ssh-copy-id Wed, 02 Oct 2013 18:07:43 +0000 Mark Murray <markm@FreeBSD.org> http://opengrok.net:8080/history/src/crypto/openssh/contrib/ssh-copy-id#ce3adf4362fcca6a43e500b2531f0038adbfbd21 Pull in all the OpenSSH bits that we'd previously left out because wedidn't use them. This will make future merges from the vendor tree mucheasier.Approved by: re (gjb) List of files: /src/crypto/openssh/contrib/ssh-copy-id Sat, 21 Sep 2013 22:24:10 +0000 Dag-Erling Smørgrav <des@FreeBSD.org> http://opengrok.net:8080/history/src/crypto/openssh/contrib/ssh-copy-id#4f52dfbb8d6c4d446500c5b097e3806ec219fbd4 Upgrade to OpenSSH 7.6p1. This will be followed shortly by 7.7p1.This completely removes client-side support for the SSH 1 protocol,which was already disabled in 12 but is still enabled in 11. For thatreason, we will not be able to merge 7.6p1 or newer back to 11. List of files: /src/crypto/openssh/contrib/ssh-copy-id Tue, 08 May 2018 23:13:11 +0000 Dag-Erling Smørgrav <des@FreeBSD.org> http://opengrok.net:8080/history/src/crypto/openssh/contrib/ssh-copy-id#076ad2f836d5f49dc1375f1677335a48fe0d4b82 Upgrade to OpenSSH 7.3p1. List of files: /src/crypto/openssh/contrib/ssh-copy-id Thu, 02 Mar 2017 00:11:32 +0000 Dag-Erling Smørgrav <des@FreeBSD.org> http://opengrok.net:8080/history/src/crypto/openssh/contrib/ssh-copy-id#538354481ef7dbcd76ebc7334512a9d60994b84e MFHSponsored by: The FreeBSD Foundation List of files: /src/crypto/openssh/contrib/ssh-copy-id Mon, 14 Mar 2016 18:54:29 +0000 Glen Barber <gjb@FreeBSD.org> http://opengrok.net:8080/history/src/crypto/openssh/contrib/ssh-copy-id#acc1a9ef8333c798c210fa94be6af4d5fe2dd794 Upgrade to OpenSSH 7.2p2. List of files: /src/crypto/openssh/contrib/ssh-copy-id Fri, 11 Mar 2016 00:15:29 +0000 Dag-Erling Smørgrav <des@FreeBSD.org>