Release of OpenSSH 10.0

The release of OpenSSH 10.0 has been published, an open implementation of client and server for working with SSH 2.0 and SFTP protocols. Main changes:

• Support for digital signatures based on the DSA algorithm has been removed, as their security level does not meet modern requirements. The costs of continuing to support the insecure DSA algorithm are not justified, and its removal will help stimulate the cessation of DSA support in other SSH implementations and cryptographic libraries. By default, the use of DSA keys has been discontinued since 2015.
• The separation of sshd into several individual executable files has continued. In OpenSSH 9.8, the sshd-session process was separated from sshd, handling tasks related to session management. In OpenSSH 10.0, the code responsible for authentication has been moved from sshd-session to a separate process called sshd-auth. The sshd-auth process allows for further isolation of the data related to authentication in the address space of a separate process, preventing access to this data in memory in case of attacks on the code used for processing connection stages prior to the completion of authentication. Additionally, this change slightly reduces memory consumption, as the authentication-related code is now present in memory only during the authentication process and is unloaded once the sshd-auth process finishes.
• In ssh, a hybrid key exchange algorithm "mlkem768x25519-sha256" is used by default, which is resistant to attacks on quantum computers and represents a combination of X25519 ECDH and the ML-KEM algorithm (CRYSTALS-Kyber), standardized by the National Institute of Standards and Technology (NIST). ML-KEM employs cryptographic methods based on solving lattice theory problems, whose solution time does not differ between classical and quantum computers.
• In ssh_config, the SetEnv and User directives have been enhanced with support for substitution of "%-token" and the expansion of environment variables.
• Support for the expression "Match version" has been added to ssh_config and sshd_config, allowing configurations to be applied based on the current version of OpenSSH. For instance, to bind to OpenSSH 10, one can specify "Match version OpenSSH_10.*".
• Support for expressions has been added to ssh_config:
  • "Match sessiontype" allows applying settings based on the type of requested session: "shell" for interactive sessions, "exec" for command execution, "subsystem" for sftp, and "none" for tunnels and traffic redirection.
  • "Match command" to bind actions to commands specified in the command line for execution via ssh.
  • 'Match tagged ""' and 'Match command ""' to bind to empty tags and execute ssh without specifying a command to be run.
• Mask usage is permitted in file paths specified in the AuthorizedKeysFile and AuthorizedPrincipalsFile directives in sshd_config.
• The ssh client now includes support for the "VersionAddendum" option to append arbitrary text to the version number string (previously this option was only available for server sshd).
• In the scp and sftp utilities, the "ControlMaster no" setting has been enabled to prohibit the use of existing connections when reconnecting to a host.
• In sshd, support for the implementation of the Diffie-Hellman algorithm in a finite field is disabled by default, resulting in the removal of "diffie-hellman-group*" and "diffie-hellman-group-exchange-*" methods from the KEXAlgorithms list. Compared to elliptic curve-based Diffie-Hellman, the remote implementation is slower and requires additional computational resources at the same level of security.
• In ssh, when selecting a cipher for the connection, the AES-GCM mode is now preferred over AES-CTR. The default priority list for cipher selection is set to: Chacha20/Poly1305, AES-GCM (128/256), and AES-CTR (128/192/256).
• In ssh-agent, all loaded keys are now removed upon receiving the SIGUSR1 signal.
• In ssh-keygen, support has been added for FIDO tokens that do not return attestation data, such as WinHello.
• In ssh-agent, the "-Owebsafe-allow=…" option has been added to override the FIDO application whitelist.
• An experimental tool regress/misc/ssh-verify-attestation has been implemented for verifying FIDO attestation data, optionally generated by ssh-keygen when registering FIDO keys.
• In ssh-keygen, it is now permitted to use "-" instead of a filename.
• In ssh-agent and the portable version of OpenSSH, support has been added for activation via a systemd-style socket, implemented using the LISTEN_PID/LISTEN_FDS mechanism.
• In the portable version:
  • Support for the AWS-LC cryptographic library (AWS libcrypto) has been implemented.
  • In sshd, support for wtmpdb, an analogue of wtmp, that is not affected by the year 2038 issue, has been added.
  • The sshd option "--with-linux-memlock-onfault" has been added to lock sshd in memory (preventing it from being swapped out).
  • The option "--with-security-key-standalone" has been added to build the standalone library sk-libfido2.
  • Build settings for RHEL 6 have been removed from the RPM package specification.
• Security-related changes in sshd: the DisableForwarding directive did not properly prohibit forwarding of the X11 protocol and ssh-agent calls. X11 forwarding is disabled by default on the server side, while ssh-agent forwarding is disabled on the client side.

Source: opennet.ru