openssh (1:10.1p1-1) unstable; urgency=medium

  OpenSSH 10.1p1 includes a number of changes that may affect existing
  configurations:

   * ssh(1): add a warning when the connection negotiates a non-post quantum
     key agreement algorithm.

     This warning has been added due to the risk of "store now, decrypt
     later" attacks. More details at https://openssh.com/pq.html

     This warning may be controlled via a new WarnWeakCrypto ssh_config
     option, defaulting to on. This option is likely to control additional
     weak crypto warnings in the future.

   * ssh(1), sshd(8): major changes to handling of DSCP marking/IPQoS

     In both client and server the default DSCP (a.k.a IPQoS) values were
     revised and the way these values are used during runtime has changed.

     Interactive traffic is now assigned to the EF (Expedited Forwarding)
     class by default. This provides more appropriate packet prioritisation
     information for the intermediate network, such as wireless media (cf.
     RFC 8325). Non-interactive traffic will now use the operating system
     default DSCP marking. Both the interactive and non-interactive DSCP
     values may be overridden via the IPQoS keyword, described in
     ssh_config(5) and sshd_config(5).

     The appropriate DSCP marking is now automatically selected and updated
     as needed over the course of a connection's lifetime. ssh(1) and
     sshd(8) will switch between the interactive and non-interactive IPQoS
     values depending on the type of SSH channels open at the time. For
     example, if an sftp session is using the connection alongside a shell
     session, then the non- interactive value will be used for the duration
     of the sftp. A connection which contains only interactive sessions is
     marked EF.

   * ssh(1), sshd(8): deprecate support for IPv4 type-of-service (ToS)
     keywords in the IPQoS configuration directive.

     Type of Service (ToS) was deprecated in the late nineties and replaced
     with the Differentiated Services architecture, which has significant
     advantages for operators because it offers more granularity.

     OpenSSH switched its default IPQoS from ToS to DSCP values in 2018
     (openssh-7.7).

     IPQoS configurations with 'lowdelay', 'reliability', or 'throughput'
     will be ignored and will instead use the system default QoS settings.
     Additionally, a debug message will be logged about the deprecation with
     a suggestion to use DSCP QoS instead.

   * ssh-add(1): when adding certificates to an agent, set the expiry to the
     certificate expiry time plus a short (5 min) grace period.

     This will cause the agent to automatically remove certificates shortly
     after they expire. A new ssh-add -N option disables this behaviour.

   * All: remove experimental support for XMSS keys. This was never enabled
     by default. We expect to implement a new post-quantum signature scheme
     in the near future.

   * ssh-agent(1), sshd(8): move agent listener sockets from /tmp to under
     ~/.ssh/agent for both ssh-agent(1) and forwarded sockets in sshd(8).

     This ensures processes that have restricted filesystem access that
     includes /tmp do not ambiently have the ability to use keys in an
     agent.

     Moving the default directory has the consequence that the OS will no
     longer clean up stale agent sockets, so ssh-agent now gains this
     ability.

     To support $HOME on NFS, the socket path includes a truncated hash of
     the hostname. ssh-agent will, by default, only clean up sockets from
     the same hostname.

     ssh-agent(1) gains some new flags: -U suppresses the automatic cleanup
     of stale sockets when it starts. -u forces a cleanup without keeping a
     running agent, -uu forces a cleanup that ignores the hostname. -T makes
     ssh-agent put the socket back in /tmp.

 -- Colin Watson <cjwatson@debian.org>  Tue, 07 Oct 2025 22:07:19 +0100

openssh (1:10.0p1-1) unstable; urgency=medium

  OpenSSH 10.0p1 includes a number of changes that may affect existing
  configurations:

   * This release removes support for the weak DSA signature algorithm,
     completing the deprecation process that began in 2015 (when DSA was
     disabled by default) and repeatedly warned over the last 12 months.

   * scp(1), sftp(1): pass "ControlMaster no" to ssh when invoked by scp &
     sftp. This disables implicit session creation by these tools when
     ControlMaster was set to yes/auto by configuration, which some users
     found surprising. This change will not prevent scp/sftp from using an
     existing multiplexing session if one had already been created.

   * sshd(8): this release disables finite field (a.k.a modp) Diffie-Hellman
     key exchange in sshd by default. Specifically, this removes the
     "diffie-hellman-group*" and "diffie-hellman-group-exchange-*" methods
     from the default KEXAlgorithms list. The client is unchanged and
     continues to support these methods by default.

   * sshd(8): this release removes the implicit fallback to compiled-in
     groups for Diffie-Hellman Group Exchange KEX when the moduli file
     exists but does not contain moduli within the client-requested range.
     The fallback behaviour remains for the case where the moduli file does
     not exist at all. This allows administrators more explicit control over
     which DH groups will be selected, but can lead to connection failures
     if the moduli file is edited incorrectly.

 -- Colin Watson <cjwatson@debian.org>  Fri, 11 Apr 2025 11:16:19 +0100

openssh (1:9.9p1-1) unstable; urgency=medium

  OpenSSH 9.9p1 includes a number of changes that may affect existing
  configurations:

   * ssh(1): remove support for pre-authentication compression.  OpenSSH has
     only supported post-authentication compression in the server for some
     years. Compression before authentication significantly increases the
     attack surface of SSH servers and risks creating oracles that reveal
     information about information sent during authentication.

   * ssh(1), sshd(8): processing of the arguments to the "Match"
     configuration directive now follows more shell-like rules for quoted
     strings, including allowing nested quotes and \-escaped characters. If
     configurations contained workarounds for the previous simplistic quote
     handling then they may need to be adjusted. If this is the case, it's
     most likely to be in the arguments to a "Match exec" condition. In this
     case, moving the command to be evaluated from the Match line to an
     external shell script is the easiest way to preserve compatibility with
     both the old and new versions.

 -- Colin Watson <cjwatson@debian.org>  Mon, 23 Sep 2024 21:09:59 -0700

openssh (1:9.8p1-5) unstable; urgency=medium

  Future Debian releases will remove GSS-API authentication and key exchange
  support from openssh-client and openssh-server; this adds
  pre-authentication attack surface and should only be used where
  specifically needed.  Users of GSS-API authentication or key exchange
  should install the new openssh-client-gssapi or openssh-server-gssapi
  package now; these currently just depend on openssh-client and
  openssh-server respectively, but this will change in the future.

 -- Colin Watson <cjwatson@debian.org>  Thu, 29 Aug 2024 12:13:32 +0100

openssh (1:9.8p1-1) unstable; urgency=medium

  OpenSSH 9.8p1 includes a number of changes that may affect existing
  configurations:

   * DSA keys, as specified in the SSH protocol, are inherently weak: they
     are limited to 160-bit private keys and the SHA-1 digest.  The SSH
     implementation provided by the openssh-client and openssh-server
     packages has disabled support for DSA keys by default since OpenSSH
     7.0p1 in 2015, released with Debian 9 ("stretch"), although it could
     still be enabled using the HostKeyAlgorithms and
     PubkeyAcceptedAlgorithms configuration options for host and user keys
     respectively.

     The only remaining uses of DSA at this point should be connecting to
     some very old devices.  For all other purposes, the other key types
     supported by OpenSSH (RSA, ECDSA, and Ed25519) are superior.

     As of OpenSSH 9.8p1, DSA keys are no longer supported even with the
     above configuration options.  If you have a device that you can only
     connect to using DSA, then you can use the ssh1 command provided by the
     openssh-client-ssh1 package to do so.

     In the unlikely event that you are still using DSA keys to connect to a
     Debian server (if you are unsure, you can check by adding the -v option
     to the ssh command line you use to connect to that server and looking
     for the "Server accepts key:" line), then you must generate replacement
     keys before upgrading.

   * sshd(8): the server will now block client addresses that repeatedly
     fail authentication, repeatedly connect without ever completing
     authentication or that crash the server.  Operators of servers that
     accept connections from many users, or servers that accept connections
     from addresses behind NAT or proxies may need to consider these
     settings.

   * sshd(8): several log messages have changed.  In particular, some log
     messages will be tagged with as originating from a process named
     "sshd-session" rather than "sshd".

   * ssh-keyscan(1): this tool previously emitted comment lines containing
     the hostname and SSH protocol banner to standard error.  This release
     now emits them to standard output, but adds a new "-q" flag to silence
     them altogether.

   * sshd(8): sshd will no longer use argv[0] as the PAM service name.  A
     new "PAMServiceName" sshd_config(5) directive allows selecting the
     service name at runtime.  This defaults to "sshd".

 -- Colin Watson <cjwatson@debian.org>  Wed, 31 Jul 2024 17:16:04 +0100

openssh (1:9.7p1-6) unstable; urgency=medium

  Debian's PAM configuration for OpenSSH no longer reads the
  ~/.pam_environment file.  The implementation of this in pam_env has a
  history of security problems and has been deprecated by the upstream
  Linux-PAM maintainers due to the possibility that "user supplied
  environment variables in the PAM environment could affect behavior of
  subsequent modules in the stack without the consent of the system
  administrator".

  Instead, environment variables need to be set somewhere that will be
  handled by the session process; for most users, this will be shell
  initialization files such as ~/.bash_profile or ~/.bashrc.

 -- Colin Watson <cjwatson@debian.org>  Tue, 25 Jun 2024 14:20:44 +0100

openssh (1:9.5p1-1) experimental; urgency=medium

  OpenSSH 9.5p1 includes a number of changes that may affect existing
  configurations:

   * ssh-keygen(1): generate Ed25519 keys by default. Ed25519 public keys
     are very convenient due to their small size. Ed25519 keys are specified
     in RFC 8709 and OpenSSH has supported them since version 6.5 (January
     2014).

   * sshd(8): the Subsystem directive now accurately preserves quoting of
     subsystem commands and arguments. This may change behaviour for exotic
     configurations, but the most common subsystem configuration
     (sftp-server) is unlikely to be affected.

 -- Colin Watson <cjwatson@debian.org>  Thu, 23 Nov 2023 17:38:07 +0000

openssh (1:9.4p1-1) unstable; urgency=medium

  OpenSSH 9.4p1 includes a number of changes that may affect existing
  configurations:

   * ssh-agent(1): PKCS#11 modules must now be specified by their full
     paths. Previously dlopen(3) could search for them in system library
     directories.

 -- Colin Watson <cjwatson@debian.org>  Sat, 02 Sep 2023 21:02:53 +0100

openssh (1:9.3p2-1) unstable; urgency=high

  OpenSSH 9.3p2 includes a number of changes that may affect existing
  configurations:

   * ssh-agent(8): the agent will now refuse requests to load PKCS#11
     modules issued by remote clients by default. A flag has been added to
     restore the previous behaviour "-Oallow-remote-pkcs11".

     Note that ssh-agent(8) depends on the SSH client to identify requests
     that are remote. The OpenSSH >=8.9 ssh(1) client does this, but
     forwarding access to an agent socket using other tools may circumvent
     this restriction.

 -- Colin Watson <cjwatson@debian.org>  Wed, 19 Jul 2023 21:57:53 +0100
