{"id":123456,"date":"2025-04-10T03:05:07","date_gmt":"2025-04-10T01:05:07","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/reliz-openssh-10-0"},"modified":"2025-04-10T03:05:07","modified_gmt":"2025-04-10T01:05:07","slug":"reliz-openssh-10-0","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/reliz-openssh-10-0","title":{"rendered":"Release of OpenSSH 10.0","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
The release of OpenSSH 10.0 has been published, an open implementation of client and server for working with SSH 2.0 and SFTP protocols. Main changes: <\/p>\n
\n
Support for digital signatures based on the DSA algorithm has been removed, as their security level does not meet modern requirements. The costs of continuing to support the insecure DSA algorithm are not justified, and its removal will help stimulate the cessation of DSA support in other SSH implementations and cryptographic libraries. By default, the use of DSA keys has been discontinued since 2015.\n
The separation of sshd into several individual executable files has continued. In OpenSSH 9.8, the sshd-session process was separated from sshd, handling tasks related to session management. In OpenSSH 10.0, the code responsible for authentication has been moved from sshd-session to a separate process called sshd-auth. The sshd-auth process allows for further isolation of the data related to authentication in the address space of a separate process, preventing access to this data in memory in case of attacks on the code used for processing connection stages prior to the completion of authentication. Additionally, this change slightly reduces memory consumption, as the authentication-related code is now present in memory only during the authentication process and is unloaded once the sshd-auth process finishes.\n
SSH by default employs a hybrid key exchange algorithm «mlkem768x25519-sha256», resistant to cracking by quantum computers, and it consists of a combination of X25519 ECDH and the ML-KEM (CRYSTALS-Kyber) algorithm, standardized by the National Institute of Standards and Technology (NIST). ML-KEM utilizes cryptographic methods based on solving lattice theory problems, which take the same time on both classical and quantum computers.\n
The ssh_config directives SetEnv and User have been updated to support substitution «%-token» and environment variable expansion.\n
Support for the «Match version» expression has been added to ssh_config and sshd_config, allowing settings to be applied based on the available version of OpenSSH; for example, to bind to OpenSSH 10, you can specify «Match version OpenSSH_10.*».\n
Support for expressions has been added to ssh_config:\n
\n
«Match sessiontype» allows settings to be applied based on the requested session type: «shell» for interactive sessions, «exec» for command execution, «subsystem» for SFTP, and «none» for tunnels and traffic redirection.\n
«Match command» for binding actions to commands specified in the command line for execution via SSH.\n
‘Match tagged «»‘ and ‘Match command «»‘ for binding to empty tags and executing SSH without specifying a command. <\/ul>\n
Mask usage is permitted in file paths specified in the AuthorizedKeysFile and AuthorizedPrincipalsFile directives in sshd_config.\n
Support for the «VersionAddendum» option has been added to the SSH client to append arbitrary text to the version number string (previously, this option was only available for). server<\/a> sshd).\n