Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package openssh for openSUSE:Factory checked in at 2026-07-26 11:27:46 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/openssh (Old) and /work/SRC/openSUSE:Factory/.openssh.new.2004 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "openssh" Sun Jul 26 11:27:46 2026 rev:207 rq:1367363 version:10.4p1 Changes: -------- --- /work/SRC/openSUSE:Factory/openssh/openssh-askpass-gnome.changes 2026-04-26 21:11:46.770562915 +0200 +++ /work/SRC/openSUSE:Factory/.openssh.new.2004/openssh-askpass-gnome.changes 2026-07-26 11:29:45.417347828 +0200 @@ -1,0 +2,7 @@ +Thu Jul 16 22:41:22 UTC 2026 - Antonio Larrosa <[email protected]> + +- "Update" to openssh 10.4p1: + * No changes for askpass, see main package changelog for + details. + +------------------------------------------------------------------- --- /work/SRC/openSUSE:Factory/openssh/openssh.changes 2026-06-02 19:47:26.661440631 +0200 +++ /work/SRC/openSUSE:Factory/.openssh.new.2004/openssh.changes 2026-07-26 11:29:45.617354734 +0200 @@ -1,0 +2,192 @@ +Thu Jul 23 09:33:51 UTC 2026 - Antonio Larrosa <[email protected]> + +- Add patch submitted to upstream to fix GSSAPI* options not + working after servconf refactoring + (https://bugzilla.mindrot.org/show_bug.cgi?id=3974): + * 0001-Fix-GSSAPI-server-option-names.diff +- Rebase patches: + * openssh-8.0p1-gssapi-keyex.patch + * openssh-7.7p1-gssapi-new-unique.patch + +------------------------------------------------------------------- +Thu Jul 16 22:21:46 UTC 2026 - Antonio Larrosa <[email protected]> + +- Update to openssh 10.4p1: + = Potentially-incompatible changes + * sshd(8): configuration dump mode ("sshd -G") now writes + directives in mixed case (e.g. "PubkeyAuthentication") whereas + previously it emitted only lower-case names. + * sshd(8): on Linux systems with the seccomp sandbox enabled, + failures to enable SECCOMP or NO_NEW_PRIVS are now fatal. + Previously sshd(8) would log the error but continue operation, + to support systems that lacked these features. Now systems that + lack these should instead disable the sandbox at configure + time. + * ssh(1), sshd(8): make the transport protocol stricter by + disconnecting if the peer sends non-KEX messages during a post- + authentication key re-exchange. Previously a malicious peer + could continue sending non-key exchange messages without + penalty. These would be buffered, causing memory to be wasted + up until the connection terminated or the server/client hit a + memory limit. Implementations that do not restrict messages + sent during key exchange as per RFC4253 section 7.1 may be + disconnected. Reported by Marko Jevtic. + + = Security + * sftp(1): when downloading files on the command-line using + "sftp host:/path .", a malicious server could cause the file to + be downloaded to an unexpected location. This issue was + identified by the Swival Security Scanner. + * scp(1): when copying files between two remote destinations, do + not allow a malicious server to write files to the parent + directory of the intended target directory. This issue was + identified by the Swival Security Scanner. + * sshd(8): when using the "internal-sftp" SFTP server + implementation (this is not the default), long command lines + were previously truncated silently after the 9th argument. If a + security-relevant option was in the 10th or later position, it + would be discarded. Reported by Steve Caffrey. + * sshd(8): add a documentation note to mention that the + GSSAPIStrictAcceptorCheck option is ineffective when the server + is joined to a Windows Active Directory. Reported by Yarin + Aharoni of Safebreach. + * sshd(8): DisableForwarding=yes didn't override PermitTunnel=yes + as it was documented to do. Note that PermitTunnel is not + enabled by default. Reported independently by Huzaifa + Sidhpurwala of Redhat and Marko Jevtic. + * sshd(8): avoid a potential pre-authentication denial of service + when GSSAPIAuthentication was enabled (this feature is off by + default). This was not mitigated by MaxAuthTries, but would be + penalised by PerSourcePenalties. This was reported by Manfred + Kaiser of the milCERT AT (Austrian Ministry of Defence). + * sshd(8): fix a number of cases where the minimum authentication + delay was not being enforced. Reported by the Orange + Cyberdefense Vulnerability Team. + * ssh(1): fix a possible client-side use-after-free if the server + changes its host key during a key reexchange. This was reported + by Zhenpeng (Leo) Lin of Depthfirst. + + = New features + * All: add experimental support for a composite post-quantum + signature scheme that combines ML-DSA 44 and Ed25519 as + specified in draft-miller-sshm-mldsa44-ed25519-composite-sigs. + This scheme is not enabled by default. To use it, you'll need + to add it to HostKeyAlgorithms, PubkeyAcceptedAlgorithms, etc. + Keys may be generated using "ssh-keygen -t mldsa44-ed25519". + * ssh(1), sshd(8): replace the wildcard pattern matcher with an + implementation based on an NFA. This avoids exponential + worst-case behaviour for the old implementation. + = Bugfixes + * ssh-agent(1): fix incorrect reply to "query" + SSH_AGENTC_EXTENSION requests. bz3967 + * sshd(8): avoid sending observably different messages for valid + vs invalid users in GSSAPIAuthentication (disabled by default). + * ssh(1), sshd(8): fix several bugs that incorrectly + classified bulk traffic as interactive. bz3972, bz3958 + * ssh-keygen(1), ssh-add(1): skip unsupported key types when + downloading resident keys from a FIDO token. Previously, + downloads would abort when one was encountered. GHPR657 + * ssh(1): fix a potential use-after-free on an error path if + cipher_init() fails. + * sshd(8): perform stricter encoding and validation of transport + state passed between sshd privilege separation subprocesses. + This somewhat further hardens the server against attacks on + sshd-auth or sshd-session subprocesses. + * ssh-agent(1): avoid possible runtime denial of service by + enforcing some limits on the length of usernames in key use + constraints. + * sftp(1): fix two separate one-byte out-of-bounds reads, in + SSH2_FXP_REALPATH and batch command processing. + * sftp-server(8): disallow use of the copy-data extension to read + and write to the same inode simultaneously. + * ssh(1), sshd(8): avoid strlen(NULL) crash if an X11 channel was + created before the x11-req SSH_MSG_CHANNEL_REQUEST was sent. + GHPR679 + * sftp(1), scp(1): avoid a situation where sftp_download() could + get stuck in a loop if a broken server repeatedly returned zero + length while reading a file. + * ssh(1): avoid leaking DNS0x20 case-randomised names into names + canonicalised using CanonicalizePermittedCNAMEs. bz3966 + * sftp-server(8): avoid truncation of pathnames passed to lstat() + during SSH_FXP_REALPATH handling on systems where PATH_MAX is + not the actual max. GHPR688 + * ssh(1), sshd(8): correct arming of poll(2) event masks for some + socket-type channels. GHPR660 + * sshd(8): major refactor of sshd_config parsing and management + code, to allow for more exact serialisation/deserialisation + across privilege separation boundaries. + * ssh-add(1): open connection to the agent only after getopt() + processing has completed, to give options like "-v" a chance to + display debug information about this operation. + * crypto code: fix bounds checking when signing messages of + length greater than will fit in a size_t. In OpenSSH, message + sizes are bounded by SSHBUF_SIZE_MAX so this was unreachable. + * crypto code: add signature malleability and pubkey validity + checks to ed25519 verification. SSH doesn't depend on these + properties + * crypto code: fix ECDSA order check for curves with + cofactor != 1. All supported EC curves have cofactor 1, so this + was unreachable. + * sshd(8): differentiate between execution failures and a + subsystem that was not found when logging why a subsystem + failed to start. GHPR637 + * All: use safer idioms for timegm(3) and mktime(3) error + detection. + * ssh(1), sshd(8): avoid accepting invalid cipher or MAC lists in + config files or command-line arguments. This could cause + runtime failures later. + * ssh(1): fix NULL deref crash during pubkey auth when using a + PEM style private key with no corresponding .pub key adjacent + to it. + * sshd(8): don't print an error message when trying to load a + host private key when PKCS#11 keys are in use, as these don't + need the private half on the filesystem. GHPR664 + * All: don't use deprecated ERR_load_crypto_strings(). GHPR650 + * ssh(1): properly report errors during configuration default + setting. GHPR649 + * ssh(1): use correct directive name (Match instead of Host) in + error message. bz3968 + * sftp(1): fix "ls -ln" which was not correctly showing numeric + UID/GIDs but rather user and group names. bz3953 + * sshd(8): avoid possible NULL dereference if an allocation fails + during config parsing. bz3948 + * All: fix ineffective guards against loading overly large public + keys in several places. bz3969 and bz3970 + * sftp(1): ensure file descriptors used by sftp to communicate to + its ssh(1) subprocess don't leak into executed subprocesses + (e.g. via "!"). GHPR693 + + = Portability + * Sync fmt_scaled.c with OpenBSD upstream, picking up an + exactness fix for large exponents (GHPR671) + * sshd(8): remove duplicate sandbox entry for clock_gettime64. + * ssh(1), sshd(8): use correct IPTOS_DSCP_VA value if not + provided by the system headers. + * Sync getrrsetbyname.c with OpenBSD upstream, picking up + robustness fixes. + * Disable replacements in openbsd-compat for strvisx(3) and + stravis(3), as these are unused in OpenSSH + * Avoid fortify warnings on Android bz3954 + * Fix a number of memory leaks on error paths in the portability + code. GHPR681 + * Revise the README.privsep documentation to reflect sshd's + recent switch to a multi-binary model. + +- Rebase patches: + * openssh-6.6p1-privsep-selinux.patch + * openssh-7.7p1-allow_root_password_login.patch + * openssh-7.7p1-fips.patch + * openssh-7.7p1-gssapi-new-unique.patch + * openssh-7.7p1-pam_check_locks.patch + * openssh-7.8p1-role-mls.patch + * openssh-7.9p1-revert-new-qos-defaults.patch + * openssh-8.0p1-gssapi-keyex.patch + * openssh-8.1p1-ed25519-use-openssl-rng.patch + * openssh-8.4p1-vendordir.patch + +- Drop patches that are already included by upstream: + * openssh-8.1p1-seccomp-clock_nanosleep.patch + * openssh-8.1p1-seccomp-clock_nanosleep_time64.patch + * fix-mac-validation-strsep-logic-bug.patch + +------------------------------------------------------------------- Old: ---- fix-mac-validation-strsep-logic-bug.patch openssh-10.3p1.tar.gz openssh-10.3p1.tar.gz.asc openssh-8.1p1-seccomp-clock_nanosleep.patch openssh-8.1p1-seccomp-clock_nanosleep_time64.patch New: ---- 0001-Fix-GSSAPI-server-option-names.diff openssh-10.4p1.tar.gz openssh-10.4p1.tar.gz.asc ----------(Old B)---------- Old:/work/SRC/openSUSE:Factory/.openssh.new.2004/openssh.changes- * openssh-8.1p1-seccomp-clock_nanosleep_time64.patch /work/SRC/openSUSE:Factory/.openssh.new.2004/openssh.changes: * fix-mac-validation-strsep-logic-bug.patch /work/SRC/openSUSE:Factory/.openssh.new.2004/openssh.changes- Old:/work/SRC/openSUSE:Factory/.openssh.new.2004/openssh.changes-- Drop patches that are already included by upstream: /work/SRC/openSUSE:Factory/.openssh.new.2004/openssh.changes: * openssh-8.1p1-seccomp-clock_nanosleep.patch /work/SRC/openSUSE:Factory/.openssh.new.2004/openssh.changes- * openssh-8.1p1-seccomp-clock_nanosleep_time64.patch Old:/work/SRC/openSUSE:Factory/.openssh.new.2004/openssh.changes- * openssh-8.1p1-seccomp-clock_nanosleep.patch /work/SRC/openSUSE:Factory/.openssh.new.2004/openssh.changes: * openssh-8.1p1-seccomp-clock_nanosleep_time64.patch /work/SRC/openSUSE:Factory/.openssh.new.2004/openssh.changes- * fix-mac-validation-strsep-logic-bug.patch ----------(Old E)---------- ----------(New B)---------- New:/work/SRC/openSUSE:Factory/.openssh.new.2004/openssh.changes- (https://bugzilla.mindrot.org/show_bug.cgi?id=3974): /work/SRC/openSUSE:Factory/.openssh.new.2004/openssh.changes: * 0001-Fix-GSSAPI-server-option-names.diff /work/SRC/openSUSE:Factory/.openssh.new.2004/openssh.changes-- Rebase patches: ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ openssh-askpass-gnome.spec ++++++ --- /var/tmp/diff_new_pack.DQBdnc/_old 2026-07-26 11:29:50.805533882 +0200 +++ /var/tmp/diff_new_pack.DQBdnc/_new 2026-07-26 11:29:50.809534021 +0200 @@ -18,8 +18,8 @@ %define _name openssh Name: openssh-askpass-gnome -Version: 10.3p1 -%define wrongly_named_version 10.3p1 +Version: 10.4p1 +%define wrongly_named_version 10.4p1 Release: 0 Summary: A GNOME-Based Passphrase Dialog for OpenSSH License: BSD-2-Clause ++++++ openssh.spec ++++++ --- /var/tmp/diff_new_pack.DQBdnc/_old 2026-07-26 11:29:50.885536645 +0200 +++ /var/tmp/diff_new_pack.DQBdnc/_new 2026-07-26 11:29:50.885536645 +0200 @@ -59,7 +59,7 @@ %define _fillupdir %{_localstatedir}/adm/fillup-templates %endif Name: openssh -Version: 10.3p1 +Version: 10.4p1 Release: 0 Summary: Secure Shell Client and Server (Remote Login Program) License: BSD-2-Clause AND MIT @@ -83,6 +83,8 @@ Source15: sshd-sle.pamd Source16: [email protected] Source17: sshd.socket +# PATCH-FIX-UPSTREAM 0001-Fix-GSSAPI-server-option-names.diff https://bugzilla.mindrot.org/show_bug.cgi?id=3974 +Patch0: 0001-Fix-GSSAPI-server-option-names.diff # PATCH-FEATURE-SUSE openssh-7.7p1-X11_trusted_forwarding.patch bsc#50836 -- Enable trusted X11 forwarding by default Patch1: openssh-7.7p1-X11_trusted_forwarding.patch # PATCH-FEATURE-SUSE openssh-7.7p1-enable_PAM_by_default.patch bsc#46749 -- UsePAM yes in default sshd_config @@ -137,10 +139,6 @@ Patch34: openssh-7.9p1-keygen-preserve-perms.patch # PATCH-FIX-SUSE openssh-7.9p1-revert-new-qos-defaults.patch bsc#1136402 [email protected] -- Revert upstream IPQoS AF21/CS1 defaults Patch35: openssh-7.9p1-revert-new-qos-defaults.patch -# PATCH-FIX-SUSE openssh-8.1p1-seccomp-clock_nanosleep.patch -- Allow clock_nanosleep() in seccomp sandbox -Patch36: openssh-8.1p1-seccomp-clock_nanosleep.patch -# PATCH-FIX-UPSTREAM openssh-8.1p1-seccomp-clock_nanosleep_time64.patch boo#1164061 mindrot#3100 -- Allow clock_nanosleep_time64 (ARM) -Patch37: openssh-8.1p1-seccomp-clock_nanosleep_time64.patch # PATCH-FIX-UPSTREAM openssh-8.1p1-seccomp-clock_gettime64.patch boo#1164061 [email protected] -- Allow clock_gettime64() (mips) Patch38: openssh-8.1p1-seccomp-clock_gettime64.patch # PATCH-FEATURE-SUSE openssh-8.1p1-use-openssl-kdf.patch jsc#SLE-9443 -- Use OpenSSL KDF API to stay in FIPS boundary @@ -181,8 +179,6 @@ Patch107: openssh-send-extra-term-env.patch # PATCH-FIX-SUSE openssh-7.7p1-gssapi-new-unique.patch bsc#1258166 [email protected] -- SSSD non-file ccache: krb5 new_unique Patch108: openssh-7.7p1-gssapi-new-unique.patch -# PATCH-FIX-SUSE fix-mac-validation-strsep-logic-bug.patch bsc#1264568 [email protected] -- Fix strsep logic bug in mac validation -Patch109: fix-mac-validation-strsep-logic-bug.patch # 200..300 -- Patches submitted to upstream # 1000..2000 -- Conditional patches %if %{with crypto_policies} ++++++ 0001-Fix-GSSAPI-server-option-names.diff ++++++ >From 35570cb2ae401a127b8b7f88d0938e759f83b5be Mon Sep 17 00:00:00 2001 From: Colin Watson <[email protected]> Date: Mon, 6 Jul 2026 13:27:43 +0100 Subject: [PATCH] Fix GSSAPI server option names Broken by bebc855fdb3f8c7f96fd392f67bec2134cc42b1b, presumably because the previous `sGss*` enumeration item names didn't quite match the names documented in sshd_config(5). --- servconf.c | 16 ++++++++-------- servconf.h | 16 ++++++++-------- 2 files changed, 16 insertions(+), 16 deletions(-) diff --git a/servconf.c b/servconf.c index ce388f1dd..2f6c966b5 100644 --- a/servconf.c +++ b/servconf.c @@ -1433,19 +1433,19 @@ process_server_config_line_depth(ServerOptions *options, char *line, #endif /* KRB5 */ #ifdef GSSAPI - case sGssAuthentication: + case sGSSAPIAuthentication: intptr = &options->gss_authentication; goto parse_flag; - case sGssCleanupCreds: + case sGSSAPICleanupCredentials: intptr = &options->gss_cleanup_creds; goto parse_flag; - case sGssDelegateCreds: + case sGSSAPIDelegateCredentials: intptr = &options->gss_deleg_creds; goto parse_flag; - case sGssStrictAcceptor: + case sGSSAPIStrictAcceptorCheck: intptr = &options->gss_strict_acceptor; goto parse_flag; #endif /* GSSAPI */ @@ -4215,10 +4215,10 @@ dump_config(ServerOptions *o) # endif #endif #ifdef GSSAPI - dump_cfg_fmtint(sGssAuthentication, o->gss_authentication); - dump_cfg_fmtint(sGssCleanupCreds, o->gss_cleanup_creds); - dump_cfg_fmtint(sGssDelegateCreds, o->gss_deleg_creds); - dump_cfg_fmtint(sGssStrictAcceptor, o->gss_strict_acceptor); + dump_cfg_fmtint(sGSSAPIAuthentication, o->gss_authentication); + dump_cfg_fmtint(sGSSAPICleanupCredentials, o->gss_cleanup_creds); + dump_cfg_fmtint(sGSSAPIDelegateCredentials, o->gss_deleg_creds); + dump_cfg_fmtint(sGSSAPIStrictAcceptorCheck, o->gss_strict_acceptor); #endif dump_cfg_fmtint(sPasswordAuthentication, o->password_authentication); dump_cfg_fmtint(sKbdInteractiveAuthentication, diff --git a/servconf.h b/servconf.h index 9e64e4673..de30d28f5 100644 --- a/servconf.h +++ b/servconf.h @@ -314,16 +314,16 @@ SSHCONF_UNSUPPORTED_INT(kerberos_get_afs_token, KerberosGetAFSToken, SSHCFG_GLOB #ifdef GSSAPI #define SSHD_CONFIG_ENTRIES_GSS \ -SSHCONF_INTFLAG(gss_authentication, GssAuthentication, SSHCFG_ALL, 0, SSHCFG_COPY_MATCH) \ -SSHCONF_INTFLAG(gss_cleanup_creds, GssCleanupCreds, SSHCFG_GLOBAL, 1, SSHCFG_COPY_NONE) \ -SSHCONF_INTFLAG(gss_deleg_creds, GssDelegateCreds, SSHCFG_GLOBAL, 1, SSHCFG_COPY_NONE) \ -SSHCONF_INTFLAG(gss_strict_acceptor, GssStrictAcceptor, SSHCFG_GLOBAL, 1, SSHCFG_COPY_NONE) +SSHCONF_INTFLAG(gss_authentication, GSSAPIAuthentication, SSHCFG_ALL, 0, SSHCFG_COPY_MATCH) \ +SSHCONF_INTFLAG(gss_cleanup_creds, GSSAPICleanupCredentials, SSHCFG_GLOBAL, 1, SSHCFG_COPY_NONE) \ +SSHCONF_INTFLAG(gss_deleg_creds, GSSAPIDelegateCredentials, SSHCFG_GLOBAL, 1, SSHCFG_COPY_NONE) \ +SSHCONF_INTFLAG(gss_strict_acceptor, GSSAPIStrictAcceptorCheck, SSHCFG_GLOBAL, 1, SSHCFG_COPY_NONE) #else /* GSSAPI */ #define SSHD_CONFIG_ENTRIES_GSS \ -SSHCONF_UNSUPPORTED_INT(gss_authentication, GssAuthentication, SSHCFG_ALL) \ -SSHCONF_UNSUPPORTED_INT(gss_cleanup_creds, GssCleanupCreds, SSHCFG_GLOBAL) \ -SSHCONF_UNSUPPORTED_INT(gss_deleg_creds, GssDelegateCreds, SSHCFG_GLOBAL) \ -SSHCONF_UNSUPPORTED_INT(gss_strict_acceptor, GssStrictAcceptor, SSHCFG_GLOBAL) +SSHCONF_UNSUPPORTED_INT(gss_authentication, GSSAPIAuthentication, SSHCFG_ALL) \ +SSHCONF_UNSUPPORTED_INT(gss_cleanup_creds, GSSAPICleanupCredentials, SSHCFG_GLOBAL) \ +SSHCONF_UNSUPPORTED_INT(gss_deleg_creds, GSSAPIDelegateCredentials, SSHCFG_GLOBAL) \ +SSHCONF_UNSUPPORTED_INT(gss_strict_acceptor, GSSAPIStrictAcceptorCheck, SSHCFG_GLOBAL) #endif /* GSSAPI */ #define SSHD_CONFIG_ENTRIES \ -- 2.53.0 ++++++ openssh-10.3p1.tar.gz -> openssh-10.4p1.tar.gz ++++++ ++++ 58018 lines of diff (skipped) ++++++ openssh-6.6p1-privsep-selinux.patch ++++++ --- /var/tmp/diff_new_pack.DQBdnc/_old 2026-07-26 11:29:51.745566342 +0200 +++ /var/tmp/diff_new_pack.DQBdnc/_new 2026-07-26 11:29:51.753566618 +0200 @@ -89,13 +89,13 @@ execl(_PATH_PASSWD_PROG, "passwd", s->pw->pw_name, (char *)NULL); @@ -1723,9 +1728,6 @@ do_child(struct ssh *ssh, Session *s, co - argv[i] = NULL; + } optind = optreset = 1; - __progname = argv[0]; + __progname = sftp_argv[0]; -#ifdef WITH_SELINUX - ssh_selinux_change_context("sftpd_t"); -#endif - exit(sftp_server_main(i, argv, s->pw)); + exit(sftp_server_main(sftp_argc, sftp_argv, s->pw)); } Index: openssh-10/sshd-auth.c ++++++ openssh-7.7p1-allow_root_password_login.patch ++++++ --- /var/tmp/diff_new_pack.DQBdnc/_old 2026-07-26 11:29:51.785567723 +0200 +++ /var/tmp/diff_new_pack.DQBdnc/_new 2026-07-26 11:29:51.793567999 +0200 @@ -7,17 +7,17 @@ Index: openssh-10.3p1/servconf.c =================================================================== ---- openssh-10.3p1.orig/servconf.c -+++ openssh-10.3p1/servconf.c -@@ -355,7 +355,7 @@ fill_default_server_options(ServerOption - if (options->login_grace_time == -1) - options->login_grace_time = 120; - if (options->permit_root_login == PERMIT_NOT_SET) -- options->permit_root_login = PERMIT_NO_PASSWD; -+ options->permit_root_login = PERMIT_YES; - if (options->ignore_rhosts == -1) - options->ignore_rhosts = 1; - if (options->ignore_user_known_hosts == -1) +--- openssh-10.3p1.orig/servconf.h ++++ openssh-10.3p1/servconf.h +@@ -166,7 +166,7 @@ fill_default_server_options(ServerOption + SSHCONF_STRING(pid_file, PidFile, SSHCFG_GLOBAL, SSHCFG_COPY_NONE) \ + SSHCONF_STRING(moduli_file, ModuliFile, SSHCFG_GLOBAL, SSHCFG_COPY_NONE) \ + SSHCONF_INT(login_grace_time, LoginGraceTime, SSHCFG_GLOBAL, NULL, SSHD_DEFAULT_LOGIN_GRACE_TIME, SSHCFG_COPY_NONE) \ +-SSHCONF_INT(permit_root_login, PermitRootLogin, SSHCFG_ALL, multistate_permitrootlogin, PERMIT_NO_PASSWD, SSHCFG_COPY_MATCH) \ ++SSHCONF_INT(permit_root_login, PermitRootLogin, SSHCFG_ALL, multistate_permitrootlogin, PERMIT_YES, SSHCFG_COPY_MATCH) \ + SSHCONF_INT(ignore_rhosts, IgnoreRhosts, SSHCFG_ALL, multistate_ignore_rhosts, 1, SSHCFG_COPY_MATCH) \ + SSHCONF_INTFLAG(ignore_user_known_hosts, IgnoreUserKnownHosts, SSHCFG_GLOBAL, 0, SSHCFG_COPY_NONE) \ + SSHCONF_INTFLAG(print_motd, PrintMotd, SSHCFG_GLOBAL, 1, SSHCFG_COPY_NONE) \ Index: openssh-10.3p1/sshd_config =================================================================== --- openssh-10.3p1.orig/sshd_config ++++++ openssh-7.7p1-fips.patch ++++++ --- /var/tmp/diff_new_pack.DQBdnc/_old 2026-07-26 11:29:51.817568828 +0200 +++ /var/tmp/diff_new_pack.DQBdnc/_new 2026-07-26 11:29:51.821568966 +0200 @@ -130,9 +130,9 @@ - char *cipher_list, *cp; - char *p; + char *cipher_list, *cp, *p; + int found = 0; if (names == NULL || strcmp(names, "") == 0) - return 0; @@ -213,7 +260,7 @@ ciphers_valid(const char *names) return 0; for ((p = strsep(&cp, CIPHER_SEP)); p && *p != '\0'; @@ -143,7 +143,7 @@ free(cipher_list); return 0; @@ -223,6 +270,31 @@ ciphers_valid(const char *names) - return 1; + return found; } +int @@ -733,7 +733,7 @@ + int (*setup)(struct sshmac *, char *)) { char *maclist, *cp, *p; - + int found = 0; @@ -243,7 +300,7 @@ mac_valid(const char *names) return 0; for ((p = strsep(&cp, MAC_SEP)); p && *p != '\0'; @@ -742,10 +742,10 @@ + if (setup(NULL, p) < 0) { free(maclist); return 0; - } + } else @@ -251,3 +308,15 @@ mac_valid(const char *names) free(maclist); - return 1; + return found; } + +int @@ -866,8 +866,8 @@ #include "version.h" +#include "fips.h" - #if !defined(SSHD_PAM_SERVICE) - # define SSHD_PAM_SERVICE "sshd" + #define SSHD_CONFIG_BLOB_VERSION 1 + @@ -223,6 +224,25 @@ option_clear_or_none(const char *o) return o == NULL || strcasecmp(o, "none") == 0; } @@ -904,14 +904,14 @@ void @@ -482,6 +504,8 @@ fill_default_server_options(ServerOption + options->fwd_opts.streamlocal_bind_mask = 0177; + if (options->fwd_opts.streamlocal_bind_unlink == -1) options->fwd_opts.streamlocal_bind_unlink = 0; - if (options->fingerprint_hash == -1) - options->fingerprint_hash = SSH_FP_HASH_DEFAULT; + options->fingerprint_hash = + fips_correct_dgst(options->fingerprint_hash); - if (options->disable_forwarding == -1) - options->disable_forwarding = 0; - if (options->expose_userauth_info == -1) + if (options->sk_provider == NULL) + options->sk_provider = xstrdup("internal"); + if (options->sshd_session_path == NULL) @@ -1928,7 +1952,7 @@ process_server_config_line_depth(ServerO fatal("%s line %d: %s missing argument.", filename, linenum, keyword); ++++++ openssh-7.7p1-gssapi-new-unique.patch ++++++ --- /var/tmp/diff_new_pack.DQBdnc/_old 2026-07-26 11:29:51.845569795 +0200 +++ /var/tmp/diff_new_pack.DQBdnc/_new 2026-07-26 11:29:51.865570485 +0200 @@ -497,78 +497,45 @@ =================================================================== --- openssh-10.3p1.orig/servconf.c +++ openssh-10.3p1/servconf.c -@@ -133,6 +133,7 @@ initialize_server_options(ServerOptions - options->kerberos_or_local_passwd = -1; - options->kerberos_ticket_cleanup = -1; - options->kerberos_get_afs_token = -1; -+ options->kerberos_unique_ccache = -1; - options->gss_authentication=-1; - options->gss_keyex = -1; - options->gss_cleanup_creds = -1; -@@ -397,6 +398,8 @@ fill_default_server_options(ServerOption - options->kerberos_ticket_cleanup = 1; - if (options->kerberos_get_afs_token == -1) - options->kerberos_get_afs_token = 0; -+ if (options->kerberos_unique_ccache == -1) -+ options->kerberos_unique_ccache = 0; - if (options->gss_authentication == -1) - options->gss_authentication = 0; - if (options->gss_keyex == -1) -@@ -586,7 +589,7 @@ typedef enum { - sPort, sHostKeyFile, sLoginGraceTime, - sPermitRootLogin, sLogFacility, sLogLevel, sLogVerbose, - sKerberosAuthentication, sKerberosOrLocalPasswd, sKerberosTicketCleanup, -- sKerberosGetAFSToken, sPasswordAuthentication, -+ sKerberosGetAFSToken, sKerberosUniqueCCache, sPasswordAuthentication, - sKbdInteractiveAuthentication, sListenAddress, sAddressFamily, - sPrintMotd, sPrintLastLog, sIgnoreRhosts, - sX11Forwarding, sX11DisplayOffset, sX11UseLocalhost, -@@ -679,11 +682,13 @@ static struct { - #else - { "kerberosgetafstoken", sUnsupported, SSHCFG_GLOBAL }, - #endif -+ { "kerberosuniqueccache", sKerberosUniqueCCache, SSHCFG_GLOBAL }, - #else - { "kerberosauthentication", sUnsupported, SSHCFG_ALL }, - { "kerberosorlocalpasswd", sUnsupported, SSHCFG_GLOBAL }, - { "kerberosticketcleanup", sUnsupported, SSHCFG_GLOBAL }, - { "kerberosgetafstoken", sUnsupported, SSHCFG_GLOBAL }, -+ { "kerberosuniqueccache", sUnsupported, SSHCFG_GLOBAL }, - #endif - { "kerberostgtpassing", sUnsupported, SSHCFG_GLOBAL }, - { "afstokenpassing", sUnsupported, SSHCFG_GLOBAL }, -@@ -1699,6 +1704,10 @@ process_server_config_line_depth(ServerO +@@ -1699,6 +1699,11 @@ process_server_config_line_depth(ServerO intptr = &options->kerberos_get_afs_token; goto parse_flag; - + #endif /* USE_AFS */ ++ + case sKerberosUniqueCCache: + intptr = &options->kerberos_unique_ccache; + goto parse_flag; + - case sGssAuthentication: - intptr = &options->gss_authentication; - goto parse_flag; -@@ -3359,6 +3368,7 @@ dump_config(ServerOptions *o) + #endif /* KRB5 */ + + #ifdef GSSAPI +@@ -3363,6 +3368,7 @@ dump_config(ServerOptions *o) # ifdef USE_AFS dump_cfg_fmtint(sKerberosGetAFSToken, o->kerberos_get_afs_token); # endif + dump_cfg_fmtint(sKerberosUniqueCCache, o->kerberos_unique_ccache); #endif #ifdef GSSAPI - dump_cfg_fmtint(sGssAuthentication, o->gss_authentication); + dump_cfg_fmtint(sGSSAPIAuthentication, o->gss_authentication); Index: openssh-10.3p1/servconf.h =================================================================== --- openssh-10.3p1.orig/servconf.h +++ openssh-10.3p1/servconf.h -@@ -150,6 +150,8 @@ typedef struct { - * file on logout. */ - int kerberos_get_afs_token; /* If true, try to get AFS token if - * authenticated with Kerberos. */ -+ int kerberos_unique_ccache; /* If true, the acquired ticket will -+ * be stored in per-session ccache */ - int gss_authentication; /* If true, permit GSSAPI authentication */ - int gss_keyex; /* If true, permit GSSAPI key exchange */ - int gss_cleanup_creds; /* If true, destroy cred cache on logout */ +@@ -303,12 +303,14 @@ SSHCONF_UNSUPPORTED_INT(kerberos_get_afs_token, KerberosGetAFSToken, SSHCFG_GLOB + SSHCONF_INTFLAG(kerberos_authentication, KerberosAuthentication, SSHCFG_ALL, 0, SSHCFG_COPY_MATCH) \ + SSHCONF_INTFLAG(kerberos_or_local_passwd, KerberosOrLocalPasswd, SSHCFG_GLOBAL, 1, SSHCFG_COPY_NONE) \ + SSHCONF_INTFLAG(kerberos_ticket_cleanup, KerberosTicketCleanup, SSHCFG_GLOBAL, 1, SSHCFG_COPY_NONE) \ ++SSHCONF_INTFLAG(kerberos_unique_ccache, KerberosUniqueCCache, SSHCFG_GLOBAL, 0, SSHCFG_COPY_NONE) \ + SSHD_CONFIG_KRB5_AFS + #else /* KRB5 */ + #define SSHD_CONFIG_ENTRIES_KRB5 \ + SSHCONF_UNSUPPORTED_INT(kerberos_authentication, KerberosAuthentication, SSHCFG_ALL) \ + SSHCONF_UNSUPPORTED_INT(kerberos_or_local_passwd, KerberosOrLocalPasswd, SSHCFG_GLOBAL) \ + SSHCONF_UNSUPPORTED_INT(kerberos_ticket_cleanup, KerberosTicketCleanup, SSHCFG_GLOBAL) \ ++SSHCONF_UNSUPPORTED_INT(kerberos_unique_ccache, KerberosUniqueCCache, SSHCFG_GLOBAL) \ + SSHCONF_UNSUPPORTED_INT(kerberos_get_afs_token, KerberosGetAFSToken, SSHCFG_GLOBAL) + #endif /* KRB5 */ + Index: openssh-10.3p1/session.c =================================================================== --- openssh-10.3p1.orig/session.c ++++++ openssh-7.7p1-pam_check_locks.patch ++++++ --- /var/tmp/diff_new_pack.DQBdnc/_old 2026-07-26 11:29:51.897571591 +0200 +++ /var/tmp/diff_new_pack.DQBdnc/_new 2026-07-26 11:29:51.905571867 +0200 @@ -5,11 +5,11 @@ bnc#708678, FATE#312033 -Index: openssh-8.8p1/auth.c +Index: openssh-10.4p1/auth.c =================================================================== ---- openssh-8.8p1.orig/auth.c -+++ openssh-8.8p1/auth.c -@@ -113,7 +113,7 @@ allowed_user(struct ssh *ssh, struct pas +--- openssh-10.4p1.orig/auth.c ++++ openssh-10.4p1/auth.c +@@ -105,7 +105,7 @@ allowed_user(struct ssh *ssh, struct pas if (!pw || !pw->pw_name) return 0; @@ -18,84 +18,31 @@ logit("User %.100s not allowed because account is locked", pw->pw_name); return 0; -#@@ -133,7 +133,7 @@ allowed_user(struct ssh *ssh, struct pas -# #endif -# -# /* check for locked account */ -#- if (!options.use_pam && passwd && *passwd) { -#+ if ((!options.use_pam || options.use_pam_check_locks) && passwd && *passwd) { -# int locked = 0; -# -# #ifdef LOCKED_PASSWD_STRING -Index: openssh-8.8p1/servconf.c +Index: openssh-10.4p1/servconf.h =================================================================== ---- openssh-8.8p1.orig/servconf.c -+++ openssh-8.8p1/servconf.c -@@ -92,6 +92,7 @@ initialize_server_options(ServerOptions - /* Portable-specific options */ - options->use_pam = -1; - options->pam_service_name = NULL; -+ options->use_pam_check_locks = -1; - - /* Standard Options */ - options->num_ports = 0; -@@ -278,6 +279,8 @@ fill_default_server_options(ServerOption - options->use_pam = 0; - if (options->pam_service_name == NULL) - options->pam_service_name = xstrdup(SSHD_PAM_SERVICE); -+ if (options->use_pam_check_locks == -1) -+ options->use_pam_check_locks = 0; - - /* Standard Options */ - if (options->num_host_key_files == 0) { -@@ -485,7 +488,7 @@ fill_default_server_options(ServerOption - typedef enum { - sBadOption, /* == unknown option */ - /* Portable-specific options */ -- sUsePAM, sPAMServiceName, -+ sUsePAM, sPAMServiceName, sUsePAMChecklocks, - /* Standard Options */ - sPort, sHostKeyFile, sLoginGraceTime, - sPermitRootLogin, sLogFacility, sLogLevel, sLogVerbose, -@@ -535,9 +538,11 @@ static struct { +--- openssh-10.4p1.orig/servconf.h ++++ openssh-10.4p1/servconf.h +@@ -273,11 +273,13 @@ SSHCONF_ALIAS(KeepAlive, TCPKeepAlive, S #ifdef USE_PAM - { "usepam", sUsePAM, SSHCFG_GLOBAL }, - { "pamservicename", sPAMServiceName, SSHCFG_ALL }, -+ { "usepamchecklocks", sUsePAMChecklocks, SSHCFG_GLOBAL }, + #define SSHD_CONFIG_ENTRIES_PAM \ + SSHCONF_INTFLAG(use_pam, UsePAM, SSHCFG_GLOBAL, 0, SSHCFG_COPY_NONE) \ +-SSHCONF_STRING(pam_service_name, PAMServiceName, SSHCFG_GLOBAL, SSHCFG_COPY_NONE) ++SSHCONF_STRING(pam_service_name, PAMServiceName, SSHCFG_GLOBAL, SSHCFG_COPY_NONE) \ ++SSHCONF_INTFLAG(use_pam_check_locks, UsePAMChecklocks, SSHCFG_GLOBAL, 0, SSHCFG_COPY_NONE) #else - { "usepam", sUnsupported, SSHCFG_GLOBAL }, - { "pamservicename", sUnsupported, SSHCFG_ALL }, -+ { "usepamchecklocks", sUnsupported, SSHCFG_GLOBAL }, + #define SSHD_CONFIG_ENTRIES_PAM \ + SSHCONF_UNSUPPORTED_INT(use_pam, UsePAM, SSHCFG_GLOBAL) \ +-SSHCONF_UNSUPPORTED_STRING(pam_service_name, PAMServiceName, SSHCFG_GLOBAL) ++SSHCONF_UNSUPPORTED_STRING(pam_service_name, PAMServiceName, SSHCFG_GLOBAL) \ ++SSHCONF_UNSUPPORTED_STRING(use_pam_check_locks, UsePAMChecklocks, SSHCFG_GLOBAL) #endif - { "pamauthenticationviakbdint", sDeprecated, SSHCFG_GLOBAL }, - /* Standard Options */ -@@ -1331,6 +1336,9 @@ process_server_config_line_depth(ServerO - if (*activep && *charptr == NULL) - *charptr = xstrdup(arg); - break; -+ case sUsePAMChecklocks: -+ intptr = &options->use_pam_check_locks; -+ goto parse_flag; - - /* Standard Options */ - case sBadOption: -Index: openssh-8.8p1/servconf.h -=================================================================== ---- openssh-8.8p1.orig/servconf.h -+++ openssh-8.8p1/servconf.h -@@ -200,6 +200,7 @@ typedef struct { - - int use_pam; /* Enable auth via PAM */ - char *pam_service_name; -+ int use_pam_check_locks; /* internally check for locked accounts even when using PAM */ - - int permit_tun; -Index: openssh-8.8p1/sshd_config.0 + #ifdef DISABLE_LASTLOG +Index: openssh-10.4p1/sshd_config.0 =================================================================== ---- openssh-8.8p1.orig/sshd_config.0 -+++ openssh-8.8p1/sshd_config.0 -@@ -1074,6 +1074,14 @@ DESCRIPTION +--- openssh-10.4p1.orig/sshd_config.0 ++++ openssh-10.4p1/sshd_config.0 +@@ -1330,6 +1330,14 @@ DESCRIPTION If UsePAM is enabled, you will not be able to run sshd(8) as a non-root user. The default is no. @@ -110,11 +57,11 @@ VersionAddendum Optionally specifies additional text to append to the SSH protocol banner sent by the server upon connection. The default -Index: openssh-8.8p1/sshd_config.5 +Index: openssh-10.4p1/sshd_config.5 =================================================================== ---- openssh-8.8p1.orig/sshd_config.5 -+++ openssh-8.8p1/sshd_config.5 -@@ -1775,6 +1775,18 @@ is enabled, you will not be able to run +--- openssh-10.4p1.orig/sshd_config.5 ++++ openssh-10.4p1/sshd_config.5 +@@ -2087,6 +2087,18 @@ is enabled, you will not be able to run as a non-root user. The default is .Cm no . ++++++ openssh-7.8p1-role-mls.patch ++++++ --- /var/tmp/diff_new_pack.DQBdnc/_old 2026-07-26 11:29:51.969574077 +0200 +++ /var/tmp/diff_new_pack.DQBdnc/_new 2026-07-26 11:29:51.977574353 +0200 @@ -73,7 +73,7 @@ + free(micuser); free(mic.value); - authctxt->postponed = 0; + if (!authenticated) Index: openssh-10.3p1/auth2-hostbased.c =================================================================== --- openssh-10.3p1.orig/auth2-hostbased.c ++++++ openssh-7.9p1-revert-new-qos-defaults.patch ++++++ --- /var/tmp/diff_new_pack.DQBdnc/_old 2026-07-26 11:29:51.997575043 +0200 +++ /var/tmp/diff_new_pack.DQBdnc/_new 2026-07-26 11:29:52.005575320 +0200 @@ -23,8 +23,8 @@ --- a/servconf.c +++ b/servconf.c @@ -503,9 +503,9 @@ - if (options->permit_tun == -1) - options->permit_tun = SSH_TUNMODE_NO; + _PATH_SSH_USER_PERMITTED_KEYS2); + } if (options->ip_qos_interactive == -1) - options->ip_qos_interactive = IPTOS_DSCP_EF; + options->ip_qos_interactive = IPTOS_LOWDELAY; ++++++ openssh-8.0p1-gssapi-keyex.patch ++++++ --- /var/tmp/diff_new_pack.DQBdnc/_old 2026-07-26 11:29:52.033576287 +0200 +++ /var/tmp/diff_new_pack.DQBdnc/_new 2026-07-26 11:29:52.037576425 +0200 @@ -110,9 +110,9 @@ - authenticated = mm_ssh_gssapi_userok(authctxt->user); + authenticated = mm_ssh_gssapi_userok(authctxt->user, authctxt->pw, 1); + if (!authenticated) + auth_failure_delay(authctxt, tstart); - authctxt->postponed = 0; - ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL); @@ -308,7 +350,7 @@ input_gssapi_mic(int type, uint32_t plen gssbuf.length = sshbuf_len(b); @@ -3051,94 +3051,38 @@ +#include "ssh-gss.h" #include "fips.h" - #if !defined(SSHD_PAM_SERVICE) -@@ -133,9 +134,12 @@ initialize_server_options(ServerOptions - options->kerberos_ticket_cleanup = -1; - options->kerberos_get_afs_token = -1; - options->gss_authentication=-1; -+ options->gss_keyex = -1; - options->gss_cleanup_creds = -1; - options->gss_deleg_creds = -1; - options->gss_strict_acceptor = -1; -+ options->gss_store_rekey = -1; -+ options->gss_kex_algorithms = NULL; - options->password_authentication = -1; - options->kbd_interactive_authentication = -1; - options->permit_empty_passwd = -1; -@@ -397,12 +401,20 @@ fill_default_server_options(ServerOption - options->kerberos_get_afs_token = 0; - if (options->gss_authentication == -1) - options->gss_authentication = 0; -+ if (options->gss_keyex == -1) -+ options->gss_keyex = 0; - if (options->gss_cleanup_creds == -1) - options->gss_cleanup_creds = 1; - if (options->gss_deleg_creds == -1) - options->gss_deleg_creds = 1; - if (options->gss_strict_acceptor == -1) - options->gss_strict_acceptor = 1; -+ if (options->gss_store_rekey == -1) -+ options->gss_store_rekey = 0; + #define SSHD_CONFIG_BLOB_VERSION 1 +@@ -365,6 +366,10 @@ fill_default_server_options(ServerOption + } + if (options->rekey_limit == -1) + options->rekey_limit = 0; +#ifdef GSSAPI + if (options->gss_kex_algorithms == NULL) + options->gss_kex_algorithms = strdup(GSS_KEX_DEFAULT_KEX); +#endif - if (options->password_authentication == -1) - options->password_authentication = 1; - if (options->kbd_interactive_authentication == -1) -@@ -592,6 +604,7 @@ typedef enum { - sPerSourcePenalties, sPerSourcePenaltyExemptList, - sClientAliveInterval, sClientAliveCountMax, sAuthorizedKeysFile, - sGssAuthentication, sGssCleanupCreds, sGssDelegateCreds, sGssStrictAcceptor, -+ sGssKeyEx, sGssKexAlgorithms, sGssStoreRekey, - sAcceptEnv, sSetEnv, sPermitTunnel, - sMatch, sPermitOpen, sPermitListen, sForceCommand, sChrootDirectory, - sUsePrivilegeSeparation, sAllowAgentForwarding, -@@ -679,14 +692,24 @@ static struct { - #ifdef GSSAPI - { "gssapiauthentication", sGssAuthentication, SSHCFG_ALL }, - { "gssapicleanupcredentials", sGssCleanupCreds, SSHCFG_GLOBAL }, -+ { "gssapicleanupcreds", sGssCleanupCreds, SSHCFG_GLOBAL }, - { "gssapidelegatecredentials", sGssDelegateCreds, SSHCFG_GLOBAL }, - { "gssapistrictacceptorcheck", sGssStrictAcceptor, SSHCFG_GLOBAL }, -+ { "gssapikeyexchange", sGssKeyEx, SSHCFG_GLOBAL }, -+ { "gssapistorecredentialsonrekey", sGssStoreRekey, SSHCFG_GLOBAL }, -+ { "gssapikexalgorithms", sGssKexAlgorithms, SSHCFG_GLOBAL }, - #else - { "gssapiauthentication", sUnsupported, SSHCFG_ALL }, - { "gssapicleanupcredentials", sUnsupported, SSHCFG_GLOBAL }, -+ { "gssapicleanupcreds", sUnsupported, SSHCFG_GLOBAL }, - { "gssapidelegatecredentials", sUnsupported, SSHCFG_GLOBAL }, - { "gssapistrictacceptorcheck", sUnsupported, SSHCFG_GLOBAL }, -+ { "gssapikeyexchange", sUnsupported, SSHCFG_GLOBAL }, -+ { "gssapistorecredentialsonrekey", sUnsupported, SSHCFG_GLOBAL }, -+ { "gssapikexalgorithms", sUnsupported, SSHCFG_GLOBAL }, - #endif -+ { "gssusesessionccache", sUnsupported, SSHCFG_GLOBAL }, -+ { "gssapiusesessioncredcache", sUnsupported, SSHCFG_GLOBAL }, - { "passwordauthentication", sPasswordAuthentication, SSHCFG_ALL }, - { "kbdinteractiveauthentication", sKbdInteractiveAuthentication, SSHCFG_ALL }, - { "challengeresponseauthentication", sKbdInteractiveAuthentication, SSHCFG_ALL }, /* alias */ -@@ -1682,6 +1705,10 @@ process_server_config_line_depth(ServerO + if (options->rekey_interval == -1) + options->rekey_interval = 0; + if (options->fwd_opts.gateway_ports == -1) +@@ -1461,6 +1466,10 @@ process_server_config_line_depth(ServerO intptr = &options->gss_authentication; goto parse_flag; -+ case sGssKeyEx: ++ case sGSSAPIKeyExchange: + intptr = &options->gss_keyex; + goto parse_flag; + - case sGssCleanupCreds: + case sGSSAPICleanupCredentials: intptr = &options->gss_cleanup_creds; goto parse_flag; -@@ -1694,6 +1721,22 @@ process_server_config_line_depth(ServerO +@@ -1694,6 +1703,21 @@ process_server_config_line_depth(ServerO + case sGSSAPIStrictAcceptorCheck: intptr = &options->gss_strict_acceptor; goto parse_flag; - -+ case sGssStoreRekey: ++ case sGSSAPIStoreCredentialsOnRekey: + intptr = &options->gss_store_rekey; + goto parse_flag; + -+ case sGssKexAlgorithms: ++ case sGSSAPIKexAlgorithms: + arg = argv_next(&ac, &av); + if (!arg || *arg == '\0') + fatal("%.200s line %d: Missing argument.", @@ -3149,17 +3093,16 @@ + if (*activep && options->gss_kex_algorithms == NULL) + options->gss_kex_algorithms = xstrdup(arg); + break; -+ + #endif /* GSSAPI */ + case sPasswordAuthentication: - intptr = &options->password_authentication; - goto parse_flag; -@@ -3324,6 +3367,9 @@ dump_config(ServerOptions *o) - dump_cfg_fmtint(sGssCleanupCreds, o->gss_cleanup_creds); - dump_cfg_fmtint(sGssDelegateCreds, o->gss_deleg_creds); - dump_cfg_fmtint(sGssStrictAcceptor, o->gss_strict_acceptor); -+ dump_cfg_fmtint(sGssKeyEx, o->gss_keyex); -+ dump_cfg_fmtint(sGssStoreRekey, o->gss_store_rekey); -+ dump_cfg_string(sGssKexAlgorithms, o->gss_kex_algorithms); +@@ -3324,6 +3349,9 @@ dump_config(ServerOptions *o) + dump_cfg_fmtint(sGSSAPICleanupCredentials, o->gss_cleanup_creds); + dump_cfg_fmtint(sGSSAPIDelegateCredentials, o->gss_deleg_creds); + dump_cfg_fmtint(sGSSAPIStrictAcceptorCheck, o->gss_strict_acceptor); ++ dump_cfg_fmtint(sGSSAPIKeyExchange, o->gss_keyex); ++ dump_cfg_fmtint(sGSSAPIStoreCredentialsOnRekey, o->gss_store_rekey); ++ dump_cfg_string(sGSSAPIKexAlgorithms, o->gss_kex_algorithms); #endif dump_cfg_fmtint(sPasswordAuthentication, o->password_authentication); dump_cfg_fmtint(sKbdInteractiveAuthentication, @@ -3167,19 +3110,28 @@ =================================================================== --- openssh-10.3p1.orig/servconf.h +++ openssh-10.3p1/servconf.h -@@ -151,9 +151,12 @@ typedef struct { - int kerberos_get_afs_token; /* If true, try to get AFS token if - * authenticated with Kerberos. */ - int gss_authentication; /* If true, permit GSSAPI authentication */ -+ int gss_keyex; /* If true, permit GSSAPI key exchange */ - int gss_cleanup_creds; /* If true, destroy cred cache on logout */ - int gss_deleg_creds; /* If true, accept delegated GSS credentials */ - int gss_strict_acceptor; /* If true, restrict the GSSAPI acceptor name */ -+ int gss_store_rekey; -+ char *gss_kex_algorithms; /* GSSAPI kex methods to be offered by client. */ - int password_authentication; /* If true, permit password - * authentication. */ - int kbd_interactive_authentication; /* If true, permit */ +@@ -317,13 +317,19 @@ typedef struct { + SSHCONF_INTFLAG(gss_authentication, GSSAPIAuthentication, SSHCFG_ALL, 0, SSHCFG_COPY_MATCH) \ + SSHCONF_INTFLAG(gss_cleanup_creds, GSSAPICleanupCredentials, SSHCFG_GLOBAL, 1, SSHCFG_COPY_NONE) \ + SSHCONF_INTFLAG(gss_deleg_creds, GSSAPIDelegateCredentials, SSHCFG_GLOBAL, 1, SSHCFG_COPY_NONE) \ +-SSHCONF_INTFLAG(gss_strict_acceptor, GSSAPIStrictAcceptorCheck, SSHCFG_GLOBAL, 1, SSHCFG_COPY_NONE) ++SSHCONF_INTFLAG(gss_strict_acceptor, GSSAPIStrictAcceptorCheck, SSHCFG_GLOBAL, 1, SSHCFG_COPY_NONE) \ ++SSHCONF_INTFLAG(gss_keyex, GSSAPIKeyExchange, SSHCFG_GLOBAL, 0, SSHCFG_COPY_NONE) \ ++SSHCONF_INTFLAG(gss_store_rekey, GSSAPIStoreCredentialsOnRekey, SSHCFG_GLOBAL, 0, SSHCFG_COPY_NONE) \ ++SSHCONF_STRING(gss_kex_algorithms, GSSAPIKexAlgorithms, SSHCFG_GLOBAL, SSHCFG_COPY_NONE) + #else /* GSSAPI */ + #define SSHD_CONFIG_ENTRIES_GSS \ + SSHCONF_UNSUPPORTED_INT(gss_authentication, GSSAPIAuthentication, SSHCFG_ALL) \ + SSHCONF_UNSUPPORTED_INT(gss_cleanup_creds, GSSAPICleanupCredentials, SSHCFG_GLOBAL) \ + SSHCONF_UNSUPPORTED_INT(gss_deleg_creds, GSSAPIDelegateCredentials, SSHCFG_GLOBAL) \ +-SSHCONF_UNSUPPORTED_INT(gss_strict_acceptor, GSSAPIStrictAcceptorCheck, SSHCFG_GLOBAL) ++SSHCONF_UNSUPPORTED_INT(gss_strict_acceptor, GSSAPIStrictAcceptorCheck, SSHCFG_GLOBAL) \ ++SSHCONF_UNSUPPORTED_INT(gss_keyex, GSSAPIKeyExchange, SSHCFG_GLOBAL) \ ++SSHCONF_UNSUPPORTED_INT(gss_store_rekey, GSSAPIStoreCredentialsOnRekey, SSHCFG_GLOBAL) \ ++SSHCONF_UNSUPPORTED_STRING(gss_kex_algorithms, GSSAPIKexAlgorithms, SSHCFG_GLOBAL) + #endif /* GSSAPI */ + + #define SSHD_CONFIG_ENTRIES \ Index: openssh-10.3p1/session.c =================================================================== --- openssh-10.3p1.orig/session.c @@ -3353,16 +3305,17 @@ =================================================================== --- openssh-10.3p1.orig/ssh.c +++ openssh-10.3p1/ssh.c -@@ -811,6 +811,8 @@ main(int ac, char **av) +@@ -811,6 +811,9 @@ main(int ac, char **av) else if (strcmp(optarg, "kex") == 0 || strcasecmp(optarg, "KexAlgorithms") == 0) cp = kex_alg_list('\n'); -+ else if (strcmp(optarg, "kex-gss") == 0) ++ else if (strcmp(optarg, "kex-gss") == 0 || ++ strcasecmp(optarg, "GSSAPIKexAlgorithms") == 0) + cp = kex_gss_alg_list('\n'); else if (strcmp(optarg, "key") == 0) cp = sshkey_alg_list(0, 0, 0, '\n'); else if (strcmp(optarg, "key-cert") == 0) -@@ -841,8 +843,8 @@ main(int ac, char **av) +@@ -841,8 +844,8 @@ main(int ac, char **av) } else if (strcmp(optarg, "help") == 0) { cp = xstrdup( "cipher\ncipher-auth\ncompression\nkex\n" @@ -3472,9 +3425,9 @@ + char *gss_host = NULL; +#endif + - xxx_host = host; - xxx_hostaddr = hostaddr; - xxx_conn_info = cinfo; + xxx_host = xstrdup(host); + xxx_hostaddr = *hostaddr; + xxx_conn_info = ssh_conn_info_dup(cinfo); @@ -256,6 +261,42 @@ ssh_kex2(struct ssh *ssh, char *host, st compression_alg_list(options.compression), hkalgs ? hkalgs : options.hostkeyalgorithms); @@ -3762,7 +3715,7 @@ + * host key algorithm we support + */ + if (gss && (strlen(myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS])) == 0) -+ myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = "null"; ++ myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = xstrdup("null"); + + if (newstr) + myproposal[PROPOSAL_KEX_ALGS] = newstr; @@ -3822,9 +3775,9 @@ Determines whether to be strict about the identity of the GSSAPI acceptor a client authenticates against. @@ -771,6 +776,32 @@ machine's default store. - This facility is provided to assist with operation on multi homed machines. The default is .Cm yes . + This option may not be effective in Windows Active Directory environments. +.It Cm GSSAPIStoreCredentialsOnRekey +Controls whether the user's GSSAPI credentials should be updated following a +successful connection rekeying. This option can be used to accepted renewed @@ -3956,9 +3909,9 @@ --- openssh-10.3p1.orig/sshkey.h +++ openssh-10.3p1/sshkey.h @@ -67,6 +67,7 @@ enum sshkey_types { - KEY_ECDSA_SK_CERT, - KEY_ED25519_SK, KEY_ED25519_SK_CERT, + KEY_MLDSA44_ED25519, + KEY_MLDSA44_ED25519_CERT, + KEY_NULL, KEY_UNSPEC }; ++++++ openssh-8.1p1-ed25519-use-openssl-rng.patch ++++++ --- /var/tmp/diff_new_pack.DQBdnc/_old 2026-07-26 11:29:52.053576978 +0200 +++ /var/tmp/diff_new_pack.DQBdnc/_new 2026-07-26 11:29:52.061577254 +0200 @@ -23,21 +23,21 @@ #define uint8 crypto_uint8 #define int16 crypto_int16 @@ -33,7 +40,15 @@ int crypto_sign_ed25519_keypair( - sc25519 scsk; - ge25519 gepk; + unsigned char seed[32]; + int r; +#ifdef WITH_OPENSSL + /* Use FIPS approved RNG */ -+ if (RAND_bytes(sk, 32) <= 0) ++ if (RAND_bytes(seed, 32) <= 0) + fatal("Couldn't obtain random bytes (error 0x%lx)", + (unsigned long)ERR_get_error()); +#else - randombytes(sk,32); + randombytes(seed, 32); +#endif + - crypto_hash_sha512(az,sk,32); - az[0] &= 248; - az[31] &= 127; + r = crypto_sign_ed25519_keypair_from_seed(pk, sk, seed); + explicit_bzero(seed, sizeof(seed)); + return r; diff --git a/kexc25519.c b/kexc25519.c index f13d766..2604eda 100644 --- a/kexc25519.c ++++++ openssh-8.4p1-vendordir.patch ++++++ --- /var/tmp/diff_new_pack.DQBdnc/_old 2026-07-26 11:29:52.093578358 +0200 +++ /var/tmp/diff_new_pack.DQBdnc/_new 2026-07-26 11:29:52.101578635 +0200 @@ -35,7 +35,7 @@ #ifndef _PATH_SSH_PIDDIR #define _PATH_SSH_PIDDIR "/var/run" #endif -@@ -35,11 +37,15 @@ +@@ -35,12 +37,16 @@ * should be world-readable. */ #define _PATH_SERVER_CONFIG_FILE SSHDIR "/sshd_config" @@ -45,6 +45,7 @@ #define _PATH_HOST_ECDSA_KEY_FILE SSHDIR "/ssh_host_ecdsa_key" #define _PATH_HOST_RSA_KEY_FILE SSHDIR "/ssh_host_rsa_key" #define _PATH_HOST_ED25519_KEY_FILE SSHDIR "/ssh_host_ed25519_key" + #define _PATH_HOST_MLDSA44_ED25519_KEY_FILE SSHDIR "/ssh_host_mldsa44_ed25519_key" #define _PATH_DH_MODULI SSHDIR "/moduli" +#define _PATH_VENDOR_DH_MODULI VENDORDIR "/moduli" + @@ -104,7 +105,7 @@ +.Pq Pa /usr/etc/ssh/ssh_config .El .Pp - Unless noted otherwise, for each parameter, the first obtained value + Unless noted otherwise, for each configuration directive, the first @@ -2515,6 +2518,11 @@ This file provides defaults for those values that are not specified in the user's configuration file, and for those users who do not have a configuration file.
