The release of OpenSSH 8.8 has been published, the open-source implementation of the client and server for SSH 2.0 and SFTP protocols. This release is notable for disabling the use of RSA key-based digital signatures with the SHA-1 hash ('ssh-rsa') by default.
The discontinuation of support for 'ssh-rsa' signatures is due to the increasing effectiveness of collision attacks with a specified prefix (the cost of finding a collision is estimated at around $50,000). To check the use of ssh-rsa in your systems, you can try connecting via ssh with the option '-oHostKeyAlgorithms=-ssh-rsa'. Support for RSA signatures with SHA-256 and SHA-512 hashes (rsa-sha2-256/512), which have been supported since OpenSSH 7.2, remains unchanged.
In most cases, the discontinuation of support for 'ssh-rsa' will not require users to take any manual actions, as OpenSSH previously had the UpdateHostKeys setting enabled by default, which automatically transitioned clients to more secure algorithms. The protocol extension 'hostkeys@openssh.com' is used for migration, allowing server after authentication to inform the client of all available host keys. In the case of connecting to hosts with very old versions of OpenSSH on the client side, it is possible to selectively restore the ability to use 'ssh-rsa' signatures by adding to ~/ .ssh/config: Host old_host_name HostkeyAlgorithms +ssh-rsa PubkeyAcceptedAlgorithms +ssh-rsa
The new version also addresses a security issue caused by incorrect initialization of the user group in sshd when executing commands specified in the AuthorizedKeysCommand and AuthorizedPrincipalsCommand directives, starting from the release of OpenSSH 6.2. These directives are intended to execute commands under a different user, but in practice, they inherited the group list used when launching sshd. Potentially, this behavior, given certain system settings, allowed the launched handler to gain additional privileges in the system.
The note accompanying the new release also includes a warning about the intention to default the scp utility to use SFTP instead of the outdated SCP/RCP protocol. SFTP employs more predictable methods for handling names and does not use shell glob pattern processing in file names on the other host, which creates security issues. In particular, with SCP and RCP server the decision is made about which files and directories to send to the client, while the client only checks the correctness of the object names returned; this allows the server to pass different file names than those requested in the absence of proper checks on the client side. The SFTP protocol is free from these issues but does not support the expansion of special paths like "~/." To address this difference, a new SFTP protocol extension for expanding paths ~/ and ~user/ was proposed in the previous OpenSSH release.
Source: opennet.ru
