openssh (1:10.4p1-4ubuntu2) stonking; urgency=medium

  * d/rules: only act on files from bin:openssh-tests if it's being
    built (LP: #2165026)

 -- Andreas Hasenack <andreas.hasenack@canonical.com>  Tue, 25 Aug 2026 09:19:48 -0300

openssh (1:10.4p1-4ubuntu1) stonking; urgency=medium

  * Merge with Debian unstable (LP: #2164221). Remaining changes:
    - debian/rules: modify dh_installsystemd invocations for
      socket-activated sshd
    - debian/README.Debian: document systemd socket activation.
    - debian/.gitignore: drop file
    - debian/openssh-server.ucf-md5sum: update for Ubuntu delta
    - d/p/systemd-socket-activation.patch:
      + Fix sshd re-execution behavior when socket activation is used
      + Adapt sshd-session and sshd-auth for systemd socket activation
      + Allow AF_VSOCK sockets
    - debian/tests/systemd-socket-activation: Add autopkgtest for systemd socket
      activation functionality.
    - debian/patches: Immediately report interactive instructions to PAM clients
    - debian/control: Build-Depends: systemd-dev
    - d/p/sshd-socket-generator.patch: add generator for socket activation
    - debian/openssh-server.install: install sshd-socket-generator
    - debian/openssh-server.postinst: restart whichever systemd unit is enabled
    - d/t/sshd-socket-generator: add dep8 test for sshd-socket-generator
    - ssh.socket: adjust unit for socket activation by default
    - debian/rules: explicitly enable LTO
    - d/t/ssh-gssapi: disable -e in cleanup()
    - d/p/test-set-UsePAM-no-on-some-tests.patch: set UsePAM=no for some tests
    - d/openssh-server.links: add full sshd.service -> ssh.service alias
      (LP #2087949)
    - document /etc/ssh/sshd_config.d/*.conf better in sshd_config
      (LP #2088207)
    - d/rules,d/control: do not build with wtmpdb support
    - d/t/control: add breaks-testbed restriction to tests
    - d/tests: do not fail when $HOME/.ssh exists
    - test: workaround test failure caused by uutils dd (LP #2125943)
  * Added:
    - d/t/password-auth-no-pam: create the privilege separation
      directory manually for this test, as it doesn't use the systemd
      service unit to start sshd

 -- Andreas Hasenack <andreas.hasenack@canonical.com>  Wed, 19 Aug 2026 17:34:01 -0300

openssh (1:10.4p1-4) unstable; urgency=medium

  * Add missing test dependencies.

 -- Colin Watson <cjwatson@debian.org>  Fri, 31 Jul 2026 17:11:39 +0100

openssh (1:10.4p1-3) unstable; urgency=medium

  * Remove most openssh-* dependencies from openssh-tests.
  * Add Slovak debconf translation (thanks, Damian Daniel; closes:
    #1142938).
  * Remove references to rsh/rcp/rlogin/rshd from package descriptions.

 -- Colin Watson <cjwatson@debian.org>  Tue, 28 Jul 2026 16:29:14 +0100

openssh (1:10.4p1-2) unstable; urgency=medium

  [ Alexander Fisher ]
  * Build-Depends: add libcrypt-dev so crypt() is detected at build time,
    fixing password authentication with UsePAM=no (closes: #1142354).
  * debian/tests: add password-auth-no-pam regression test.

 -- Colin Watson <cjwatson@debian.org>  Sun, 19 Jul 2026 12:46:25 +0100

openssh (1:10.4p1-1) unstable; urgency=medium

  [ Sven Joachim ]
  * Make doc symlinks relative on upgrade from 1:10.3p1-5 (closes:
    #1141420).

  [ Colin Watson ]
  * New upstream release:
    - CVE-2026-59995: sftp(1): when downloading files on the command-line
      using "sftp host:/path .", a malicious server could cause the file to
      be downloaded to an unexpected location. This issue was identified by
      the Swival Security Scanner.
    - CVE-2026-59996: scp(1): when copying files between two remote
      destinations, do not allow a malicious server to write files to the
      parent directory of the intended target directory. This issue was
      identified by the Swival Security Scanner.
    - CVE-2026-59997: sshd(8): when using the "internal-sftp" SFTP server
      implementation (this is not the default), long command lines were
      previously truncated silently after the 9th argument. If a
      security-relevant option was in the 10th or later position, it would
      be discarded. Reported by Steve Caffrey.
    - CVE-2026-59998: sshd(8): add a documentation note to mention that the
      GSSAPIStrictAcceptorCheck option is ineffective when the server is
      joined to a Windows Active Directory. Reported by Yarin Aharoni of
      Safebreach.
    - CVE-2026-59999: sshd(8): DisableForwarding=yes didn't override
      PermitTunnel=yes as it was documented to do. Note that PermitTunnel is
      not enabled by default. Reported independently by Huzaifa Sidhpurwala
      of Redhat and Marko Jevtic.
    - CVE-2026-60000: sshd(8): avoid a potential pre-authentication denial
      of service when GSSAPIAuthentication was enabled (this feature is off
      by default). This was not mitigated by MaxAuthTries, but would be
      penalised by PerSourcePenalties. This was reported by Manfred Kaiser
      of the milCERT AT (Austrian Ministry of Defence).
    - CVE-2026-60001: sshd(8): fix a number of cases where the minimum
      authentication delay was not being enforced. Reported by the Orange
      Cyberdefense Vulnerability Team.
    - CVE-2026-60002: ssh(1): fix a possible client-side use-after-free if
      the server changes its host key during a key reexchange. This was
      reported by Zhenpeng (Leo) Lin of Depthfirst.
    - All: add experimental support for a composite post-quantum signature
      scheme that combines ML-DSA 44 and Ed25519 as specified in
      draft-miller-sshm-mldsa44-ed25519-composite-sigs. This scheme is not
      enabled by default. To use it, you'll need to add it to
      HostKeyAlgorithms, PubkeyAcceptedAlgorithms, etc. Keys may be
      generated using "ssh-keygen -t mldsa44-ed25519".
    - ssh(1), sshd(8): replace the wildcard pattern matcher with an
      implementation based on an NFA. This avoids exponential worst-case
      behaviour for the old implementation.
    - ssh-agent(1): fix incorrect reply to "query" SSH_AGENTC_EXTENSION
      requests.
    - sshd(8): avoid sending observably different messages for valid vs
      invalid users in GSSAPIAuthentication (disabled by default).
    - ssh(1), sshd(8): fix several bugs that incorrectly classified bulk
      traffic as interactive.
    - ssh-keygen(1), ssh-add(1): skip unsupported key types when downloading
      resident keys from a FIDO token. Previously, downloads would abort
      when one was encountered.
    - ssh(1): fix a potential use-after-free on an error path if
      cipher_init() fails.
    - sshd(8): perform stricter encoding and validation of transport state
      passed between sshd privilege separation subprocesses. This somewhat
      further hardens the server against attacks on sshd-auth or
      sshd-session subprocesses.
    - ssh-agent(1): avoid possible runtime denial of service by enforcing
      some limits on the length of usernames in key use constraints.
    - sftp(1): fix two separate one-byte out-of-bounds reads, in
      SSH2_FXP_REALPATH and batch command processing.
    - sftp-server(8): disallow use of the copy-data extension to read and
      write to the same inode simultaneously.
    - ssh(1), sshd(8): avoid strlen(NULL) crash if an X11 channel was
      created before the x11-req SSH_MSG_CHANNEL_REQUEST was sent.
    - sftp(1), scp(1): avoid a situation where sftp_download() could get
      stuck in a loop if a broken server repeatedly returned zero length
      while reading a file.
    - ssh(1): avoid leaking DNS0x20 case-randomised names into names
      canonicalised using CanonicalizePermittedCNAMEs.
    - sftp-server(8): avoid truncation of pathnames passed to lstat() during
      SSH_FXP_REALPATH handling on systems where PATH_MAX is not the actual
      max.
    - ssh(1), sshd(8): correct arming of poll(2) event masks for some
      socket-type channels.
    - sshd(8): major refactor of sshd_config parsing and management code, to
      allow for more exact serialisation/deserialisation across privilege
      separation boundaries.
    - ssh-add(1): open connection to the agent only after getopt()
      processing has completed, to give options like "-v" a chance to
      display debug information about this operation.
    - sshd(8): differentiate between execution failures and a subsystem that
      was not found when logging why a subsystem failed to start.
    - All: use safer idioms for timegm(3) and mktime(3) error detection.
    - ssh(1), sshd(8): avoid accepting invalid cipher or MAC lists in config
      files or command-line arguments. This could cause runtime failures
      later.
    - ssh(1): fix NULL deref crash during pubkey auth when using a PEM style
      private key with no corresponding .pub key adjacent to it (closes:
      #1134814).
    - sshd(8): don't print an error message when trying to load a host
      private key when PKCS#11 keys are in use, as these don't need the
      private half on the filesystem.
    - All: don't use deprecated ERR_load_crypto_strings().
    - ssh(1): properly report errors during configuration default setting.
    - ssh(1): use correct directive name (Match instead of Host) in error
      message.
    - sftp(1): fix "ls -ln" which was not correctly showing numeric UID/GIDs
      but rather user and group names.
    - sshd(8): avoid possible NULL dereference if an allocation fails during
      config parsing.
    - All: fix ineffective guards against loading overly large public keys
      in several places.
    - sftp(1): ensure file descriptors used by sftp to communicate to its
      ssh(1) subprocess don't leak into executed subprocesses (e.g. via
      "!").
    - Sync fmt_scaled.c with OpenBSD upstream, picking up an exactness fix
      for large exponents.
    - sshd(8): remove duplicate sandbox entry for clock_gettime64.
    - Sync getrrsetbyname.c with OpenBSD upstream, picking up robustness
      fixes.
    - Fix a number of memory leaks on error paths in the portability code.
    - Revise the README.privsep documentation to reflect sshd's recent
      switch to a multi-binary model.

 -- Colin Watson <cjwatson@debian.org>  Mon, 06 Jul 2026 19:11:28 +0100

openssh (1:10.3p1-9) unstable; urgency=medium

  * openssh-client Conflicts: openssh-server (<< 1:10.3p1-6~) (closes:
    #1141550).

 -- Colin Watson <cjwatson@debian.org>  Mon, 06 Jul 2026 09:51:32 +0100

openssh (1:10.3p1-8) unstable; urgency=medium

  * d/copyright: Add some missing authors.
  * Standards-Version: 4.7.4.
  * openssh-tests: Make a couple more scripts executable.

 -- Colin Watson <cjwatson@debian.org>  Fri, 03 Jul 2026 16:54:01 +0100

openssh (1:10.3p1-7) unstable; urgency=medium

  * Reupload with binaries, since openssh-common is new.

 -- Colin Watson <cjwatson@debian.org>  Fri, 03 Jul 2026 00:32:52 +0100

openssh (1:10.3p1-6) unstable; urgency=medium

  * Move documentation to a new openssh-common package (closes: #1070098).
  * Remove dependency on openssh-client{,-gssapi} from
    openssh-server{,-gssapi} (closes: #699473).
  * Use --link-doc on all packages.
  * Move ssh-keygen and openssh-{pkcs11,sk}-helper to openssh-common.

 -- Colin Watson <cjwatson@debian.org>  Thu, 02 Jul 2026 20:24:29 +0100

openssh (1:10.3p1-5) unstable; urgency=medium

  [ Johannes Schauer Marin Rodrigues ]
  * Support DPKG_ROOT.

  [ Colin Watson ]
  * d/copyright: Significantly rework to be lrc-clean.

  [ Roland C. Dowdeswell ]
  * Fix GSS C25519 server blob bounds check.

 -- Colin Watson <cjwatson@debian.org>  Fri, 26 Jun 2026 16:16:18 +0100

openssh (1:10.3p1-4ubuntu2) stonking; urgency=medium

  * No-change rebuild against libssl4

 -- Ravi Kant Sharma <ravi.kant.sharma@canonical.com>  Fri, 24 Jul 2026 08:01:03 +0000

openssh (1:10.3p1-4ubuntu1) stonking; urgency=medium

  * Merge with Debian unstable. (LP: #2155170)
    - Remaining changes:
      - debian/rules: modify dh_installsystemd invocations for
        socket-activated sshd
      - debian/README.Debian: document systemd socket activation.
      - debian/.gitignore: drop file
      - debian/openssh-server.ucf-md5sum: update for Ubuntu delta
      - d/p/systemd-socket-activation.patch:
        + Fix sshd re-execution behavior when socket activation is used
        + Adapt sshd-session and sshd-auth for systemd socket activation
        + Allow AF_VSOCK sockets
      - debian/tests/systemd-socket-activation: Add autopkgtest for systemd
        socket activation functionality.
      - debian/patches: Immediately report interactive instructions to PAM
        clients
      - debian/control: Build-Depends: systemd-dev
      - d/p/sshd-socket-generator.patch: add generator for socket activation
      - debian/openssh-server.install: install sshd-socket-generator
      - debian/openssh-server.postinst: restart whichever systemd unit is
        enabled
      - d/t/sshd-socket-generator: add dep8 test for sshd-socket-generator
      - ssh.socket: adjust unit for socket activation by default
      - debian/rules: explicitly enable LTO
      - d/t/ssh-gssapi: disable -e in cleanup()
      - d/p/test-set-UsePAM-no-on-some-tests.patch: set UsePAM=no for some
        tests
      - d/openssh-server.links: add full sshd.service -> ssh.service alias
        (LP #2087949)
      - document /etc/ssh/sshd_config.d/*.conf better in sshd_config
        (LP #2088207)
      - d/rules,d/control: do not build with wtmpdb support
      - d/t/control: add breaks-testbed restriction to tests
      - d/tests: do not fail when $HOME/.ssh exists
      - test: workaround test failure caused by uutils dd (LP #2125943)
    - Dropped changes:
      - d/p/gss-api-defaults.patch: Do not default to weak GSS-API exchange
        algorithms.
        + [ Fixed in 1:10.2p1-6 ]
      - d/p/sshconnect2-Write-kbd-interactive-service-info-and-instru.patch:
        Write kbd-interactive service info and instructions as utf-8.
        + [ Fixed upstream in OpenSSH 10.3p1. ]
      - d/p/auth-pam-Add-an-enum-to-define-the-PAM-done-status.patch:
        Add an enum to define the PAM done status.
        + [ Fixed upstream in OpenSSH 10.3p1 (SshPamDone enum) ]
      - d/p/auth-pam-Add-debugging-information-when-we-receive-PAM-me.patch:
        Add debugging information when we receive PAM messages.
        + [ Fixed upstream in OpenSSH 10.3p1. ]
      - d/p/auth-pam-Immediately-report-interactive-instructions-to-c.patch:
        Immediately report interactive instructions to clients.
        + [ Fixed upstream in OpenSSH 10.3p1. ]
      - d/p/CVE-2026-35385.patch, CVE-2026-35386-pre1.patch,
        CVE-2026-35386.patch, CVE-2026-35386-2.patch,
        CVE-2026-35387_35414.patch, CVE-2026-35388.patch:
        Security fixes for CVE-2026-35385, CVE-2026-35386,
        CVE-2026-35387, CVE-2026-35388, CVE-2026-35414.
        + [ All fixed upstream in OpenSSH 10.3p1. ]

 -- Grayson Wolf <grayson.wolf@canonical.com>  Mon, 08 Jun 2026 09:58:34 -0400

openssh (1:10.3p1-4) unstable; urgency=medium

  * OpenSSL 4 removed support for engines, so only configure with
    --with-ssl-engine when building for older versions (closes: #1138423).

 -- Colin Watson <cjwatson@debian.org>  Mon, 01 Jun 2026 11:37:05 +0100

openssh (1:10.3p1-3) unstable; urgency=medium

  * Enable regression tests of keyboard-interactive and password
    authentication.
  * Add test dependency on procps for pidof (closes: #1136545).

 -- Colin Watson <cjwatson@debian.org>  Fri, 29 May 2026 10:00:29 +0100

openssh (1:10.3p1-2) unstable; urgency=medium

  * Correctly set extended type for client-side channels.  Fixes interactive
    vs bulk IPQoS for client->server traffic.
  * Build-depend on libselinux-dev rather than libselinux1-dev.

 -- Colin Watson <cjwatson@debian.org>  Sun, 03 May 2026 17:28:29 +0100

openssh (1:10.3p1-1) unstable; urgency=medium

  * New upstream release:
    - CVE-2026-35386: ssh(1): validation of shell metacharacters in user
      names supplied on the command-line was performed too late to prevent
      some situations where they could be expanded from %-tokens in
      ssh_config. For certain configurations, such as those that use a "%u"
      token in a "Match exec" block, an attacker who can control the user
      name passed to ssh(1) could potentially execute arbitrary shell
      commands. Reported by Florian Kohnhäuser (closes: #1132573).
      We continue to recommend against directly exposing ssh(1) and other
      tools' command-lines to untrusted input. Mitigations such as this can
      not be absolute given the variety of shells and user configurations in
      use.
    - CVE-2026-35414: sshd(8): when matching an authorized_keys
      principals="" option against a list of principals in a certificate, an
      incorrect algorithm was used that could allow inappropriate matching
      in cases where a principal name in the certificate contains a comma
      character. Exploitation of the condition requires an authorized_keys
      principals="" option that lists more than one principal *and* a CA
      that will issue a certificate that encodes more than one of these
      principal names separated by a comma (typical CAs strongly constrain
      which principal names they will place in a certificate). This
      condition only applies to user- trusted CA keys in authorized_keys,
      the main certificate authentication path
      (TrustedUserCAKeys/AuthorizedPrincipalsFile) is not affected. Reported
      by Vladimir Tokarev (closes: #1132576).
    - CVE-2026-35385: scp(1): when downloading files as root in legacy (-O)
      mode and without the -p (preserve modes) flag set, scp did not clear
      setuid/setgid bits from downloaded files as one might typically
      expect. This bug dates back to the original Berkeley rcp program.
      Reported by Christos Papakonstantinou of Cantina and Spearbit (closes:
      #1132572).
    - CVE-2026-35387: sshd(8): fix incomplete application of
      PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms with regard
      to ECDSA keys. Previously if one of these directives contains any
      ECDSA algorithm name (say "ecdsa-sha2-nistp384"), then any other ECDSA
      algorithm would be accepted in its place regardless of whether it was
      listed or not.  Reported by Christos Papakonstantinou of Cantina and
      Spearbit (closes: #1132574).
    - CVE-2026-35388: ssh(1): connection multiplexing confirmation
      (requested using "ControlMaster ask/autoask") was not being tested for
      proxy mode multiplexing sessions (i.e. "ssh -O proxy ..."). Reported
      by Michalis Vasileiadis (closes: #1132575).
    - ssh(1), sshd(8): support IANA-assigned codepoints for SSH agent
      forwarding, as per draft-ietf-sshm-ssh-agent. Support for the new
      names is advertised via the EXT_INFO message. If a server offers
      support for the new names, then they are used preferentially. Support
      for the pre-standardisation "@openssh.com" extensions for agent
      forwarding remains supported.
    - ssh-agent(1): implement support for draft-ietf-sshm-ssh-agent "query"
      extension.
    - ssh-add(1): support querying the protocol extensions via the agent
      "query" extension with a new -Q flag.
    - ssh(1): support multiple files in a ssh_config RevokedHostKeys
      directive.
    - sshd(8): support multiple files in a sshd_config RevokedKeys
      directive.
    - ssh(1): add a ~I escape option that shows information about the
      current SSH connection (closes: #321525).
    - ssh(1): add an "ssh -Oconninfo user@host" multiplexing command that
      shows connection information, similar to the ~I escapechar.
    - ssh(1): add an "ssh -O channels user@host" multiplexing command to get
      a running mux process to show information about what channels are
      currently open.
    - sshd(8): add 'invaliduser' penalty to PerSourcePenalties, which is
      applied to login attempts for usernames that do not match real
      accounts. Defaults to 5s to match 'authfail' but allows administrators
      to block such attempts for longer if desired.
    - sshd(8): add a GSSAPIDelegateCredentials option for the server,
      controlling whether it accepts delegated credentials offered by the
      client.  This option mirrors the same option in ssh_config.
    - ssh(1), sshd(8): support the VA DSCP codepoint in the IPQoS directive.
    - sshd(8): convert PerSourcePenalties to using floating point time,
      allowing penalties to be less than a second. This is useful if you
      need to penalise things you expect to occur at >=1 QPS.
    - ssh-keygen(1): support writing ED25519 keys in PKCS8 format.
    - Support the ed25519 signature scheme via libcrypto.
    - sshd(8): make IPQoS first-match-wins in sshd_config, like other
      configuration directives.
    - sshd(8): fix potential crash when MaxStartups is using a single
      argument (i.e. not using the MaxStartups x:y:z form) to a value below
      10.
    - sshd(8): fix a potential hang during key exchange if needed DH group
      values were missing from /etc/moduli.
    - ssh-agent(1): fix return values from extensions to be correct wrt
      draft-ietf-sshm-ssh-agent: extension requests should indicate failure
      using SSH_AGENT_EXTENSION_FAILURE rather than the generic
      SSH_AGENT_FAILURE error code. This allows the client to discern
      between "the request failed" and "the agent doesn't support this
      extension".
    - ssh(1): use fmprintf for showing challenge-response name and info to
      preserve UTF-8 characters where appropriate.
    - scp(1): when uploading a directory using sftp/sftp (e.g. during a
      recursive transfer), don't clobber the remote directory permissions
      unless either we created the directory during the transfer or the -p
      flag was set.
    - All: implement missing pieces of FIDO/webauthn signature support,
      mostly related to certificate handling and enable acceptance of this
      signature format by default.
    - sshd_config(5): make it clear that DenyUsers/DenyGroups overrides
      AllowUsers/AllowGroups. Previously we specified the order in which the
      directives are processed but it was ambiguous as to what happened if
      both matched.
    - ssh(1): don't try to match certificates held in an agent to private
      keys. This matching is done to support certificates that were loaded
      without their private key material, but is unnecessary for
      agent-hosted certificate which always have private key material
      available in the agent. Worse, this matching would mess up the request
      sent to the agent in such a way as to break usage of these keys when
      the key usage was restricted in the agent.
    - sftp(1): if editline has been switched to vi mode (i.e. via "bind -v"
      in .editrc), setup a keybinding so that command mode can be entered.
    - ssh(1), sshd(8): improve performance of keying the sntrup761 key
      agreement algorithm.
    - ssh(1), sshd(8): enforce maximum packet/block limit during
      pre-authentication phase.
    - sftp(1): don't misuse the sftp limits extension's open-handles field.
      This value is supposed to be the number of handles a server will allow
      to be opened and not a number of outstanding read/write requests that
      can be sent during an upload/download.
    - sshd(8): don't crash at connection time if the main sshd_config lacks
      any subsystem directive but one is defined in a Match block.
    - sshd_config(5): add a warning next to the ForceCommand directive that
      forcing a command doesn't automatically disable forwarding.
    - sshd_config(5): add a warning that TOKENS are replaced without
      filtering or escaping and that it's the administrator's responsibility
      to ensure they are used safely in context.
    - sshd(8): don't mess up the PerSourceNetBlockSize IPv6 mask if sscanf
      didn't decode it.
    - ssh-add(1): when loading FIDO2 resident keys, set the comment to the
      FIDO application string. This matches the behaviour of ssh-keygen -K.
    - sshd(8): don't strnvis() log messages that are going to be logged by
      sshd-auth via its parent sshd-session process, as the parent will also
      run them though strnvis(). Prevents double-escaping of non-printing
      characters in some log messages.
    - ssh-agent(1): escape SSH_AUTH_SOCK paths that are sent to the shell as
      setenv commands. Unbreaks ssh-agent for home directory paths that
      contain whitespace (closes: #1118288).
    - All: Remove unnecessary checks for ECDSA public key validity.
    - sshd(8): activate UnusedConnectionTimeout only after the last channel
      has closed. Previously UnusedConnectionTimeout could fire early after
      a ChannelTimeout. This was not a problem for the OpenSSH client
      because it terminates once all channels have closed but could cause
      problems for other clients (e.g. API clients) that do things
      differently.
    - scp(1): when using the SFTP protocol for transfers, fix implicit
      destination path selection when source path ends with "..".
    - sftp(1): when tab-completing a filename, ensure that the completed
      string does not end up mid-way through a multibyte character, as this
      will cause a fatal() later on.
    - ssh-keygen(1): fix crash at exit (visible via ssh-keygen -D) when
      multiple keys loaded.
    - scp(1)/sftp(1): correctly display bandwidths >2GBps in the progress
      meter.
    - sshd(8): fix condition introduced in openssh 10.2p1 stable branch
      where a PAM module that changed the requested username between
      SSH_MSG_USERAUTH_REQUEST messages during authentication could confuse
      the PAM stack and let it proceed with a different understanding of the
      active username than the rest of sshd. Reported by Mike Damm.
    - sshd(8): immediately report interactive instructions to clients when
      using keyboard-interactive authentication with PAM.
    - sshd(8): fix duplicate PAM messages under some situations.
    - sshd(8): don't leak PAM handle on repeat invocations.
    - sshd(8): fix ut_type for btmp records, correctly using LOGIN_PROCESS
      and USER_PROCESS.
    - sshd(8): allow uname(3) in the seccomp sandbox. This is needed by
      zlib-ng on RISC-V platforms.
    - All: remove remaining OpenSSL_add_all_algorithms() calls. We already
      have OPENSSL_init_crypto() in the compat layer.

 -- Colin Watson <cjwatson@debian.org>  Sun, 12 Apr 2026 12:49:45 +0100

openssh (1:10.2p1-6) unstable; urgency=medium

  * CVE-2026-3497: Fix incorrect GSS-API error handling; Replace incorrect
    use of sshpkt_disconnect() with ssh_packet_disconnect(), and properly
    initialize some variables (closes: #1130595; thanks, Marc Deslauriers).
  * Do not default to weak GSS-API exchange algorithms (closes: #989906,
    #1131206; LP: #2144812; thanks, Athos Ribeiro).

 -- Colin Watson <cjwatson@debian.org>  Fri, 27 Mar 2026 18:26:06 +0000

openssh (1:10.2p1-5) unstable; urgency=medium

  [ Samuel Thibault ]
  * Do not link against libcrypt on GNU/Hurd (closes: #1128399).

  [ Colin Watson ]
  * Install systemd files directly to /usr and drop dh-sequence-movetousr
    (closes: #1122765).

 -- Colin Watson <cjwatson@debian.org>  Thu, 19 Feb 2026 10:46:15 +0000

openssh (1:10.2p1-4) unstable; urgency=medium

  [ Colin Watson ]
  * Debconf translations:
    - Simplified and Traditional Chinese (thanks, Yangfl; closes: #1124970).

  [ Luca Boccassi ]
  * openssh-client: use sysusers.d instead of manual scripting.
  * openssh-client: drop compat postinst not needed since bookworm/noble.
  * openssh-client: drop versioned dependency on i-s-h, satisfied since
    trixie/noble.
  * openssh-client: drop dependency on passwd, add recommends on
    openssh-server.
  * Use dh-sequence-installsysusers and drop d/rules override.

  [ Christian Göttsche ]
  * Reorder pam_selinux(7) usage (closes: #747303).

 -- Colin Watson <cjwatson@debian.org>  Wed, 18 Feb 2026 14:09:13 +0000

openssh (1:10.2p1-3) unstable; urgency=medium

  * Drop "Rules-Requires-Root: no", default as of dpkg-dev 1.22.13.
  * Drop openssh-server's dependency on lsb-base.
  * Remove support for direct upgrades from before Debian 12 (bookworm).
  * Rewrite scp-quoting.patch using argv_assemble, and forward it upstream.

 -- Colin Watson <cjwatson@debian.org>  Tue, 02 Dec 2025 14:36:37 +0000

openssh (1:10.2p1-2ubuntu3.2) resolute-security; urgency=medium

  * SECURITY UPDATE: unexpected scp setuid and setgid
    - debian/patches/CVE-2026-35385.patch: clear setuid/setgid bits from
      downloaded files in scp.c.
    - CVE-2026-35385
  * SECURITY UPDATE: command execution via shell metacharacters in username
    - debian/patches/CVE-2026-35386-pre1.patch: apply validity rules on
      ProxyJump usernames and hostnames in readconf.c, readconf.h, ssh.c.
    - debian/patches/CVE-2026-35386.patch: move username check earlier in
      ssh.c.
    - debian/patches/CVE-2026-35386-2.patch: adapt to username validity
      check change in regress/percent.sh.
    - CVE-2026-35386
  * SECURITY UPDATE: use of unintended ECDSA algorithms
    - debian/patches/CVE-2026-35387_35414.patch: correctly match ECDSA
      signature algorithms against algorithm allowlists in
      auth2-hostbased.c, auth2-pubkey.c, sshconnect2.c.
    - CVE-2026-35387
  * SECURITY UPDATE: missing connection multiplexing confirmation
    - debian/patches/CVE-2026-35388.patch: add missing askpass check in
      mux.c.
    - CVE-2026-35388
  * SECURITY UPDATE: authorized_keys principals option mishandling
    - debian/patches/CVE-2026-35387_35414.patch: check for commas in
      auth2-pubkeyfile.c.
    - CVE-2026-35414

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 27 Apr 2026 20:15:40 -0400

openssh (1:10.2p1-2ubuntu3) resolute; urgency=medium

  * d/p/gss-api-defaults.patch: do not default to weak GSS-API
    exchange algorithms (LP: #2144812)

 -- Athos Ribeiro <athos@ubuntu.com>  Wed, 18 Mar 2026 16:23:48 -0300

openssh (1:10.2p1-2ubuntu2) resolute; urgency=medium

  * SECURITY UPDATE: GSSAPI Key Exchange issue
    - debian/patches/gssapi.patch: replace incorrect use of
      sshpkt_disconnect() with ssh_packet_disconnect() and properly
      initialize some vars.
    - CVE-2026-3497

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 13 Mar 2026 07:05:34 -0400

openssh (1:10.2p1-2ubuntu1) resolute; urgency=medium

  * Merge with Debian unstable (LP: #2130054). Remaining changes:
    - debian/rules: modify dh_installsystemd invocations for
      socket-activated sshd
    - debian/README.Debian: document systemd socket activation.
    - debian/.gitignore: drop file
    - debian/openssh-server.ucf-md5sum: update for Ubuntu delta
    - d/p/systemd-socket-activation.patch:
      + Fix sshd re-execution behavior when socket activation is used
      + Adapt sshd-session and sshd-auth for systemd socket activation
      + Allow AF_VSOCK sockets
    - debian/tests/systemd-socket-activation: Add autopkgtest for systemd socket
      activation functionality.
    - debian/patches: Immediately report interactive instructions to PAM clients
    - debian/patches: sshconnect2: Write kbd-interactive messages as utf-8
    - debian/control: Build-Depends: systemd-dev
    - d/p/sshd-socket-generator.patch: add generator for socket activation
    - debian/openssh-server.install: install sshd-socket-generator
    - debian/openssh-server.postinst: restart whichever systemd unit is enabled
    - d/t/sshd-socket-generator: add dep8 test for sshd-socket-generator
    - ssh.socket: adjust unit for socket activation by default
    - debian/rules: explicitly enable LTO
    - d/t/ssh-gssapi: disable -e in cleanup()
    - d/p/test-set-UsePAM-no-on-some-tests.patch: set UsePAM=no for some tests
    - d/openssh-server.links: add full sshd.service -> ssh.service alias
      (LP #2087949)
    - document /etc/ssh/sshd_config.d/*.conf better in sshd_config
      (LP #2088207)
    - d/rules,d/control: do not build with wtmpdb support
    - d/t/control: add breaks-testbed restriction to tests
    - d/tests: do not fail when $HOME/.ssh exists
    - test: workaround test failure caused by uutils dd (LP #2125943)
  * Dropped:
    - authfd: fallback to default if $SSH_AUTH_SOCK is unset (LP #2125549)
      [ This was not the right fix, so do not carry it anymore ]

 -- Nick Rosbrook <enr0n@ubuntu.com>  Tue, 02 Dec 2025 16:22:16 -0500

openssh (1:10.2p1-2) unstable; urgency=medium

  * ssh-session-cleanup: Update pattern for sshd-session split in 9.8
    (closes: #1117965).
  * Link ssh against ssh-pkcs11.o directly (closes: #1117638, #1117720).

 -- Colin Watson <cjwatson@debian.org>  Fri, 17 Oct 2025 10:14:14 +0100

openssh (1:10.2p1-1) unstable; urgency=medium

  * New upstream release:
    - ssh-keygen(1): fix download of keys from PKCS#11 tokens.

 -- Colin Watson <cjwatson@debian.org>  Fri, 10 Oct 2025 14:50:27 +0100

openssh (1:10.1p1-2) unstable; urgency=medium

  * Don't reuse c->isatty for signalling that the remote channel has a tty
    attached (closes: #1117574, #1117594).
  * Link ssh-keygen directly against ssh-pkcs11.c.

 -- Colin Watson <cjwatson@debian.org>  Thu, 09 Oct 2025 00:54:25 +0100

openssh (1:10.1p1-1) unstable; urgency=medium

  [ Allison Karlitskaya ]
  * sshd@.service: Support ephemeral keys from VM/container hosts.

  [ Colin Watson ]
  * New upstream release:
    - ssh(1): add a warning when the connection negotiates a non-post
      quantum key agreement algorithm.
    - ssh(1), sshd(8): major changes to handling of DSCP marking/IPQoS: by
      default, interactive traffic is assigned to the EF (Expedited
      Forwarding) class, while non-interactive traffic uses the operating
      system default DSCP marking.
    - ssh(1), sshd(8): deprecate support for IPv4 type-of-service (ToS)
      keywords in the IPQoS configuration directive.
    - ssh-add(1): when adding certificates to an agent, set the expiry to
      the certificate expiry time plus a short (5 min) grace period.
    - All: remove experimental support for XMSS keys.
    - ssh-agent(1), sshd(8): move agent listener sockets from /tmp to under
      ~/.ssh/agent for both ssh-agent(1) and forwarded sockets in sshd(8).
    - CVE-2025-61984: ssh(1): disallow control characters in usernames
      passed via the commandline or expanded using %-sequences from the
      configuration file (closes: #1117529).
    - CVE-2025-61985: ssh(1): disallow \0 characters in ssh:// URIs (closes:
      #1117530).
    - ssh(1), sshd(8): add SIGINFO handlers to log active channel and
      session information.
    - sshd(8): when refusing a certificate for user authentication, log
      enough information to identify the certificate in addition to the
      reason why it was being denied. Makes debugging certificate
      authorisation problems a bit easier.
    - ssh(1), ssh-agent(1): support ed25519 keys hosted on PKCS#11 tokens.
    - ssh(1): add an ssh_config(5) RefuseConnection option that, when
      encountered while processing an active section in a configuration,
      terminates ssh(1) with an error message that contains the argument to
      the option.
    - sshd(8): make the X11 display number check relative to
      X11DisplayOffset. This will allow people to use X11DisplayOffset to
      configure much higher port ranges if they really want, while not
      changing the default behaviour.
    - ssh(1): fix delay on X client startup when ObscureKeystrokeTiming is
      enabled.
    - sshd(8): increase the maximum size of the supported configuration from
      256KB to 4MB, which ought to be enough for anybody. Fail early and
      visibly when this limit is breached.
    - sftp(1): during sftp uploads, avoid a condition where a failed write
      could be ignored if a subsequent write succeeded. This is unlikely but
      technically possible because sftp servers are allowed to reorder
      requests.
    - sshd(8): avoid a race condition when the sshd-auth process exits that
      could cause a spurious error message to be logged.
    - sshd(8): log at level INFO when PerSourcePenalties actually blocks
      access to a source address range. Previously this was logged at level
      VERBOSE, which hid enforcement actions under default config settings.
    - sshd(8): Make the MaxStartups and PerSourceNetBlockSize options
      first-match-wins as advertised.
    - ssh(1): fix an incorrect return value check in the local forward
      cancellation path that would cause failed cancellations not to be
      logged.
    - sshd(8): make "Match !final" not trigger a second parsing pass of
      ssh_config (unless hostname canonicalisation or a separate "Match
      final" does).
    - ssh(1): better debug diagnostics when loading keys. Will now list key
      fingerprint and algorithm (not just algorithm number) as well as
      making it explicit which keys didn't load.
    - All: fix a number of memory leaks found by LeakSanitizer, Coverity and
      manual inspection.
    - sshd(8): Output the current name for PermitRootLogin's
      "prohibit-password" in sshd -T instead of its deprecated alias
      "without-password" (closes: #1095922).
    - ssh(1): make writing known_hosts lines more atomic by writing the
      entire line in one operation and using unbuffered stdio.
    - sshd(8): check the username didn't change during the PAM transactions.
    - sshd(8): don't log audit messages with UNKNOWN hostname to avoid slow
      DNS lookups in the audit subsystem.
    - All: when making a copy of struct passwd, ensure struct fields are
      non-NULL.
    - sshd(8): handle futex_time64 properly in seccomp sandbox.
    - Add contrib/gnome-ssh-askpass4 for GNOME 40+ using the GCR API.
    - ssh-agent(1): exit 0 from SIGTERM under systemd socket-activation,
      preventing a graceful shutdown of an agent via systemd from
      incorrectly marking the service as "failed".
  * Drop patches:
    - no-openssl-version-status.patch: Mostly applied upstream; the rest
      only applied to OpenSSL < 3, which isn't relevant to current Debian
      releases.
    - revert-ipqos-defaults.patch: This new upstream release reworks IPQoS,
      so let's see how that works in Debian (closes: #1111446).
  * debian/run-tests: Fix path to dropbear.

 -- Colin Watson <cjwatson@debian.org>  Tue, 07 Oct 2025 22:07:19 +0100

openssh (1:10.0p1-8) unstable; urgency=medium

  * Remove some long-obsolete Conflicts (closes: #54243).
  * Fix mistracking of MaxStartups process exits in some situations (closes:
    #1080350).

 -- Colin Watson <cjwatson@debian.org>  Sun, 10 Aug 2025 00:07:55 +0100

openssh (1:10.0p1-7) unstable; urgency=medium

  * Make postinst logic for cleaning up the sshd diversion more robust.

 -- Colin Watson <cjwatson@debian.org>  Fri, 01 Aug 2025 16:02:27 +0100

openssh (1:10.0p1-6) unstable; urgency=medium

  * Temporarily divert /usr/sbin/sshd during upgrades from before
    1:9.8p1-1~, to avoid new connections failing between unpack and
    configure (closes: #1109742).

 -- Colin Watson <cjwatson@debian.org>  Mon, 28 Jul 2025 12:17:42 +0100

openssh (1:10.0p1-5ubuntu5) questing; urgency=medium

  * test: workaround test failure caused by uutils dd (LP: #2125943)
  * authfd: fallback to default if $SSH_AUTH_SOCK is unset (LP: #2125549)

 -- Nick Rosbrook <enr0n@ubuntu.com>  Mon, 29 Sep 2025 14:43:07 -0400

openssh (1:10.0p1-5ubuntu4) questing; urgency=medium

  * Rebuild to include updated RISC-V base ISA RVA23

 -- Heinrich Schuchardt <heinrich.schuchardt@canonical.com>  Sat, 06 Sep 2025 14:19:10 +0000

openssh (1:10.0p1-5ubuntu3) questing; urgency=medium

  * d/p/systemd-socket-activation.patch: allow AF_VSOCK sockets (LP: #2111226)

 -- Nick Rosbrook <enr0n@ubuntu.com>  Mon, 04 Aug 2025 11:22:12 -0400

openssh (1:10.0p1-5ubuntu2) questing; urgency=medium

  * d/rules,d/control: do not build with wtmpdb support
    (LP: #2116241)
  * Re-instate UsePAM yes in sshd_config (LP: #2116196):
    - d/p/debian-config.patch: reinstate erroneously dropped changes
    - debian/openssh-server.ucf-md5sum: update for current checksums
  * d/t/control: add breaks-testbed restriction to tests
  * d/tests: do not fail when $HOME/.ssh exists

 -- Nick Rosbrook <enr0n@ubuntu.com>  Tue, 08 Jul 2025 15:40:56 -0400

openssh (1:10.0p1-5ubuntu1) questing; urgency=medium

  * Merge with Debian unstable. (LP: #2112050) Remaining changes:
    - debian/rules: modify dh_installsystemd invocations for
      socket-activated sshd
    - debian/README.Debian: document systemd socket activation.
    - debian/.gitignore: drop file
    - debian/openssh-server.ucf-md5sum: update for Ubuntu delta
    - d/p/systemd-socket-activation.patch:
      + Fix sshd re-execution behavior when socket activation is used
      + Adapt sshd-session for systemd socket activation
    - debian/tests/systemd-socket-activation: Add autopkgtest for systemd socket
      activation functionality.
    - debian/patches: Immediately report interactive instructions to PAM clients
    - debian/patches: sshconnect2: Write kbd-interactive messages as utf-8
    - debian/control: Build-Depends: systemd-dev
    - d/p/sshd-socket-generator.patch: add generator for socket activation
    - debian/openssh-server.install: install sshd-socket-generator
    - debian/openssh-server.postinst: restart whichever systemd unit is enabled
    - d/t/sshd-socket-generator: add dep8 test for sshd-socket-generator
    - ssh.socket: adjust unit for socket activation by default
    - debian/rules: explicitly enable LTO
    - d/t/ssh-gssapi: disable -e in cleanup()
    - d/p/test-set-UsePAM-no-on-some-tests.patch: set UsePAM=no for some tests
    - d/openssh-server.links: add full sshd.service -> ssh.service alias
      (LP #2087949)
    - document /etc/ssh/sshd_config.d/*.conf better in sshd_config
      (LP #2088207)
  * New changes:
    - debian/openssh-server.ucf-md5sum: update for new Ubuntu version
    - d/p/systemd-socket-activation.patch: add -N no-opt flag for sshd-auth
      Otherwise, authentication will fail in socket activated mode, due
      to the unrecognized flag.
    - d/p/debian-config.patch: refresh
  * Dropped changes, fixed upstream:
    - CVE-2025-26465.patch
    - CVE-2025-26466.patch
    - CVE-2025-32728.patch

 -- Nick Rosbrook <enr0n@ubuntu.com>  Thu, 03 Jul 2025 16:25:27 -0400

openssh (1:10.0p1-5) unstable; urgency=medium

  * Ensure that configure knows the path to passwd; fixes reproducibility of
    openssh-tests.

 -- Colin Watson <cjwatson@debian.org>  Fri, 09 May 2025 13:40:49 +0100

openssh (1:10.0p1-4) unstable; urgency=medium

  [ Daniel Kahn Gillmor ]
  * Add Requires=ssh-agent.socket to ssh-agent.service (closes: #1103522).

 -- Colin Watson <cjwatson@debian.org>  Fri, 09 May 2025 10:16:45 +0100

openssh (1:10.0p1-3) unstable; urgency=medium

  * Disable --with-linux-memlock-onfault again, since it causes
    RLIMIT_MEMLOCK to be exceeded with some combinations of PAM modules
    (closes: #1103418).

 -- Colin Watson <cjwatson@debian.org>  Wed, 07 May 2025 16:18:43 +0100

openssh (1:10.0p1-2) unstable; urgency=medium

  [ Colin Watson ]
  * Disable --with-linux-memlock-onfault on riscv64.
  * Build with wtmpdb (see #1102643).
  * Stop writing /var/log/btmp, since nothing reads it any more (closes:
    #1072184).
  * Restore some rdomain references in sshd_config(5) where they're
    supported on Linux, referring to ip-vrf(8) (closes: #1095686).

  [ Daniel Kahn Gillmor ]
  * Improve systemd user service socket activation (closes: #961311,
    #1039919, #1103037).

  [ Luca Boccassi ]
  * Switch from adduser to sysusers.d.
  * Add sshd-keygen service.

 -- Colin Watson <cjwatson@debian.org>  Tue, 15 Apr 2025 14:19:35 +0100

openssh (1:10.0p1-1) unstable; urgency=medium

  [ Luca Boccassi ]
  * Add COLORTERM NO_COLOR to SendEnv and AcceptEnv.

  [ Colin Watson ]
  * New upstream release:
    - This release removes support for the weak DSA signature algorithm.
    - scp(1), sftp(1): pass "ControlMaster no" to ssh when invoked by scp &
      sftp.
    - This release has the version number 10.0 and announces itself as
      "SSH-2.0-OpenSSH_10.0". Software that naively matches versions using
      patterns like "OpenSSH_1*" may be confused by this.
    - sshd(8): this release removes the code responsible for the user
      authentication phase of the protocol from the per-connection
      sshd-session binary to a new sshd-auth binary. Splitting this code
      into a separate binary ensures that the crucial pre-authentication
      attack surface has an entirely disjoint address space from the code
      used for the rest of the connection. It also yields a small runtime
      memory saving as the authentication code will be unloaded after the
      authentication phase completes. This change should be largely
      invisible to users, though some log messages may now come from
      "sshd-auth" instead of "sshd-session".
    - sshd(8): this release disables finite field (a.k.a modp)
      Diffie-Hellman key exchange in sshd by default. Specifically, this
      removes the "diffie-hellman-group*" and
      "diffie-hellman-group-exchange-*" methods from the default
      KEXAlgorithms list. The client is unchanged and continues to support
      these methods by default.
    - sshd(8): this release removes the implicit fallback to compiled-in
      groups for Diffie-Hellman Group Exchange KEX when the moduli file
      exists but does not contain moduli within the client-requested range.
      The fallback behaviour remains for the case where the moduli file does
      not exist at all. This allows administrators more explicit control
      over which DH groups will be selected, but can lead to connection
      failures if the moduli file is edited incorrectly.
    - CVE-2025-32728: sshd(8): fix the DisableForwarding directive, which
      was failing to disable X11 forwarding and agent forwarding as
      documented (closes: #1102603). X11 forwarding is disabled by default
      in the server and agent forwarding is off by default in the client.
    - ssh(1): the hybrid post-quantum algorithm mlkem768x25519-sha256 is now
      used by default for key agreement. This algorithm is considered to be
      safe against attack by quantum computers, is guaranteed to be no less
      strong than the popular curve25519-sha256 algorithm, has been
      standardised by NIST and is considerably faster than the previous
      default.
    - ssh(1): prefer AES-GCM to AES-CTR mode when selecting a cipher for the
      connection. The default cipher preference list is now
      Chacha20/Poly1305, AES-GCM (128/256) followed by AES-CTR
      (128/192/256).
    - ssh(1): add %-token and environment variable expansion to the
      ssh_config SetEnv directive.
    - ssh(1): allow %-token and environment variable expansion in the
      ssh_config User directive, with the exception of %r and %C which would
      be self-referential.
    - ssh(1), sshd(8): add "Match version" support to ssh_config and
      sshd_config. Allows matching on the local version of OpenSSH, e.g.
      "Match version OpenSSH_10.*".
    - ssh(1): add support for "Match sessiontype" to ssh_config. Allows
      matching on the type of session initially requested, either "shell"
      for interactive sessions, "exec" for command execution sessions,
      "subsystem" for subsystem requests, such as sftp, or "none" for
      transport/forwarding-only sessions.
    - ssh(1): add support for "Match command ..." support to ssh_config,
      allowing matching on the remote command as specified on the
      command-line.
    - ssh(1): allow 'Match tagged ""' and 'Match command ""' to match empty
      tag and command values respectively.
    - sshd(8): allow glob(3) patterns to be used in sshd_config
      AuthorizedKeysFile and AuthorizedPrincipalsFile directives.
    - sshd(1): support the VersionAddendum in the client, mirroring the
      option of the same name in the server.
    - ssh-agent(1): the agent will now delete all loaded keys when signaled
      with SIGUSR1. This allows deletion of keys without having access to
      $SSH_AUTH_SOCK.
    - Portable OpenSSH, ssh-agent(1): support systemd-style socket
      activation in ssh-agent using the LISTEN_PID/LISTEN_FDS mechanism.
      Activated when these environment variables are set, the agent is
      started with the -d or -D option and no socket path is set.
    - ssh-keygen(1): support FIDO tokens that return no attestation data,
      e.g. recent WinHello.
    - ssh-agent(1): add a "-Owebsafe-allow=..." option to allow the default
      FIDO application ID allow-list to be overridden.
    - ssh-keygen(1): allow "-" as output file for moduli screening.
    - sshd(8): remove assumption that the sshd_config and any configs it
      includes can fit in a (possibly enlarged) socket buffer. Previously it
      was possible to create a sufficiently large configuration that could
      cause sshd to fail to accept any connection. sshd(8) will now actively
      manage sending its config to the sshd-session sub-process.
    - ssh(1): don't start the ObscureKeystrokeTiming mitigations if there
      has been traffic on a X11 forwarding channel recently. Should fix X11
      forwarding performance problems when this setting is enabled.
    - ssh(1): prohibit the comma character in hostnames accepted, but allow
      an underscore as the first character in a hostname.
    - sftp(1): set high-water when resuming a "put". Prevents bogus "server
      reordered acks" debug message.
    - ssh(1), sshd(8): fix regression in openssh-9.8, which would fail to
      accept "Match criteria=argument" as well as the documented "Match
      criteria argument" syntax in ssh_config and sshd_config.
    - sftp(1), ssh(1): fix a number of possible NULL dereference bugs,
      including Coverity CIDs 405019 and 477813.
    - sshd(8): fix PerSourcePenalty incorrectly using "crash" penalty when
      LoginGraceTime was exceeded.
    - sshd(8): fix "Match invalid-user" from incorrectly being activated in
      initial configuration pass when no other predicates were present on
      the match line.
    - sshd(8): fix debug logging of user specific delay.
    - sshd(8): improve debug logging across sub-process boundaries.
      Previously some log messages were lost early in the sshd-auth and
      sshd-session processes' life.
    - ssh(1): require control-escape character sequences passed via the '-e
      ^x' command-line to be exactly two characters long. Avoids one byte
      out-of-bounds read if ssh is invoked as "ssh -e^ ...".
    - ssh(1), sshd(8): prevent integer overflow in x11 port handling. These
      are theoretically possible if the admin misconfigured X11DisplayOffset
      or the user misconfigures their own $DISPLAY, but don't happen in
      normal operation.
    - ssh-keygen(1): don't mess up ssh-keygen -l output when the file
      contains CR characters.
    - sshd(8): add rate limits to logging of connections dropped by
      PerSourcePenalties. Previously these could be noisy in logs.
    - ssh(1): fix argument of "Compression" directive in ssh -G config dump,
      which regressed in openssh-9.8.
    - sshd(8): fix a corner-case triggered by UpdateHostKeys when sshd
      refuses to accept the signature returned by an agent holding host keys
      during the hostkey rotation sub-protocol. This situation could occur
      in situations where a PKCS#11 smartcard that lacked support for
      particular signature algorithms was used to store host keys.
    - ssh-keygen(1): when using RSA keys to sign messages with "ssh-keygen
      -Y", select the signature algorithm based on the requested hash
      algorithm ("-Ohashalg=xxx"). This allows using something other than
      the default of rsa-sha2-512, which may not be supported on all signing
      backends, e.g. some smartcards only support SHA256.
    - sshd(8): add wtmpdb support as a Y2038 safe wtmp replacement.
    - sshd(8): add support for locking sshd into memory, enabled with the
      --with-linux-memlock-onfault configure flag.
  * Configure --with-linux-memlock-onfault on Linux.

 -- Colin Watson <cjwatson@debian.org>  Fri, 11 Apr 2025 16:00:55 +0100

openssh (1:9.9p2-2) unstable; urgency=medium

  * Simplify most autopkgtests using needs-sudo restriction.
  * Remove obsolete slogin symlink (closes: #1098760).
  * Check if dbclient supports SHA1 before trying SHA1-based KEX (closes:
    #1100948).

 -- Colin Watson <cjwatson@debian.org>  Thu, 20 Mar 2025 23:12:58 +0000

openssh (1:9.9p2-1) unstable; urgency=medium

  * New upstream release:
    - CVE-2025-26465: ssh(1) in OpenSSH versions 6.8p1 to 9.9p1 (inclusive)
      contained a logic error that allowed an on-path attacker (a.k.a MITM)
      to impersonate any server when the VerifyHostKeyDNS option is enabled.
      This option is off by default.
    - CVE-2025-26466: sshd(8) in OpenSSH versions 9.5p1 to 9.9p1 (inclusive)
      is vulnerable to a memory/CPU denial-of-service related to the
      handling of SSH2_MSG_PING packets. This condition may be mitigated
      using the existing PerSourcePenalties feature.
    - ssh(1), sshd(8): fix regression in Match directive that caused
      failures when predicates and their arguments were separated by '='
      characters instead of whitespace (bz3739).
    - sshd(8): fix the "Match invalid-user" predicate, which was matching
      incorrectly in the initial pass of config evaluation.

 -- Colin Watson <cjwatson@debian.org>  Tue, 18 Feb 2025 10:13:10 +0000

openssh (1:9.9p1-3ubuntu3.1) plucky-security; urgency=medium

  * SECURITY UPDATE: incorrect DisableForwarding directive behaviour
    - debian/patches/CVE-2025-32728.patch: fix logic error in session.c.
    - CVE-2025-32728

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 11 Apr 2025 07:33:19 -0400

openssh (1:9.9p1-3ubuntu3) plucky; urgency=medium

  * SECURITY UPDATE: MitM with VerifyHostKeyDNS option
    - debian/patches/CVE-2025-26465.patch: fix error code handling in
      krl.c, ssh-agent.c, ssh-sk-client.c, sshconnect2.c, sshsig.c.
    - CVE-2025-26465
  * SECURITY UPDATE: pre-authentication denial of service
    - debian/patches/CVE-2025-26466.patch: don't reply to PING in preauth
      or in KEX in packet.c.
    - CVE-2025-26466

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 18 Feb 2025 08:50:06 -0500

openssh (1:9.9p1-3ubuntu2) plucky; urgency=medium

  * document /etc/ssh/sshd_config.d/*.conf better in sshd_config
    (LP: #2088207)
    - d/p/debian-config.patch: expand comment about configuration options
      and precedence of configuration snippets
    - d/openssh-server.ucf-md5sum: update for new sshd_config comments
    - d/p/sshd-socket-generator.patch: refresh for sshd_config comment
  * d/t/systemd-socket-activation: add wait while unit is reloading
    This avoids a race condition where we sometimes fail the assertion
    that ActiveState=active after systemctl reload.
    (LP: #2089049)

 -- Nick Rosbrook <enr0n@ubuntu.com>  Tue, 19 Nov 2024 12:06:14 -0500

openssh (1:9.9p1-3ubuntu1) plucky; urgency=medium

  * Merge with Debian unstable (LP: #2085261). Remaining changes:
    - Make systemd socket activation the default:
      + debian/rules: modify dh_installsystemd invocations for
        socket-activated sshd
      + debian/README.Debian: document systemd socket activation.
      + debian/patches/systemd-socket-activation.patch: Fix sshd
        re-execution behavior when socket activation is used
      + debian/tests/systemd-socket-activation: Add autopkgtest for systemd socket
        activation functionality.
      + debian/control: Build-Depends: systemd-dev
      + d/p/sshd-socket-generator.patch: add generator for socket activation
      + debian/openssh-server.install: install sshd-socket-generator
      + debian/openssh-server.postinst: handle migration to sshd-socket-generator
      + d/t/sshd-socket-generator: add dep8 test for sshd-socket-generator
      + ssh.socket: adjust unit for socket activation by default
      + debian/rules: explicitly enable LTO
    - debian/.gitignore: drop file
    - debian/openssh-server.ucf-md5sum: update for Ubuntu delta
    - debian/patches: Immediately report interactive instructions to PAM clients
    - debian/patches: sshconnect2: Write kbd-interactive messages as utf-8
    - d/t/ssh-gssapi: disable -e in cleanup()
  * Dropped changes, included in Debian:
    - SECURITY UPDATE: timing attack against echo-off password entry
      + debian/patches/CVE-2024-39894.patch: don't rely on
        channel_did_enqueue in clientloop.c
      + CVE-2024-39894
  * New changes:
    - d/p/systemd-socket-activation.patch: refresh and adapt for sshd-session
    - d/openssh-server.links: add full sshd.service -> ssh.service alias
      (LP: #2087949)

 -- Nick Rosbrook <enr0n@ubuntu.com>  Tue, 12 Nov 2024 16:28:26 -0500

openssh (1:9.9p1-3) unstable; urgency=medium

  * Fix mlkem768x25519-sha256 key exchange algorithm on big-endian
    architectures.
  * Drop patch to define MAXHOSTNAMELEN on GNU/Hurd (no longer needed).

 -- Colin Watson <cjwatson@debian.org>  Sun, 27 Oct 2024 13:58:04 +0000

openssh (1:9.9p1-2) unstable; urgency=medium

  * Don't prefer host-bound public key signatures if there was no initial
    host key, as is the case when using GSS-API key exchange (closes:
    #1041521).
  * Use runuser rather than sudo in autopkgtests where possible, avoiding a
    dependency.

 -- Colin Watson <cjwatson@debian.org>  Mon, 21 Oct 2024 18:24:07 +0100

openssh (1:9.9p1-1) unstable; urgency=medium

  * Alias the old Debian-specific SetupTimeOut client option to
    ConnectTimeout rather than to ServerAliveInterval.
  * New upstream release (https://www.openssh.com/releasenotes.html#9.9p1):
    - ssh(1): remove support for pre-authentication compression.
    - ssh(1), sshd(8): processing of the arguments to the "Match"
      configuration directive now follows more shell-like rules for quoted
      strings, including allowing nested quotes and \-escaped characters.
    - ssh(1), sshd(8): add support for a new hybrid post-quantum key
      exchange based on the FIPS 203 Module-Lattice Key Enapsulation
      mechanism (ML-KEM) combined with X25519 ECDH as described by
      https://datatracker.ietf.org/doc/html/draft-kampanakis-curdle-ssh-pq-ke-03
      This algorithm "mlkem768x25519-sha256" is available by default.
    - ssh(1): the ssh_config "Include" directive can now expand environment
      as well as the same set of %-tokens "Match Exec" supports.
    - sshd(8): add a sshd_config "RefuseConnection" option that, if set will
      terminate the connection at the first authentication request.
    - sshd(8): add a "refuseconnection" penalty class to sshd_config
      PerSourcePenalties that is applied when a connection is dropped by the
      new RefuseConnection keyword.
    - sshd(8): add a "Match invalid-user" predicate to sshd_config Match
      options that matches when the target username is not valid on the
      server.
    - ssh(1), sshd(8): update the Streamlined NTRUPrime code to a
      substantially faster implementation.
    - ssh(1), sshd(8): the hybrid Streamlined NTRUPrime/X25519 key exchange
      algorithm now has an IANA-assigned name in addition to the
      "@openssh.com" vendor extension name. This algorithm is now also
      available under this name "sntrup761x25519-sha512"
    - ssh(1), sshd(8), ssh-agent(1): prevent private keys from being
      included in core dump files for most of their lifespans. This is in
      addition to pre-existing controls in ssh-agent(1) and sshd(8) that
      prevented coredumps.
    - All: convert key handling to use the libcrypto EVP_PKEY API, with the
      exception of DSA.
    - sshd(8): add a random amount of jitter (up to 4 seconds) to the grace
      login time to make its expiry unpredictable.
    - sshd(8): fix regression introduced in openssh-9.8 that swapped the
      order of source and destination addresses in some sshd log messages.
    - sshd(8): do not apply authorized_keys options when signature
      verification fails. Prevents more restrictive key options being
      incorrectly applied to subsequent keys in authorized_keys.
    - ssh-keygen(1): include pathname in some of ssh-keygen's passphrase
      prompts. Helps the user know what's going on when ssh-keygen is
      invoked via other tools.
    - ssh(1), ssh-add(1): make parsing user@host consistently look for the
      last '@' in the string rather than the first. This makes it possible
      to more consistently use usernames that contain '@' characters.
    - ssh(1), sshd(8): be more strict in parsing key type names. Only allow
      short names (e.g "rsa") in user-interface code and require full SSH
      protocol names (e.g. "ssh-rsa") everywhere else.
    - regress: many performance and correctness improvements to the
      re-keying regression test.
    - ssh-keygen(1): clarify that ed25519 is the default key type generated
      and clarify that rsa-sha2-512 is the default signature scheme when RSA
      is in use.
    - sshd(8): fix minor memory leak in Subsystem option parsing.
    - All: additional hardening and consistency checks for the sshbuf code.
    - sshd(8): reduce default logingrace penalty to ensure that a single
      forgotten login that times out will be below the penalty threshold.
    - ssh(1): fix proxy multiplexing (-O proxy) bug. If a mux started with
      ControlPersist then later has a forwarding added using mux proxy
      connection and the forwarding was used, then when the mux proxy
      session terminated, the mux master process would issue a bad message
      that terminated the connection.
    - Sync contrib/ssh-copy-id to the latest upstream version.
    - sshd(8): restore audit call before exit that regressed in openssh-9.8.
      Fixes an issue where the SSH_CONNECTION_ABANDON event was not
      recorded.
    - Fix detection of setres*id on GNU/Hurd.

 -- Colin Watson <cjwatson@debian.org>  Mon, 23 Sep 2024 21:09:59 -0700

openssh (1:9.8p1-8) unstable; urgency=medium

  * Source-only reupload.

 -- Colin Watson <cjwatson@debian.org>  Fri, 30 Aug 2024 00:38:26 +0100

openssh (1:9.8p1-7) unstable; urgency=medium

  * Adjust description line-wrapping so that lintian recognizes that
    openssh-client-gssapi is an intentionally empty package.

 -- Colin Watson <cjwatson@debian.org>  Thu, 29 Aug 2024 14:17:13 +0100

openssh (1:9.8p1-6) unstable; urgency=medium

  * Upload with binaries to satisfy Debian archive NEW checks.

 -- Colin Watson <cjwatson@debian.org>  Thu, 29 Aug 2024 13:46:57 +0100

openssh (1:9.8p1-5) unstable; urgency=medium

  * Add openssh-client-gssapi and openssh-server-gssapi packages; these
    currently just depend on their non-gssapi counterparts, but will become
    different in future.  See
    https://lists.debian.org/debian-devel/2024/04/msg00044.html.

 -- Colin Watson <cjwatson@debian.org>  Thu, 29 Aug 2024 12:53:42 +0100

openssh (1:9.8p1-4) unstable; urgency=medium

  [ Grzegorz Szymaszek ]
  * Disable listening on 22 in the port change example in README.Debian.

  [ Colin Watson ]
  * sshd: Allow exec without absolute path in inetd mode (closes: #1078429).
  * Add an autopkgtest for running sshd from xinetd.

 -- Colin Watson <cjwatson@debian.org>  Mon, 26 Aug 2024 15:02:45 +0100

openssh (1:9.8p1-3) unstable; urgency=medium

  [ Dirk Van Haerenborgh ]
  * Add sshd-session to openssh-server-udeb.

 -- Colin Watson <cjwatson@debian.org>  Tue, 06 Aug 2024 12:58:46 +0100

openssh (1:9.8p1-2) unstable; urgency=medium

  * Don't close sockets passed by systemd socket activation (closes:
    #1077765).
  * Add an autopkgtest for socket activation.
  * Consult /etc/hosts.{allow,deny} as "sshd", not "sshd-session" (closes:
    #1077799).

 -- Colin Watson <cjwatson@debian.org>  Fri, 02 Aug 2024 17:08:58 +0100

openssh (1:9.8p1-1) unstable; urgency=medium

  * New upstream release (https://www.openssh.com/releasenotes.html#9.8p1):
    - CVE-2024-39894: Fix Logic error in ssh(1) ObscureKeystrokeTiming that
      made the feature ineffective.
    - The DSA signature algorithm is now disabled at compile-time.
    - sshd(8): the server has been split into a listener binary, sshd(8),
      and a per-session binary "sshd-session".  This allows for a much
      smaller listener binary, as it no longer needs to support the SSH
      protocol.  As part of this work, support for disabling privilege
      separation (which previously required code changes to disable) and
      disabling re-execution of sshd(8) has been removed.  Further
      separation of sshd-session into additional, minimal binaries is
      planned for the future.
    - sshd(8): several log messages have changed.  In particular, some log
      messages will be tagged with as originating from a process named
      "sshd-session" rather than "sshd".
    - ssh-keyscan(1): this tool previously emitted comment lines containing
      the hostname and SSH protocol banner to standard error.  This release
      now emits them to standard output, but adds a new "-q" flag to silence
      them altogether.
    - sshd(8): sshd will no longer use argv[0] as the PAM service name.  A
      new "PAMServiceName" sshd_config(5) directive allows selecting the
      service name at runtime.  This defaults to "sshd".
    - sshd(8): penalise client addresses that, for various reasons, do not
      successfully complete authentication.  This feature is controlled by a
      new sshd_config(5) PerSourcePenalties option and is on by default.
    - ssh(8): allow the HostkeyAlgorithms directive to disable the implicit
      fallback from certificate host key to plain host keys.
    - misc: fix a number of inaccuracies in the PROTOCOL.* documentation
      files.
    - all: switch to strtonum(3) for more robust integer parsing in most
      places.
    - ssh(1), sshd(8): correctly restore sigprocmask around ppoll().
    - ssh-keysign(8): stricter validation of messaging socket fd.
    - sftp(1): flush stdout after writing "sftp>" prompt when not using
      editline.
    - sftp-server(8): fix home-directory extension implementation, it
      previously always returned the current user's home directory contrary
      to the spec.
    - ssh-keyscan(1): do not close stdin to prevent error messages when
      stdin is read multiple times.
    - regression tests: fix rekey test that was testing the same KEX
      algorithm repeatedly instead of testing all of them.
    - ssh_config(5), sshd_config(5): clarify the KEXAlgorithms directive
      documentation, especially around what is supported vs available
      (closes: #1073065).
    - sshd(8): expose SSH_AUTH_INFO_0 always to PAM auth modules
      unconditionally. The previous behaviour was to expose it only when
      particular authentication methods were in use.
    - build: fix OpenSSL ED25519 support detection. An incorrect function
      signature in configure.ac previously prevented enabling the recently
      added support for ED25519 private keys in PEM PKCS8 format.
    - ssh(1), ssh-agent(8): allow the presence of the WAYLAND_DISPLAY
      environment variable to enable SSH_ASKPASS, similarly to the X11
      DISPLAY environment variable (closes: #1037515, #1068044).
  * Stop generating DSA host key.
  * Apply X-Style: black.

 -- Colin Watson <cjwatson@debian.org>  Wed, 31 Jul 2024 17:16:04 +0100

openssh (1:9.7p1-7ubuntu5) plucky; urgency=medium

  * d/t/sshd-socket-generator: run test_match_on_port test

 -- Nick Rosbrook <enr0n@ubuntu.com>  Wed, 30 Oct 2024 08:48:50 -0400

openssh (1:9.7p1-7ubuntu4) oracular; urgency=medium

  * Explicitly listen on IPv4 by default, with socket-activated sshd
    (LP: #2080216)
    - d/systemd/ssh.socket: explicitly listen on ipv4 by default
    - d/t/sshd-socket-generator: update for new defaults and AddressFamily
    - sshd-socket-generator: handle new ssh.socket default settings
  * d/p/systemd-socket-activation.patch: always close newsock fd before re-exec

 -- Nick Rosbrook <enr0n@ubuntu.com>  Tue, 01 Oct 2024 14:45:28 -0400

openssh (1:9.7p1-7ubuntu3) oracular; urgency=medium

  * sshd-socket-generator: do not parse server match config (LP: #2076023)

 -- Nick Rosbrook <enr0n@ubuntu.com>  Tue, 27 Aug 2024 15:54:41 -0400

openssh (1:9.7p1-7ubuntu2) oracular; urgency=medium

  * d/p/test-set-UsePAM-no-on-some-tests.patch: restore patch
    This was mistakenly dropped in the merge from Debian after
    testing locally only.

 -- Nick Rosbrook <enr0n@ubuntu.com>  Wed, 31 Jul 2024 10:20:23 -0400

openssh (1:9.7p1-7ubuntu1) oracular; urgency=medium

  * Merge with Debian unstable (LP: #2064435). Remaining changes:
    - Make systemd socket activation the default:
      + debian/rules: modify dh_installsystemd invocations for
        socket-activated sshd
      + debian/README.Debian: document systemd socket activation.
      + debian/patches/systemd-socket-activation.patch: Fix sshd
        re-execution behavior when socket activation is used
      + debian/tests/systemd-socket-activation: Add autopkgtest for systemd socket
        activation functionality.
      + debian/control: Build-Depends: systemd-dev
      + d/p/sshd-socket-generator.patch: add generator for socket activation
      + debian/openssh-server.install: install sshd-socket-generator
      + debian/openssh-server.postinst: handle migration to sshd-socket-generator
      + d/t/sshd-socket-generator: add dep8 test for sshd-socket-generator
      + ssh.socket: adjust unit for socket activation by default
      + debian/rules: explicitly enable LTO
    - debian/.gitignore: drop file
    - debian/openssh-server.ucf-md5sum: update for Ubuntu delta
    - debian/patches: Immediately report interactive instructions to PAM clients
    - debian/patches: sshconnect2: Write kbd-interactive messages as utf-8
    - d/t/ssh-gssapi: disable -e in cleanup()
    - SECURITY UPDATE: timing attack against echo-off password entry
      + debian/patches/CVE-2024-39894.patch: don't rely on
        channel_did_enqueue in clientloop.c
      + CVE-2024-39894
  * Dropped changes, included in Debian:
    - debian/patches: only set PAM_RHOST if remote host is not "UNKNOWN"
    - Remove deprecated user_readenv=1 setting (LP #2059859):
      + d/openssh-server.sshd.pam.in: drop user_readenv=1, which was
        deprecated by pam_env upstream. Openssh has the SendEnv and AcceptEnv
        configuration options that can be used to replace this feature, and
        are in the default config already
      + d/NEWS: update about this change in behavior
    - debian: Remove dependency on libsystemd
    - d/p/gssapi.patch: fix method_gsskeyex structure and
      userauth_gsskeyex function regarding changes introduced in upstream
      commit dbb339f015c33d63484261d140c84ad875a9e548 ("prepare for
      multiple names for authmethods") (LP #2053146)
    - d/t/{ssh-gssapi,util}: ssh-gssapi DEP8 test for gssapi-with-mic
      and gssapi-keyex authentication methods
    - SECURITY UPDATE: remote code execution via signal handler race
      condition (LP #2070497)
      + debian/patches/CVE-2024-6387.patch: don't log in sshsigdie() in log.c.
      + CVE-2024-6387
  * Dropped changes, no longer needed:
    - debian/openssh-server.postinst: ucf workaround for LP #1968873
      [affected upgrade path not supported]
    - d/p/test-set-UsePAM-no-on-some-tests.patch: set UsePAM=no
      for some tests.

 -- Nick Rosbrook <enr0n@ubuntu.com>  Mon, 29 Jul 2024 15:19:02 -0400

openssh (1:9.7p1-7) unstable; urgency=critical

  [ Salvatore Bonaccorso ]
  * Disable async-signal-unsafe code from the sshsigdie() function.  This is
    a minimal workaround for a regression from CVE-2006-5051.

 -- Colin Watson <cjwatson@debian.org>  Mon, 01 Jul 2024 10:11:27 +0100

openssh (1:9.7p1-6) unstable; urgency=medium

  * Stop reading ~/.pam_environment, which has a history of security
    problems and is deprecated by PAM upstream (closes: #1018260).

 -- Colin Watson <cjwatson@debian.org>  Tue, 25 Jun 2024 14:20:44 +0100

openssh (1:9.7p1-5) unstable; urgency=medium

  [ Colin Watson ]
  * Add "After=nss-user-lookup.target" to ssh.service and sshd@.service
    (closes: #1069706).
  * Avoid cleanup of /tmp/sshauth.*, created by sshd if ExposeAuthInfo is
    set.

  [ Andreas Hasenack ]
  * Add autopkgtests for GSSAPI logins, including gssapi-keyex.

  [ Luca Boccassi ]
  * Install tmpfiles.d to avoid cleanup of ssh-agent socket in /tmp/
    (closes: #1070725).
  * Only set PAM_RHOST if the remote host is not "UNKNOWN" (thanks, Daan De
    Meyer).

 -- Colin Watson <cjwatson@debian.org>  Thu, 16 May 2024 11:16:30 +0100

openssh (1:9.7p1-4) unstable; urgency=medium

  * Rework systemd readiness notification and socket activation patches to
    not link against libsystemd (the former via an upstream patch).
  * Force -fzero-call-used-regs=used not to be used on ppc64el (it's
    unsupported, but configure fails to detect this).

 -- Colin Watson <cjwatson@debian.org>  Wed, 03 Apr 2024 12:06:08 +0100

openssh (1:9.7p1-3) unstable; urgency=medium

  * Fix gssapi-keyex declaration further (thanks, Andreas Hasenack;
    LP: #2053146).
  * Extend -fzero-call-used-regs check to catch m68k gcc bug (closes:
    #1067243).
  * debian/tests/regress: Set a different IP address for UNKNOWN.
  * Re-enable ssh-askpass-gnome on all architectures.
  * regress: Redirect conch stdin from /dev/zero (re-enables conch interop
    tests).
  * Drop "Work around RSA SHA-2 signature issues in conch" patch (no longer
    needed now that Twisted is fixed).

 -- Colin Watson <cjwatson@debian.org>  Sun, 31 Mar 2024 11:55:38 +0100

openssh (1:9.7p1-2) unstable; urgency=medium

  [ Simon McVittie ]
  * d/control, d/rules: Disable ssh-askpass-gnome on 32-bit, except i386
    (closes: #1066847).

 -- Colin Watson <cjwatson@debian.org>  Thu, 14 Mar 2024 11:45:12 +0000

openssh (1:9.7p1-1) unstable; urgency=medium

  * Add the isolation-container restriction to the "regress" autopkgtest.
    Our setup code wants to ensure that the haveged service is running, and
    furthermore at least the agent-subprocess test assumes that there's an
    init to reap zombie processes and doesn't work in (e.g.)
    autopkgtest-virt-unshare.
  * New upstream release (https://www.openssh.com/releasenotes.html#9.7p1):
    - ssh(1), sshd(8): add a "global" ChannelTimeout type that watches all
      open channels and will close all open channels if there is no traffic
      on any of them for the specified interval. This is in addition to the
      existing per-channel timeouts added recently.
      This supports situations like having both session and x11 forwarding
      channels open where one may be idle for an extended period but the
      other is actively used. The global timeout could close both channels
      when both have been idle for too long (closes: #165185).
    - All: make DSA key support compile-time optional, defaulting to on.
    - sshd(8): don't append an unnecessary space to the end of subsystem
      arguments (bz3667)
    - ssh(1): fix the multiplexing "channel proxy" mode, broken when
      keystroke timing obfuscation was added. (GHPR#463)
    - ssh(1), sshd(8): fix spurious configuration parsing errors when
      options that accept array arguments are overridden (bz3657).
    - ssh-agent(1): fix potential spin in signal handler (bz3670)
    - Many fixes to manual pages and other documentation.
    - Greatly improve interop testing against PuTTY.
  * Skip utimensat test on ZFS, since it seems to leave the atime set to 0.
  * Allow passing extra options to debian/tests/regress, for debugging.
  * Fix gssapi-keyex declaration, broken when rebasing onto 8.9p1
    (LP: #2053146).

 -- Colin Watson <cjwatson@debian.org>  Thu, 14 Mar 2024 10:47:58 +0000

openssh (1:9.6p1-5) unstable; urgency=medium

  * Restore systemd template unit for per-connection sshd instances,
    although without any corresponding .socket unit for now; this is mainly
    for use with the forthcoming systemd-ssh-generator (closes: #1061516).
    It's now called sshd@.service, since unlike the main service there's no
    need to be concerned about compatibility with the slightly confusing
    "ssh" service name that Debian has traditionally used.

 -- Colin Watson <cjwatson@debian.org>  Wed, 06 Mar 2024 09:45:56 +0000

openssh (1:9.6p1-4) unstable; urgency=medium

  * Add sshd_config checksums for 1:9.2p1-1 to ucf reference file, and add a
    test to ensure it doesn't get out of date again.
  * Drop manual adjustment of OpenSSL dependencies; OpenSSH relaxed its
    checks for OpenSSL >= 3 in 9.4p1.
  * Build-depend on pkgconf rather than pkg-config.
  * Adjust debian/copyright to handle the "placed in the public domain"
    status of rijndael.* more explicitly.

 -- Colin Watson <cjwatson@debian.org>  Mon, 26 Feb 2024 12:26:57 +0000

openssh (1:9.6p1-3ubuntu18) oracular; urgency=medium

  * d/p/systemd-socket-activation.patch: don't clear rexec_flag
    It was pointed out that this is generally not a good idea, so undo this
    change. In order to do this, we need to restore the logic to ensure
    that when we have been re-executed, we ignore $LISTEN_PID because it
    won't match, but we still need to know $LISTEN_FDS. And, do not set
    FD_CLOEXEC on the fds passed from systemd, because we want them to
    survive the re-execution. (LP: #2071815)
  * d/p/systemd-socket-activation.patch: refresh patch

 -- Nick Rosbrook <enr0n@ubuntu.com>  Fri, 26 Jul 2024 11:54:36 -0400

openssh (1:9.6p1-3ubuntu17) oracular; urgency=medium

  * Remove deprecated user_readenv=1 setting (LP: #2059859):
    - d/openssh-server.sshd.pam.in: drop user_readenv=1, which was
      deprecated by pam_env upstream. Openssh has the SendEnv and
      AcceptEnv configuration options that can be used to replace this
      feature, and are in the default config already
    - d/NEWS: update about this change in behavior

 -- Andreas Hasenack <andreas@canonical.com>  Wed, 10 Jul 2024 11:41:37 -0300

openssh (1:9.6p1-3ubuntu16) oracular; urgency=medium

  * SECURITY UPDATE: timing attack against echo-off password entry
    - debian/patches/CVE-2024-39894.patch: don't rely on
      channel_did_enqueue in clientloop.c
    - CVE-2024-39894

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 09 Jul 2024 07:28:38 -0400

openssh (1:9.6p1-3ubuntu15) oracular; urgency=medium

  * SECURITY UPDATE: remote code execution via signal handler race
    condition (LP: #2070497)
    - debian/patches/CVE-2024-6387.patch: don't log in sshsigdie() in log.c.
    - CVE-2024-6387

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 26 Jun 2024 14:29:50 -0400

openssh (1:9.6p1-3ubuntu14) oracular; urgency=medium

  * d/p/sshd-socket-generator.patch: add note to sshd_config
    Explain that a systemctl daemon-reload is needed for changes
    to Port et al to take effect. (LP: #2069041)
  * debian/openssh-server.ucf-md5sum: add new checksums for sshd_config

 -- Nick Rosbrook <enr0n@ubuntu.com>  Tue, 18 Jun 2024 13:31:47 -0400

openssh (1:9.6p1-3ubuntu13) noble; urgency=medium

  [ Marco Trevisan (Treviño) ]
  * debian: Remove dependency on libsystemd
    As per the xz backdoor we learned that the least dependencies sshd have,
    the best it is, so avoid to plug libsystemd (which also brings various
    other dependencies) inside sshd for no reason:

    - d/p/systemd-readiness.patch: Use upstream patch with no libsystemd
      dependency
    - d/p/systemd-socket-activation.patch: Import patch from debian that
      mimics the libsystemd sd_listen_fds() code, as refactored by Colin
      Watson.
    - d/control: Remove dependencies on  libsystemd-dev | libelogind-dev
    - d/rules: Drop --with-systemd flag (new options are used by default)

  [ Nick Rosbrook ]
  * debian/patches: only set PAM_RHOST if remote host is not "UNKNOWN"
    (LP: #2060150)
  * debian/openssh-server.postinst: don't re-enable ssh.socket if it was disabled
    (LP: #2059874)
  * d/p/sshd-socket-generator.patch: do not always ignore ListenStream=22
    (LP: #2059872)

 -- Nick Rosbrook <enr0n@ubuntu.com>  Fri, 05 Apr 2024 15:30:31 -0400

openssh (1:9.6p1-3ubuntu12) noble; urgency=medium

  * No-change rebuild for CVE-2024-3094

 -- Steve Langasek <steve.langasek@ubuntu.com>  Sun, 31 Mar 2024 09:23:28 +0000

openssh (1:9.6p1-3ubuntu11) noble; urgency=medium

  * d/t/ssh-gssapi: make the test a bit more rebust (LP: #2058276):
    - deal with return codes
    - match a more specific success expression from the logs
    - add klist output in the case of failure

 -- Andreas Hasenack <andreas@canonical.com>  Mon, 18 Mar 2024 10:25:15 -0300

openssh (1:9.6p1-3ubuntu10) noble; urgency=medium

  * Build again with gnome.

 -- Matthias Klose <doko@ubuntu.com>  Sat, 16 Mar 2024 19:30:41 +0100

openssh (1:9.6p1-3ubuntu9) noble; urgency=medium

  * d/p/gssapi.patch: fix method_gsskeyex structure and
    userauth_gsskeyex function regarding changes introduced in upstream
    commit dbb339f015c33d63484261d140c84ad875a9e548 ("prepare for
    multiple names for authmethods") (LP: #2053146)
  * d/t/{ssh-gssapi,util}: ssh-gssapi DEP8 test for gssapi-with-mic
    and gssapi-keyex authentication methods

 -- Andreas Hasenack <andreas@canonical.com>  Fri, 15 Mar 2024 16:18:01 -0300

openssh (1:9.6p1-3ubuntu8) noble; urgency=medium

  * No-change rebuild against libcom-err2

 -- Steve Langasek <steve.langasek@ubuntu.com>  Tue, 12 Mar 2024 20:34:07 +0000

openssh (1:9.6p1-3ubuntu7) noble; urgency=medium

  * No-change rebuild against libglib2.0-0t64

 -- Steve Langasek <steve.langasek@ubuntu.com>  Mon, 11 Mar 2024 23:25:42 +0000

openssh (1:9.6p1-3ubuntu6) noble; urgency=medium

  * No-change rebuild against libglib2.0-0t64

 -- Steve Langasek <steve.langasek@ubuntu.com>  Fri, 08 Mar 2024 06:32:05 +0000

openssh (1:9.6p1-3ubuntu5) noble; urgency=medium

  * debian/systemd/ssh.service: restore RuntimeDirectory=sshd (LP: #2055806)
    We started using a tmpfile in Ubuntu when we invoked sshd -G in
    openssh-server.postinst as a part of migration to systemd socket activation.
    Since we use a generator now, instead of invoking sshd -G, we no longer need
    this change.

 -- Nick Rosbrook <enr0n@ubuntu.com>  Thu, 07 Mar 2024 13:59:57 -0500

openssh (1:9.6p1-3ubuntu5~ppa2) noble; urgency=medium

  * Build without gnome.

 -- Matthias Klose <doko@ubuntu.com>  Tue, 05 Mar 2024 15:53:05 +0100

openssh (1:9.6p1-3ubuntu4) noble; urgency=medium

  * No-change rebuild against libssl3t64

 -- Steve Langasek <steve.langasek@ubuntu.com>  Mon, 04 Mar 2024 20:31:25 +0000

openssh (1:9.6p1-3ubuntu3) noble; urgency=medium

  * Add sshd-socket-generator to generate ssh.socket drop-in configuration
    instead of doing one-time generation on package upgrade:
    - debian/control: Build-Depends: systemd-dev
    - d/p/sshd-socket-generator.patch: add generator for socket activation
    - debian/openssh-server.install: install sshd-socket-generator
    - debian/openssh-server.postinst: handle migration to sshd-socket-generator
    - d/t/sshd-socket-generator: add dep8 test for sshd-socket-generator
    - ssh.socket: adjust unit for socket activation by default
    - debian/README.Debian: update ssh.socket documentation
    - debian/rules: explicitly enable LTO
      The armhf build was not using LTO, which made sshd-socket-generator FTBFS.
      This change ensures that all arches are using LTO.
  * Drop the following changes related to previous ssh socket activation approach:
    - debian/openssh-server.postrm: remove systemd drop-ins for
      socket-activated sshd on purge
    - debian/openssh-server.templates: include debconf prompt explaining
      when migration cannot happen due to multiple ListenAddress values
    - debian/openssh-server.postinst: handle migration of sshd_config options
      to systemd socket options on upgrade.
    - debian/patches/socket-activation-documentation.patch: Document in
      sshd_config(5) that ListenAddress and Port no longer work.
  * debian/openssh-server.ucf-md5sum: update for new Ubuntu delta

 -- Nick Rosbrook <enr0n@ubuntu.com>  Wed, 21 Feb 2024 12:51:30 -0500

openssh (1:9.6p1-3ubuntu2) noble; urgency=medium

  [ Marco Trevisan (Treviño) ]
  * debian/patches: Immediately report interactive instructions to PAM clients
  * debian/patches: sshconnect2: Write kbd-interactive messages as utf-8

 -- Julian Andres Klode <juliank@ubuntu.com>  Thu, 15 Feb 2024 11:13:03 +0100

openssh (1:9.6p1-3ubuntu1) noble; urgency=medium

  * Merge with Debian unstable (LP: #2040406). Remaining changes:
    - debian/rules: modify dh_installsystemd invocations for
      socket-activated sshd.
    - debian/openssh-server.postinst: handle migration of sshd_config
      options to systemd socket options on upgrade.
    - debian/README.Debian: document systemd socket activation.
    - debian/patches/socket-activation-documentation.patch: Document
      in sshd_config(5) that ListenAddress and Port no longer work.
    - debian/openssh-server.templates: include debconf prompt
      explaining when migration cannot happen due to multiple
      ListenAddress values.
    - debian/.gitignore: drop file.
    - debian/openssh-server.postrm: remove systemd drop-ins for
      socket-activated sshd on purge.
    - debian/openssh-server.ucf-md5sum: update for Ubuntu delta
    - debian/openssh-server.tmpfile,debian/systemd/ssh.service: Move
      /run/sshd creation out of the systemd unit to a tmpfile config
      so that sshd can be run manually if necessary without having to
      create this directory by hand.
    - debian/patches/systemd-socket-activation.patch: Fix sshd
      re-execution behavior when socket activation is used.
    - debian/tests/systemd-socket-activation: Add autopkgtest
      for systemd socket activation functionality.
    - d/p/test-set-UsePAM-no-on-some-tests.patch: set UsePAM=no
      for some tests.
  * Dropped changes, fixed upstream:
    - d/p/fix-ftbfs-with-zlib13.patch: fix ftbfs when using zlib 1.3
      (LP #2049552)

 -- Miriam España Acebal <miriam.espana@canonical.com>  Mon, 29 Jan 2024 11:16:31 +0100

openssh (1:9.6p1-3) unstable; urgency=medium

  * Allow passing extra ssh-agent arguments via
    "/usr/lib/openssh/agent-launch start", making it possible to override
    things like identity lifetime using a systemd drop-in unit (closes:
    #1059639).
  * Don't try to start rescue-ssh.target in postinst (LP: #2047082).

 -- Colin Watson <cjwatson@debian.org>  Wed, 17 Jan 2024 22:50:07 +0000

openssh (1:9.6p1-2) unstable; urgency=medium

  * Improve detection of broken -fzero-call-used-regs=used (see
    https://bugzilla.mindrot.org/show_bug.cgi?id=3645; fixes build on
    ppc64/ppc64el).

 -- Colin Watson <cjwatson@debian.org>  Thu, 21 Dec 2023 16:07:34 +0000

openssh (1:9.6p1-1) unstable; urgency=medium

  * Use single quotes in suggested ssh-keygen commands (closes: #1057835).
  * Debconf translations:
    - Catalan (thanks, Pablo Huguet; closes: #1049995).
  * New upstream release (https://www.openssh.com/releasenotes.html#9.6p1):
    - [CVE-2023-48795] ssh(1), sshd(8): implement protocol extensions to
      thwart the so-called "Terrapin attack" discovered by Fabian Bäumer,
      Marcus Brinkmann and Jörg Schwenk. This attack allows a MITM to effect
      a limited break of the integrity of the early encrypted SSH transport
      protocol by sending extra messages prior to the commencement of
      encryption, and deleting an equal number of consecutive messages
      immediately after encryption starts. A peer SSH client/server would
      not be able to detect that messages were deleted.
    - [CVE-2023-51384] ssh-agent(1): when adding PKCS#11-hosted private keys
      while specifying destination constraints, if the PKCS#11 token
      returned multiple keys then only the first key had the constraints
      applied. Use of regular private keys, FIDO tokens and unconstrained
      keys are unaffected.
    - [CVE-2023-51385] ssh(1): if an invalid user or hostname that contained
      shell metacharacters was passed to ssh(1), and a ProxyCommand,
      LocalCommand directive or "match exec" predicate referenced the user
      or hostname via %u, %h or similar expansion token, then an attacker
      who could supply arbitrary user/hostnames to ssh(1) could potentially
      perform command injection depending on what quoting was present in the
      user-supplied ssh_config(5) directive. OpenSSH 9.6 now bans most shell
      metacharacters from user and hostnames supplied via the command-line.
    - ssh(1), sshd(8): the RFC4254 connection/channels protocol provides a
      TCP-like window mechanism that limits the amount of data that can be
      sent without acceptance from the peer. In cases where this limit was
      exceeded by a non-conforming peer SSH implementation, ssh(1)/sshd(8)
      previously discarded the extra data. From OpenSSH 9.6, ssh(1)/sshd(8)
      will now terminate the connection if a peer exceeds the window limit
      by more than a small grace factor. This change should have no effect
      of SSH implementations that follow the specification.
    - ssh(1): add a %j token that expands to the configured ProxyJump
      hostname (or the empty string if this option is not being used) that
      can be used in a number of ssh_config(5) keywords.
    - ssh(1): add ChannelTimeout support to the client, mirroring the same
      option in the server and allowing ssh(1) to terminate quiescent
      channels.
    - ssh(1), sshd(8), ssh-add(1), ssh-keygen(1): add support for reading
      ED25519 private keys in PEM PKCS8 format. Previously only the OpenSSH
      private key format was supported.
    - ssh(1), sshd(8): introduce a protocol extension to allow renegotiation
      of acceptable signature algorithms for public key authentication after
      the server has learned the username being used for authentication.
      This allows varying sshd_config(5) PubkeyAcceptedAlgorithms in a
      "Match user" block.
    - ssh-add(1), ssh-agent(1): add an agent protocol extension to allow
      specifying certificates when loading PKCS#11 keys. This allows the use
      of certificates backed by PKCS#11 private keys in all OpenSSH tools
      that support ssh-agent(1). Previously only ssh(1) supported this
      use-case.
    - ssh(1): when deciding whether to enable the keystroke timing
      obfuscation, enable it only if a channel with a TTY is active.
    - ssh(1): switch mainloop from poll(3) to ppoll(3) and mask signals
      before checking flags set in signal handler. Avoids potential race
      condition between signaling ssh to exit and polling.
    - ssh(1): when connecting to a destination with both the AddressFamily
      and CanonicalizeHostname directives in use, the AddressFamily
      directive could be ignored.
    - sftp(1): correct handling of the limits@openssh.com option when the
      server returned an unexpected message.
    - ssh(1): release GSS OIDs only at end of authentication, avoiding
      unnecessary init/cleanup cycles.
    - ssh_config(5): mention "none" is a valid argument to IdentityFile in
      the manual.
    - scp(1): improved debugging for paths from the server rejected for not
      matching the client's glob(3) pattern in old SCP/RCP protocol mode.
    - ssh-agent(1): refuse signing operations on destination-constrained
      keys if a previous session-bind operation has failed. This may prevent
      a fail-open situation in future if a user uses a mismatched ssh(1)
      client and ssh-agent(1) where the client supports a key type that the
      agent does not support.
  * debian/run-tests: Supply absolute paths to tools.
  * debian/run-tests: Enable interop tests for Dropbear.

 -- Colin Watson <cjwatson@debian.org>  Mon, 18 Dec 2023 22:35:25 +0000

openssh (1:9.5p1-2) unstable; urgency=medium

  * Upload to unstable.

 -- Colin Watson <cjwatson@debian.org>  Sat, 25 Nov 2023 16:16:04 +0000

openssh (1:9.5p1-1) experimental; urgency=medium

  * New upstream release (https://www.openssh.com/releasenotes.html#9.5p1):
    - ssh-keygen(1): generate Ed25519 keys by default. Ed25519 public keys
      are very convenient due to their small size. Ed25519 keys are
      specified in RFC 8709 and OpenSSH has supported them since version 6.5
      (January 2014).
    - sshd(8): the Subsystem directive now accurately preserves quoting of
      subsystem commands and arguments. This may change behaviour for exotic
      configurations, but the most common subsystem configuration
      (sftp-server) is unlikely to be affected.
    - ssh(1): add keystroke timing obfuscation to the client. This attempts
      to hide inter-keystroke timings by sending interactive traffic at
      fixed intervals (default: every 20ms) when there is only a small
      amount of data being sent. It also sends fake "chaff" keystrokes for a
      random interval after the last real keystroke. These are controlled by
      a new ssh_config ObscureKeystrokeTiming keyword.
    - ssh(1), sshd(8): Introduce a transport-level ping facility. This adds
      a pair of SSH transport protocol messages SSH2_MSG_PING/PONG to
      implement a ping capability. These messages use numbers in the "local
      extensions" number space and are advertised using a "ping@openssh.com"
      ext-info message with a string version number of "0".
    - sshd(8): allow override of Subsystem directives in sshd Match blocks.
    - scp(1): fix scp in SFTP mode recursive upload and download of
      directories that contain symlinks to other directories. In scp mode,
      the links would be followed, but in SFTP mode they were not.
    - ssh-keygen(1): handle cr+lf (instead of just cr) line endings in
      sshsig signature files.
    - ssh(1): interactive mode for ControlPersist sessions if they
      originally requested a tty.
    - sshd(8): make PerSourceMaxStartups first-match-wins.
    - sshd(8): limit artificial login delay to a reasonable maximum (5s) and
      don't delay at all for the "none" authentication mechanism.
    - sshd(8): Log errors in kex_exchange_identification() with level
      verbose instead of error to reduce preauth log spam. All of those get
      logged with a more generic error message by sshpkt_fatal().
    - sshd(8): correct math for ClientAliveInterval that caused the probes
      to be sent less frequently than configured.
    - ssh(1): fix regression in OpenSSH 9.4 (mux.c r1.99) that caused
      multiplexed sessions to ignore SIGINT under some circumstances.
  * Build-depend on dh-sequence-movetousr.
  * Report DebianBanner setting in "sshd -G/-T" output (thanks, Rasmus
    Villemoes; closes: #1053555).

 -- Colin Watson <cjwatson@debian.org>  Thu, 23 Nov 2023 17:38:07 +0000

openssh (1:9.4p1-1ubuntu2) noble; urgency=medium

  * d/p/fix-ftbfs-with-zlib13.patch: fix ftbfs when using
    zlib 1.3 (LP: #2049552).

 -- Miriam España Acebal <miriam.espana@canonical.com>  Wed, 17 Jan 2024 20:00:55 +0100

openssh (1:9.4p1-1ubuntu1) noble; urgency=medium

  * Merge with Debian unstable. Remaining changes:
    - debian/rules: modify dh_installsystemd invocations for
      socket-activated sshd
    - debian/openssh-server.postinst: handle migration of sshd_config options
      to systemd socket options on upgrade.
    - debian/README.Debian: document systemd socket activation.
    - debian/patches/socket-activation-documentation.patch: Document in
      sshd_config(5) that ListenAddress and Port no longer work.
    - debian/openssh-server.templates: include debconf prompt explaining
      when migration cannot happen due to multiple ListenAddress values
    - debian/.gitignore: drop file
    - debian/openssh-server.postrm: remove systemd drop-ins for
      socket-activated sshd on purge
    - debian/openssh-server.ucf-md5sum: update for Ubuntu delta
    - debian/openssh-server.tmpfile,debian/systemd/ssh.service: Move
      /run/sshd creation out of the systemd unit to a tmpfile config so
      that sshd can be run manually if necessary without having to create
      this directory by hand.
    - debian/patches/systemd-socket-activation.patch: Fix sshd
      re-execution behavior when socket activation is used
    - debian/tests/systemd-socket-activation: Add autopkgtest for systemd socket
      activation functionality.
    - d/p/test-set-UsePAM-no-on-some-tests.patch: set UsePAM=no for some tests
  * Dropped changes, fixed upstream:
    - d/p/fix-authorized-principals-command.patch: Fix the situation where
      sshd ignores AuthorizedPrincipalsCommand if AuthorizedKeysCommand
      is also set by checking if the value pointed to by the pointer
      'charptr' is NULL.
    - debian/patches/CVE-2023-38408-1.patch: terminate process if requested
      to load a PKCS#11 provider that isn't a PKCS#11 provider in
      ssh-pkcs11.c.
    - debian/patches/CVE-2023-38408-2.patch: disallow remote addition of
      FIDO/PKCS11 provider in ssh-agent.1, ssh-agent.c.
    - debian/patches/CVE-2023-38408-3.patch: ensure FIDO/PKCS11 libraries
      contain expected symbols in misc.c, misc.h, ssh-pkcs11.c, ssh-sk.c.
  * Dropped changes, affected package versions not published in supported
    releases:
    - debian/openssh-server.postint: do not try to restart systemd units,
      and instead indicate that a reboot is required
    - debian/tests/systemd-socket-activation: Reboot the testbed before starting the test
    - debian/rules: Do not stop ssh.socket on upgrade

 -- Nick Rosbrook <enr0n@ubuntu.com>  Mon, 13 Nov 2023 12:47:29 -0500

openssh (1:9.4p1-1) unstable; urgency=medium

  * New upstream release (https://www.openssh.com/releasenotes.html#9.4p1):
    - ssh-agent(1): PKCS#11 modules must now be specified by their full
      paths. Previously dlopen(3) could search for them in system library
      directories.
    - ssh(1): allow forwarding Unix Domain sockets via ssh -W.
    - ssh(1): add support for configuration tags to ssh(1). This adds a
      ssh_config(5) "Tag" directive and corresponding "Match tag" predicate
      that may be used to select blocks of configuration similar to the
      pf.conf(5) keywords of the same name.
    - ssh(1): add a "match localnetwork" predicate. This allows matching on
      the addresses of available network interfaces and may be used to vary
      the effective client configuration based on network location.
    - ssh(1), sshd(8), ssh-keygen(1): infrastructure support for KRL
      extensions. This defines wire formats for optional KRL extensions and
      implements parsing of the new submessages. No actual extensions are
      supported at this point.
    - sshd(8): AuthorizedPrincipalsCommand and AuthorizedKeysCommand now
      accept two additional %-expansion sequences: %D which expands to the
      routing domain of the connected session and %C which expands to the
      addresses and port numbers for the source and destination of the
      connection.
    - ssh-keygen(1): increase the default work factor (rounds) for the
      bcrypt KDF used to derive symmetric encryption keys for passphrase
      protected key files by 50%.
    - ssh-agent(1): improve isolation between loaded PKCS#11 modules by
      running separate ssh-pkcs11-helpers for each loaded provider.
    - ssh(1): make -f (fork after authentication) work correctly with
      multiplexed connections, including ControlPersist (closes: #348741).
    - ssh(1): make ConnectTimeout apply to multiplexing sockets and not just
      to network connections.
    - ssh-agent(1), ssh(1): improve defences against invalid PKCS#11 modules
      being loaded by checking that the requested module contains the
      required symbol before loading it.
    - sshd(8): fix AuthorizedPrincipalsCommand when AuthorizedKeysCommand
      appears before it in sshd_config. Since OpenSSH 8.7 the
      AuthorizedPrincipalsCommand directive was incorrectly ignored in this
      situation.
    - sshd(8), ssh(1), ssh-keygen(1): remove vestigial support for KRL
      signatures. When the KRL format was originally defined, it included
      support for signing of KRL objects. However, the code to sign KRLs and
      verify KRL signatues was never completed in OpenSSH. This release
      removes the partially-implemented code to verify KRLs. All OpenSSH
      tools now ignore KRL_SECTION_SIGNATURE sections in KRL files.
    - All: fix a number of memory leaks and unreachable/harmless integer
      overflows.
    - ssh-agent(1), ssh(1): don't truncate strings logged from PKCS#11
      modules.
    - sshd(8), ssh(1): better validate CASignatureAlgorithms in ssh_config
      and sshd_config. Previously this directive would accept certificate
      algorithm names, but these were unusable in practice as OpenSSH does
      not support CA chains.
    - ssh(1): make `ssh -Q CASignatureAlgorithms` only list signature
      algorithms that are valid for CA signing. Previous behaviour was to
      list all signing algorithms, including certificate algorithms.
    - ssh-keyscan(1): gracefully handle systems where rlimits or the maximum
      number of open files is larger than INT_MAX.
    - ssh-keygen(1): fix "no comment" not showing on when running
      `ssh-keygen -l` on multiple keys where one has a comment and other
      following keys do not. bz3580
    - scp(1), sftp(1): adjust ftruncate() logic to handle servers that
      reorder requests. Previously, if the server reordered requests then
      the resultant file would be erroneously truncated.
    - ssh(1): don't incorrectly disable hostname canonicalization when
      CanonicalizeHostname=yes and ProxyJump was explicitly set to "none".
    - scp(1): when copying local->remote, check that the source file exists
      before opening an SFTP connection to the server (closes: #59255).
    - sshd(8): provide a replacement for the SELinux matchpathcon()
      function, which is deprecated.
    - All: relax libcrypto version checks for OpenSSL >=3 (closes:
      #1035623). Beyond OpenSSL 3.0, the ABI compatibility guarantees are
      wider (only the library major must match instead of major and minor in
      earlier versions).
    - ssh-copy-id(1): Special case OpenWrt instead of Dropbear
      (LP: #1966886).

 -- Colin Watson <cjwatson@debian.org>  Sat, 02 Sep 2023 21:02:53 +0100

openssh (1:9.3p2-1) unstable; urgency=high

  * New upstream release (https://www.openssh.com/releasenotes.html#9.3p2):
    - [CVE-2023-38408] Fix a condition where specific libraries loaded via
      ssh-agent(1)'s PKCS#11 support could be abused to achieve remote code
      execution via a forwarded agent socket.

 -- Colin Watson <cjwatson@debian.org>  Wed, 19 Jul 2023 22:49:14 +0100

openssh (1:9.3p1-1ubuntu3) mantic; urgency=medium

  * d/p/fix-authorized-principals-command.patch: Fix the situation where
    sshd ignores AuthorizedPrincipalsCommand if AuthorizedKeysCommand
    is also set by checking if the value pointed to by the pointer
    'charptr' is NULL. (LP: #2031942)

 -- Michal Maloszewski <michal.maloszewski@canonical.com>  Thu, 24 Aug 2023 15:20:27 +0200

openssh (1:9.3p1-1ubuntu2) mantic; urgency=medium

  * SECURITY UPDATE: remote code execution relating to PKCS#11 providers
    - debian/patches/CVE-2023-38408-1.patch: terminate process if requested
      to load a PKCS#11 provider that isn't a PKCS#11 provider in
      ssh-pkcs11.c.
    - debian/patches/CVE-2023-38408-2.patch: disallow remote addition of
      FIDO/PKCS11 provider in ssh-agent.1, ssh-agent.c.
    - debian/patches/CVE-2023-38408-3.patch: ensure FIDO/PKCS11 libraries
      contain expected symbols in misc.c, misc.h, ssh-pkcs11.c, ssh-sk.c.
    - CVE-2023-38408

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 24 Jul 2023 15:01:06 -0400

openssh (1:9.3p1-1ubuntu1) mantic; urgency=medium

  * Merge with Debian unstable (LP: #2025664). Remaining changes:
    - debian/rules: modify dh_installsystemd invocations for
      socket-activated sshd
    - debian/openssh-server.postinst: handle migration of sshd_config options
      to systemd socket options on upgrade.
    - debian/README.Debian: document systemd socket activation.
    - debian/patches/socket-activation-documentation.patch: Document in
      sshd_config(5) that ListenAddress and Port no longer work.
    - debian/openssh-server.templates: include debconf prompt explaining
      when migration cannot happen due to multiple ListenAddress values
    - debian/.gitignore: drop file
    - debian/openssh-server.postrm: remove systemd drop-ins for
      socket-activated sshd on purge
    - debian/openssh-server.ucf-md5sum: update for Ubuntu delta
    - debian/openssh-server.tmpfile,debian/systemd/ssh.service: Move
      /run/sshd creation out of the systemd unit to a tmpfile config so
      that sshd can be run manually if necessary without having to create
      this directory by hand.
    - debian/patches/systemd-socket-activation.patch: Fix sshd
      re-execution behavior when socket activation is used
    - debian/tests/systemd-socket-activation: Add autopkgtest for systemd socket
      activation functionality.
    - d/p/test-set-UsePAM-no-on-some-tests.patch: set UsePAM=no for some tests
    - Ensure smooth upgrade path from versions affected by LP: #2020474:
      + debian/openssh-server.postint: do not try to restart systemd units,
        and instead indicate that a reboot is required
      + debian/tests/systemd-socket-activation: Reboot the testbed before starting the test
      + debian/rules: Do not stop ssh.socket on upgrade

 -- Nick Rosbrook <nick.rosbrook@canonical.com>  Mon, 03 Jul 2023 11:34:47 -0400

openssh (1:9.3p1-1) unstable; urgency=medium

  * Debconf translations:
    - Romanian (thanks, Remus-Gabriel Chelu; closes: #1033178).
  * Properly fix date of 1:3.0.2p1-2 changelog entry (closes: #1034425).
  * New upstream release (https://www.openssh.com/releasenotes.html#9.3p1):
    - [CVE-2023-28531] ssh-add(1): when adding smartcard keys to
      ssh-agent(1) with the per-hop destination constraints (ssh-add -h ...)
      added in OpenSSH 8.9, a logic error prevented the constraints from
      being communicated to the agent. This resulted in the keys being added
      without constraints. The common cases of non-smartcard keys and keys
      without destination constraints are unaffected. This problem was
      reported by Luci Stanescu (closes: #1033166).
    - [SECURITY] ssh(1): Portable OpenSSH provides an implementation of the
      getrrsetbyname(3) function if the standard library does not provide
      it, for use by the VerifyHostKeyDNS feature. A specifically crafted
      DNS response could cause this function to perform an out-of-bounds
      read of adjacent stack data, but this condition does not appear to be
      exploitable beyond denial-of-service to the ssh(1) client.
    - ssh-keygen(1), ssh-keyscan(1): accept -Ohashalg=sha1|sha256 when
      outputting SSHFP fingerprints to allow algorithm selection.
    - sshd(8): add a `sshd -G` option that parses and prints the effective
      configuration without attempting to load private keys and perform
      other checks. This allows usage of the option before keys have been
      generated and for configuration evaluation and verification by
      unprivileged users.
    - scp(1), sftp(1): fix progressmeter corruption on wide displays.
    - ssh-add(1), ssh-keygen(1): use RSA/SHA256 when testing usability of
      private keys as some systems are starting to disable RSA/SHA1 in
      libcrypto.
    - sftp-server(8): fix a memory leak.
    - ssh(1), sshd(8), ssh-keyscan(1): remove vestigial protocol
      compatibility code and simplify what's left.
    - Fix a number of low-impact Coverity static analysis findings.
    - ssh_config(5), sshd_config(5): mention that some options are not
      first-match-wins.
    - Rework logging for the regression tests. Regression tests will now
      capture separate logs for each ssh and sshd invocation in a test.
    - ssh(1): make `ssh -Q CASignatureAlgorithms` work as the manpage says
      it should.
    - ssh(1): ensure that there is a terminating newline when adding a new
      entry to known_hosts.
    - sshd(8): harden Linux seccomp sandbox. Move to an allowlist of
      mmap(2), madvise(2) and futex(2) flags, removing some concerning
      kernel attack surface.
  * debian/README.Debian: Clarify that you need to restart ssh.socket after
    overriding its ListenStream= option (LP: #2020560).
  * debian/openssh-server.postinst: Use "sshd -G" to parse the server
    configuration file (closes: #959726).
  * Fix incorrect RRSET_FORCE_EDNS0 flags validation in SSHFP DNSSEC patch
    (thanks, Ben Hutchings; closes: #909022).
  * Always use the internal mkdtemp implementation, since it substitutes
    more randomness into the template string than glibc's version (closes:
    #1001186).

 -- Colin Watson <cjwatson@debian.org>  Tue, 20 Jun 2023 01:01:48 +0100

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog openssh-common`.
