aboutsummaryrefslogtreecommitdiff
path: root/crypto/openssh/LICENCE
Commit message (Collapse)AuthorAgeFilesLines
* openssh: Update to 9.9p1Ed Maste2025-02-191-0/+41
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Highlights from the release notes are reproduced below. Bug fixes and improvements that were previously merged into FreeBSD have been elided. See the upstream release notes for full details of the 9.9p1 release (https://www.openssh.com/releasenotes.html). --- Future deprecation notice ========================= OpenSSH plans to remove support for the DSA signature algorithm in early 2025. Potentially-incompatible changes -------------------------------- * ssh(1): remove support for pre-authentication compression. * ssh(1), sshd(8): processing of the arguments to the "Match" configuration directive now follows more shell-like rules for quoted strings, including allowing nested quotes and \-escaped characters. New features ------------ * ssh(1), sshd(8): add support for a new hybrid post-quantum key exchange based on the FIPS 203 Module-Lattice Key Enapsulation mechanism (ML-KEM) combined with X25519 ECDH as described by https://datatracker.ietf.org/doc/html/draft-kampanakis-curdle-ssh-pq-ke-03 This algorithm "mlkem768x25519-sha256" is available by default. * ssh(1), sshd(8), ssh-agent(1): prevent private keys from being included in core dump files for most of their lifespans. This is in addition to pre-existing controls in ssh-agent(1) and sshd(8) that prevented coredumps. This feature is supported on OpenBSD, Linux and FreeBSD. * All: convert key handling to use the libcrypto EVP_PKEY API, with the exception of DSA. Bugfixes -------- * sshd(8): do not apply authorized_keys options when signature verification fails. Prevents more restrictive key options being incorrectly applied to subsequent keys in authorized_keys. bz3733 * ssh-keygen(1): include pathname in some of ssh-keygen's passphrase prompts. Helps the user know what's going on when ssh-keygen is invoked via other tools. Requested in GHPR503 * ssh(1), ssh-add(1): make parsing user@host consistently look for the last '@' in the string rather than the first. This makes it possible to more consistently use usernames that contain '@' characters. * ssh(1), sshd(8): be more strict in parsing key type names. Only allow short names (e.g "rsa") in user-interface code and require full SSH protocol names (e.g. "ssh-rsa") everywhere else. bz3725 * ssh-keygen(1): clarify that ed25519 is the default key type generated and clarify that rsa-sha2-512 is the default signature scheme when RSA is in use. GHPR505 --- Reviewed by: jlduran (build infrastructure) Reviewed by: cy (build infrastructure) Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D48947
* | ssh: update to OpenSSH 9.1p1Ed Maste2022-10-191-0/+1
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Release notes are available at https://www.openssh.com/txt/release-9.1 9.1 contains fixes for three minor memory safety problems; these have lready been merged to the copy of OpenSSH 9.0 that is in the FreeBSD base system. Some highlights copied from the release notes: Potentially-incompatible changes -------------------------------- * ssh(1), sshd(8): SetEnv directives in ssh_config and sshd_config are now first-match-wins to match other directives. Previously if an environment variable was multiply specified the last set value would have been used. bz3438 * ssh-keygen(8): ssh-keygen -A (generate all default host key types) will no longer generate DSA keys, as these are insecure and have not been used by default for some years. New features ------------ * ssh(1), sshd(8): add a RequiredRSASize directive to set a minimum RSA key length. Keys below this length will be ignored for user authentication and for host authentication in sshd(8). * sftp-server(8): add a "users-groups-by-id@openssh.com" extension request that allows the client to obtain user/group names that correspond to a set of uids/gids. * sftp(1): use "users-groups-by-id@openssh.com" sftp-server extension (when available) to fill in user/group names for directory listings. * sftp-server(8): support the "home-directory" extension request defined in draft-ietf-secsh-filexfer-extensions-00. This overlaps a bit with the existing "expand-path@openssh.com", but some other clients support it. * ssh-keygen(1), sshd(8): allow certificate validity intervals, sshsig verification times and authorized_keys expiry-time options to accept dates in the UTC time zone in addition to the default of interpreting them in the system time zone. YYYYMMDD and YYMMDDHHMM[SS] dates/times will be interpreted as UTC if suffixed with a 'Z' character. Also allow certificate validity intervals to be specified in raw seconds-since-epoch as hex value, e.g. -V 0x1234:0x4567890. This is intended for use by regress tests and other tools that call ssh-keygen as part of a CA workflow. bz3468 * sftp(1): allow arguments to the sftp -D option, e.g. sftp -D "/usr/libexec/sftp-server -el debug3" * ssh-keygen(1): allow the existing -U (use agent) flag to work with "-Y sign" operations, where it will be interpreted to require that the private keys is hosted in an agent; bz3429 MFC after: 2 weeks Relnotes: Yes Sponsored by: The FreeBSD Foundation
* | ssh: update to OpenSSH v8.9p1Ed Maste2022-04-131-16/+5
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Release notes are available at https://www.openssh.com/txt/release-8.9 Some highlights: * ssh(1), sshd(8), ssh-add(1), ssh-agent(1): add a system for restricting forwarding and use of keys added to ssh-agent(1) * ssh(1), sshd(8): add the sntrup761x25519-sha512@openssh.com hybrid ECDH/x25519 + Streamlined NTRU Prime post-quantum KEX to the default KEXAlgorithms list (after the ECDH methods but before the prime-group DH ones). The next release of OpenSSH is likely to make this key exchange the default method. * sshd(8), portable OpenSSH only: this release removes in-built support for MD5-hashed passwords. If you require these on your system then we recommend linking against libxcrypt or similar. Future deprecation notice ========================= A near-future release of OpenSSH will switch scp(1) from using the legacy scp/rcp protocol to using SFTP by default. Legacy scp/rcp performs wildcard expansion of remote filenames (e.g. "scp host:* .") through the remote shell. This has the side effect of requiring double quoting of shell meta-characters in file names included on scp(1) command-lines, otherwise they could be interpreted as shell commands on the remote side. MFC after: 1 month Relnotes: Yes Sponsored by: The FreeBSD Foundation
* | openssh: update to OpenSSH v8.7p1Ed Maste2021-09-081-1/+63
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Some notable changes, from upstream's release notes: - sshd(8): Remove support for obsolete "host/port" syntax. - ssh(1): When prompting whether to record a new host key, accept the key fingerprint as a synonym for "yes". - ssh-keygen(1): when acting as a CA and signing certificates with an RSA key, default to using the rsa-sha2-512 signature algorithm. - ssh(1), sshd(8), ssh-keygen(1): this release removes the "ssh-rsa" (RSA/SHA1) algorithm from those accepted for certificate signatures. - ssh-sk-helper(8): this is a new binary. It is used by the FIDO/U2F support to provide address-space isolation for token middleware libraries (including the internal one). - ssh(1): this release enables UpdateHostkeys by default subject to some conservative preconditions. - scp(1): this release changes the behaviour of remote to remote copies (e.g. "scp host-a:/path host-b:") to transfer through the local host by default. - scp(1): experimental support for transfers using the SFTP protocol as a replacement for the venerable SCP/RCP protocol that it has traditionally used. Additional integration work is needed to support FIDO/U2F in the base system. Deprecation Notice ------------------ OpenSSH will disable the ssh-rsa signature scheme by default in the next release. Reviewed by: imp MFC after: 1 month Relnotes: Yes Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D29985
* | Upgrade to OpenSSH 7.6p1. This will be followed shortly by 7.7p1.Dag-Erling Smørgrav2018-05-081-22/+1
|\| | | | | | | | | | | | | | | | | This completely removes client-side support for the SSH 1 protocol, which was already disabled in 12 but is still enabled in 11. For that reason, we will not be able to merge 7.6p1 or newer back to 11. Notes: svn path=/head/; revision=333389
* | Upgrade OpenSSH to 6.1p1.Dag-Erling Smørgrav2012-09-031-0/+1
|\| | | | | | | Notes: svn path=/head/; revision=240075
* | Upgrade to OpenSSH 5.8p2.Dag-Erling Smørgrav2011-05-041-0/+1
|\| | | | | | | Notes: svn path=/head/; revision=221420
* | Upgrade to OpenSSH 5.1p1.Dag-Erling Smørgrav2008-08-011-0/+1
|\| | | | | | | | | | | | | | | | | | | | | | | | | I have worked hard to reduce diffs against the vendor branch. One notable change in that respect is that we no longer prefer DSA over RSA - the reasons for doing so went away years ago. This may cause some surprises, as ssh will warn about unknown host keys even for hosts whose keys haven't changed. MFC after: 6 weeks Notes: svn path=/head/; revision=181111
| * Properly flatten openssh/dist.Dag-Erling Smørgrav2008-07-221-337/+0
| | | | | | | | Notes: svn path=/vendor-crypto/openssh/dist/; revision=180720
| * Vendor import of OpenSSH 4.4p1.Dag-Erling Smørgrav2006-09-301-0/+2
| | | | | | | | Notes: svn path=/vendor-crypto/openssh/dist/; revision=162852
| * Vendor import of OpenSSH 4.2p1.Dag-Erling Smørgrav2005-09-031-0/+2
| | | | | | | | Notes: svn path=/vendor-crypto/openssh/dist/; revision=149749
| * Vendor import of OpenSSH 4.0p1.Dag-Erling Smørgrav2005-06-051-2/+3
| | | | | | | | Notes: svn path=/vendor-crypto/openssh/dist/; revision=146998
| * Vendor import of OpenSSH 3.8p1.Dag-Erling Smørgrav2004-02-261-22/+22
| | | | | | | | Notes: svn path=/vendor-crypto/openssh/dist/; revision=126274
| * Vendor import of OpenSSH 3.7.1p2.Dag-Erling Smørgrav2004-01-071-21/+139
| | | | | | | | Notes: svn path=/vendor-crypto/openssh/dist/; revision=124208
| * Vendor import of OpenSSH 3.3.Dag-Erling Smørgrav2002-06-231-0/+2
| | | | | | | | Notes: svn path=/vendor-crypto/openssh/dist/; revision=98675
* | Merge conflicts.Dag-Erling Smørgrav2006-09-301-0/+2
| | | | | | | | | | | | | | MFC after: 1 week Notes: svn path=/head/; revision=162856
* | Resolve conflicts.Dag-Erling Smørgrav2005-09-031-0/+2
| | | | | | | | Notes: svn path=/head/; revision=149753
* | Resolve conflicts.Dag-Erling Smørgrav2005-06-051-2/+3
| | | | | | | | Notes: svn path=/head/; revision=147005
* | Resolve conflicts.Dag-Erling Smørgrav2004-02-261-22/+22
| | | | | | | | Notes: svn path=/head/; revision=126277
* | Resolve conflicts and remove obsolete files.Dag-Erling Smørgrav2004-01-071-21/+139
| | | | | | | | | | | | | | Sponsored by: registrar.no Notes: svn path=/head/; revision=124211
* | Forcibly revert to mainline.Dag-Erling Smørgrav2002-06-271-44/+0
| | | | | | | | Notes: svn path=/head/; revision=98941
* | Resolve conflicts. Known issues:Dag-Erling Smørgrav2002-06-231-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | - sshd fails to set TERM correctly. - privilege separation may break PAM and is currently turned off. - man pages have not yet been updated I will have these issues resolved, and privilege separation turned on by default, in time for DP2. Sponsored by: DARPA, NAI Labs Notes: svn path=/head/; revision=98684
* | Note that portions of this software wereDag-Erling Smørgrav2002-03-201-0/+43
|/ | | | | | | Sponsored by: DARPA, NAI Labs Notes: svn path=/head/; revision=92836
* Vendor import of OpenSSH 3.1Dag-Erling Smørgrav2002-03-181-4/+80
| | | | Notes: svn path=/vendor-crypto/openssh/dist/; revision=92555
* Say "hi" to the latest in the OpenSSH series, version 2.9!Brian Feldman2001-05-041-4/+4
| | | | | | | Happy birthday to: rwatson Notes: svn path=/vendor-crypto/openssh/dist/; revision=76259
* Import of OpenSSH 2.3.0 (virgin OpenBSD source release).Brian Feldman2000-12-051-1/+1
| | | | Notes: svn path=/vendor-crypto/openssh/dist/; revision=69587
* Initial import of OpenSSH post-2.2.0 snapshot dated 2000-09-09Kris Kennaway2000-09-101-0/+136
Notes: svn path=/vendor-crypto/openssh/dist/; revision=65668
generated by cgit v1.2.3 (git 2.25.1) at 2026-01-27 16:25:27 +0000