OpenSSH 10.1 has been released, an open implementation of the client and server for working with SSH 2.0 and SFTP protocols. <\/p>\n
Key Changes: <\/p>\n
\n
A security issue has been fixed that allowed an attacker to inject shell commands through manipulation of special characters in the username or URI, which could be executed when running a command specified via the 'ProxyCommand' setting and containing the substitution '%u'. This issue affects only systems that allow the substitution of usernames or URIs obtained from untrusted sources when launching ssh.\n
To block such attacks, the use of control characters in usernames specified when launching from the command line or substituted in settings via %-sequences is prohibited. The use of the null character ('\\0') in ssh:\/\/ URIs is also forbidden. An exception is made only for names specified in the configuration file (it is assumed that this configuration file is trusted). <\/p>\n
The ssh and ssh-agent utilities have added support for ed25519 keys stored in PKCS#11 tokens.\n
A new setting, RefuseConnection, has been added to the ssh_config file, which terminates the process with an error message without attempting to establish a connection in the active section when processed. Match host foo RefuseConnection 'host foo is no longer in use, connect to host bar'\n
Signal handlers for SIGINFO have been added to ssh and sshd to log session and active channel information.\n
In sshd, when user authentication via certificate is denied, information is logged not only regarding the denial reason but also comprehensive information for identifying the problematic certificate.\n
In sshd, a check for the X11 display number has been added to verify against the offset specified in the X11DisplayOffset directive.\n
Performance measurement capabilities have been added to the unit tests, activated by running 'make UNITTEST_BENCHMARK=yes' in OpenBSD or 'make unit-bench' in other systems. <\/ul>\n
Changes that may potentially break backward compatibility: <\/p>\n
\n
In ssh, a warning has been added when using a key agreement algorithm that is not resistant to brute force attacks on quantum computers while establishing a connection. The warning was included due to the risk of future attacks using previously saved traffic dumps. To disable the warning, the WarnWeakCrypto option has been added to ssh_config. Match host unsafe.example.com WarnWeakCrypto no\n
In ssh and sshd, the handling of DSCP (IPQoS) parameters has been significantly changed. For interactive traffic, the EF (Expedited Forwarding) class is now set by default for higher priority handling in wireless networks. For non-interactive traffic, the class is set to the default used by the operating system. The traffic class can be changed using the IPQoS settings in ssh_config and sshd_config. The ToS (type-of-service) parameters for IPv4 in the IPQoS directive have been deprecated (DSCP has replaced ToS).\n
In ssh-add, when adding a certificate to the ssh-agent, the expiration time of the certificate is set to 5 minutes longer than the certificate's validity period (for automatic removal of expired certificates). To disable this behavior in ssh-add, the '-N' option has been added.\n
Support for XMSS keys has been removed, which was marked as experimental and was never enabled by default.\n
Unix sockets created by the ssh-agent and sshd processes have been moved from the \/tmp directory to ~\/.ssh\/agent, ensuring that access to these sockets is impossible from isolated processes that have restricted filesystem access but open access to \/tmp. <\/ul>\n