OpenSSH 8.4 release

After four months of development introduced Release of OpenSSH 8.4, the open-source implementation of the client and server for working with SSH 2.0 and SFTP protocols.

Key Changes:

• Security-related changes:
  • In ssh-agent, when using FIDO keys that are not created for SSH authentication (the key identifier does not start with "ssh:"), a check is now performed to ensure that the message will be signed using methods applied in the SSH protocol. This change will prevent ssh-agent from being redirected to remote hosts with FIDO keys, blocking the use of those keys for signing web authentication requests (the reverse case, where a browser could sign an SSH request, is already excluded by the use of the "ssh:" prefix in the key identifier).
  • In ssh-keygen, support for the credProtect extension described in the FIDO 2.1 specification has been added when generating resident keys, providing additional protection for keys through a mandatory PIN input request before executing any operation that could lead to extracting the resident key from the token.
• Changes that may break compatibility:
  • For FIDO/U2F support, it is recommended to use the libfido2 library version 1.5.0 or higher. Partial support for older releases is implemented, but in this case, features such as resident keys, PIN requests, and connecting multiple tokens will be unavailable.
  • In ssh-keygen, the format of the attestation information, optionally saved during the generation of a FIDO key, has been updated to include data for the authenticator that is necessary for verifying attestation digital signatures.
  • The API used for OpenSSH interaction with the middleware for accessing FIDO tokens has been changed.
  • When building the portable version of OpenSSH, automake is now required to generate the configure script and associated build files (if the build is performed from a released tar file with the code, re-generating configure is not necessary).
• Support for FIDO keys requiring confirmation via PIN has been added to ssh and ssh-keygen. An option "verify-required" has been added in ssh-keygen for generating keys with a PIN. If such keys are used, before performing the signature creation operation, the user will be prompted to confirm their actions by entering the PIN.
• In sshd, the authorized_keys setting has implemented the "verify-required" option, which requires using verification methods to confirm the presence of a user during token operations. The FIDO standard provides several options for such verification, but currently, OpenSSH only supports PIN-based verification.
• Support for verifying digital signatures compliant with the FIDO Webauthn standard has been added in sshd and ssh-keygen, allowing the use of FIDO keys in web browsers.
• In ssh, in the CertificateFile settings,
  ControlPath, IdentityAgent, IdentityFile, LocalForward, and
  RemoteForward, substitution of values from environment variables specified in the "${ENV}" format is allowed.
• In ssh and ssh-agent, support for the $SSH_ASKPASS_REQUIRE environment variable has been added, which can be used to enable or disable the calling of ssh-askpass.
• In ssh, the ssh_config directive AddKeysToAgent now includes the ability to limit the key's validity period. After the specified limit is reached, keys are automatically removed from the ssh-agent.
• In scp and sftp, the "-A" flag now explicitly allows agent forwarding in scp and sftp (by default, forwarding is disabled).
• In ssh settings, support for the substitution of ‘%k’, which defines the host key name, has been added. This feature can be used to distribute keys across separate files (for example, "UserKnownHostsFile ~/.ssh/known_hosts.d/%k").
• The operation "ssh-add -d -" is now allowed to read keys to be deleted from stdin.
• In sshd, logging of the start and end of the connection trimming process, regulated by the MaxStartups parameter, has been implemented.

OpenSSH developers also reminded about the imminent deprecation of algorithms using SHA-1 hashes due to increased efficiency of collision attacks with a defined prefix (the cost of finding a collision is estimated at approximately $45,000). In an upcoming release, the default option to use the ‘ssh-rsa’ public key digital signature algorithm will be disabled, which is mentioned in the original RFC for the SSH protocol and remains widely used in practice (to check the use of ssh-rsa in your systems, try connecting via ssh with the ‘-oHostKeyAlgorithms=-ssh-rsa’ option).

To smooth the transition to new algorithms, the next OpenSSH release will have the UpdateHostKeys setting enabled by default, which will automatically migrate clients to more secure algorithms. Recommended migration algorithms include rsa-sha2-256/512 based on RFC8332 RSA SHA-2 (supported since OpenSSH 7.2 and used by default), ssh-ed25519 (supported since OpenSSH 6.5), and ecdsa-sha2-nistp256/384/521 based on RFC5656 ECDSA (supported since OpenSSH 5.7).

Source: opennet.ru