https://lwn.net/Articles/946497/ LWN.net Logo LWN .net News from the source LWN * Content + Weekly Edition + Archives + Search + Kernel + Security + Events calendar + Unread comments + ------------------------------------------------------------- + LWN FAQ + Write for us User: [ ] Password: [ ] [Log in] | [Subscribe] | [Register] Subscribe / Log in / New account OpenSSH 9.5 released OpenSSH 9.5 is out. Significant changes include a transport-level ping mechanism and keystroke timing obfuscation: This attempts to hide inter-keystroke timings by sending interactive traffic at fixed intervals (default: every 20ms) when there is only a small amount of data being sent. It also sends fake "chaff" keystrokes for a random interval after the last real keystroke. These are controlled by a new ssh_config ObscureKeystrokeTiming keyword. --------------------------------------------------------------------- From: Damien Miller To: lwn-AT-lwn.net Subject: Announce: OpenSSH 9.5 released Date: Wed, 04 Oct 2023 04:27:22 -0600 Message-ID: <1b95b5395fec3c38@cvs.openbsd.org> OpenSSH 9.5 has just been released. It will be available from the mirrors listed at https://www.openssh.com/ shortly. OpenSSH is a 100% complete SSH protocol 2.0 implementation and includes sftp client and server support. Once again, we would like to thank the OpenSSH community for their continued support of the project, especially those who contributed code or patches, reported bugs, tested snapshots or donated to the project. More information on donations may be found at: https://www.openssh.com/donations.html Changes since OpenSSH 9.4 ========================= This release fixes a number of bugs and adds some small features. Potentially incompatible changes -------------------------------- * ssh-keygen(1): generate Ed25519 keys by default. Ed25519 public keys are very convenient due to their small size. Ed25519 keys are specified in RFC 8709 and OpenSSH has supported them since version 6.5 (January 2014). * sshd(8): the Subsystem directive now accurately preserves quoting of subsystem commands and arguments. This may change behaviour for exotic configurations, but the most common subsystem configuration (sftp-server) is unlikely to be affected. New features ------------ * ssh(1): add keystroke timing obfuscation to the client. This attempts to hide inter-keystroke timings by sending interactive traffic at fixed intervals (default: every 20ms) when there is only a small amount of data being sent. It also sends fake "chaff" keystrokes for a random interval after the last real keystroke. These are controlled by a new ssh_config ObscureKeystrokeTiming keyword. * ssh(1), sshd(8): Introduce a transport-level ping facility. This adds a pair of SSH transport protocol messages SSH2_MSG_PING/PONG to implement a ping capability. These messages use numbers in the "local extensions" number space and are advertised using a "ping@openssh.com" ext-info message with a string version number of "0". * sshd(8): allow override of Sybsystem directives in sshd Match blocks. Bugfixes -------- * scp(1): fix scp in SFTP mode recursive upload and download of directories that contain symlinks to other directories. In scp mode, the links would be followed, but in SFTP mode they were not. bz3611 * ssh-keygen(1): handle cr+lf (instead of just cr) line endings in sshsig signature files. * ssh(1): interactive mode for ControlPersist sessions if they originally requested a tty. * sshd(8): make PerSourceMaxStartups first-match-wins * sshd(8): limit artificial login delay to a reasonable maximum (5s) and don't delay at all for the "none" authentication mechanism.cw bz3602 * sshd(8): Log errors in kex_exchange_identification() with level verbose instead of error to reduce preauth log spam. All of those get logged with a more generic error message by sshpkt_fatal(). * sshd(8): correct math for ClientAliveInterval that caused the probes to be sent less frequently than configured. * ssh(1): fix regression in OpenSSH 9.4 (mux.c r1.99) that caused multiplexed sessions to ignore SIGINT under some circumstances. Portability ----------- * Avoid clang zero-call-used-regs=all bug on Apple compilers, which for some reason have version numbers that do not match the upstream clang version numbers. bz#3584 * Fix configure test for zlib 1.3 and later/development versions. bz3604 Checksums: ========== - SHA1 (openssh-9.5.tar.gz) = 8a0bd3a91fac338d97d91817af58df731f6509a3 - SHA256 (openssh-9.5.tar.gz) = sVMxeM3d6g65qBMktJIofxmK4Ipg9dblKif0VnhPeO0= - SHA1 (openssh-9.5p1.tar.gz) = 35c16dcc6e7d0a9465faa241476ef24f76b196cc - SHA256 (openssh-9.5p1.tar.gz) = 8Cbnt5un+1QPdRgq+W3IqPHbOV+SK7yfbKYDZyaGCGs= Please note that the SHA256 signatures are base64 encoded and not hexadecimal (which is the default for most checksum tools). The PGP key used to sign the releases is available from the mirror sites: https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/RELEASE_KEY.asc Reporting Bugs: =============== - Please read https://www.openssh.com/report.html Security bugs should be reported directly to openssh@openssh.com ----------------------------------------- (Log in to post comments) OpenSSH 9.5 released Posted Oct 4, 2023 15:28 UTC (Wed) by kilobyte (subscriber, #108024) [Link] Yet MPTCP support is still blocked because of "being available only on a single platform". That'd alone fix more user frustration than all other improvements in openssh taken together since at least a decade: when your link goes down, the ssh connection transparently migrates onto your phone. Got two similar quality links? The bandwidth gets summed. Running with a laptop to a place with a different access point? If your network card/software can handle multiple links, you're golden (NM/connman/... suck so bad here though). [Reply to this comment] OpenSSH 9.5 released Posted Oct 4, 2023 15:38 UTC (Wed) by Sesse (subscriber, #53779) [ Link] If that single platform were OpenBSD, I doubt it would be a blocker... :-) [Reply to this comment] OpenSSH 9.5 released Posted Oct 4, 2023 15:44 UTC (Wed) by kilobyte (subscriber, #108024) [Link] Well yeah, the vast majority of users are not on OpenBSD though. On the other hand, someone managed to get Linux network stack including MPTCP running on Windows via lkl (ie, in userspace, talking to a tun interface) -- perhaps the same could work on OpenBSD before it grows native support? [Reply to this comment] OpenSSH 9.5 released Posted Oct 4, 2023 16:30 UTC (Wed) by farnz (subscriber, #17727) [ Link] Can you link to references for the MPTCP support being blocked? The search terms '"openssh" "mptcp"' are sufficiently nondescript that I can't find anything, either on the OpenSSH Bugzilla, or via Google, or in the openssh-unix-dev mailing list archives. [Reply to this comment] OpenSSH 9.5 released Posted Oct 4, 2023 16:35 UTC (Wed) by kilobyte (subscriber, #108024) [Link] Anything that doesn't work on OpenBSD itself goes to openssh-portable; the pull request in question is https://github.com/ openssh/openssh-portable/pull/335 This said, I assume that openbsd kernel lacking an implementation is a temporary thing. [Reply to this comment] OpenSSH 9.5 released Posted Oct 4, 2023 22:19 UTC (Wed) by Sesse (subscriber, #53779) [ Link] Wow, that patch doesn't exactly strike me as a huge maintenance burden. [Reply to this comment] OpenSSH 9.5 released Posted Oct 4, 2023 16:32 UTC (Wed) by zdzichu (subscriber, #17118) [ Link] I think Darwin includes MPTCP, as is Linux 5.19+. So two platforms at least? [Reply to this comment] OpenSSH 9.5 released Posted Oct 4, 2023 18:02 UTC (Wed) by bluca (subscriber, #118303) [ Link] OpenSSH is pretty much a BSD project that sort of works on Linux as a side hobby. We really should band together a bunch of mainstream Linux distros and fork it, so that we can modernize it with things like MPTCP, AF_VSOCK and more. [Reply to this comment] Forking Posted Oct 4, 2023 18:34 UTC (Wed) by corbet (editor, #1) [Link] Might it be worth trying to contribute back to the portable OpenSSH project before forking? (Assuming, of course, that this has not already been tried). [Reply to this comment] Forking Posted Oct 4, 2023 18:39 UTC (Wed) by bluca (subscriber, #118303) [ Link] They routinely reject non-BSD specific features and enhancements. MPTCP, VRF, default config files in /usr/, AF_VSOCK, and more. It's not for lack of trying, patches do get sent. [Reply to this comment] Forking Posted Oct 4, 2023 19:30 UTC (Wed) by mjg59 (subscriber, #23239) [ Link] And it wouldn't be unheard of, most of the Windows integration is in a Microsoft fork rather than upstream. [Reply to this comment] Copyright (c) 2023, Eklektix, Inc. Comments and public postings are copyrighted by their creators. Linux is a registered trademark of Linus Torvalds