openssh: Add a note to check for deprecated and removed config options

Suggested by: emaste
Sponsored by: The FreeBSD Foundation

(cherry picked from commit 9340d69e57764c6ead568dbf14a859d184c35b8e)

ssh: correct configure option name

The option is security-key-builtin not security-key-internal. There is
no change to the generated config.h because the option defaults off
anyway.

MFC after: 3 d

ssh: correct configure option name

The option is security-key-builtin not security-key-internal. There is
no change to the generated config.h because the option defaults off
anyway.

MFC after: 3 days
Fixes: 87152f340549 ("ssh: disble internal security key...")
Sponsored by: The FreeBSD Foundation

(cherry picked from commit f1421a8972a2c8babfacfd1270258492579e0208)

show more ...

ssh: pass 0 to procctl(2) to operate on self

As of f833ab9dd187 procctl(2) allows idtype P_PID with id = 0 as a
shortcut for the calling process ID. The shortcut also bypasses the
p_cansee / p_cand

ssh: pass 0 to procctl(2) to operate on self

As of f833ab9dd187 procctl(2) allows idtype P_PID with id = 0 as a
shortcut for the calling process ID. The shortcut also bypasses the
p_cansee / p_candebug test (since the process is able to act on itself.)

At present if the security.bsd.unprivileged_proc_debug sysctl is 0 then
procctl(P_PID, getpid(), ... for a process to act on itself will fail,
but procctl(P_PID, 0, ... will succeed. This should likely be addressed
with a kernel change.

In any case the id = 0 shortcut is a tiny optimization for a process to
act on itself and allows the self-procctl to succeed, so use it in ssh.

Reported by: Shawn Webb
Reviewed by: kib
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D33970

(cherry picked from commit 0746301c4995d9e4a82b0e5034b62e310694d1ef)
(cherry picked from commit e38610abcadbfeba5f7a32aa8a6bc8981be64908)

show more ...

ssh: update to OpenSSH v8.8p1

OpenSSH v8.8p1 was motivated primarily by a security update and
deprecation of RSA/SHA1 signatures. It also has a few minor bug fixes.

The security update was already

ssh: update to OpenSSH v8.8p1

OpenSSH v8.8p1 was motivated primarily by a security update and
deprecation of RSA/SHA1 signatures. It also has a few minor bug fixes.

The security update was already applied to FreeBSD as an independent
change, and the RSA/SHA1 deprecation is excluded from this commit but
will immediately follow.

MFC after: 1 month
Relnotes: Yes
Sponsored by: The FreeBSD Foundation

(cherry picked from commit e9e8876a4d6afc1ad5315faaa191b25121a813d7)
(cherry picked from commit 2ffb13149c8e46cb7d7e891b237255615906dc60)

show more ...

ssh: enable FIDO/U2F keys

Description of FIDO/U2F support (from OpenSSH 8.2 release notes,
https://www.openssh.com/txt/release-8.2):

This release adds support for FIDO/U2F hardware authenticators

ssh: enable FIDO/U2F keys

Description of FIDO/U2F support (from OpenSSH 8.2 release notes,
https://www.openssh.com/txt/release-8.2):

This release adds support for FIDO/U2F hardware authenticators to
OpenSSH. U2F/FIDO are open standards for inexpensive two-factor
authentication hardware that are widely used for website
authentication. In OpenSSH FIDO devices are supported by new public
key types "ecdsa-sk" and "ed25519-sk", along with corresponding
certificate types.

ssh-keygen(1) may be used to generate a FIDO token-backed key, after
which they may be used much like any other key type supported by
OpenSSH, so long as the hardware token is attached when the keys are
used. FIDO tokens also generally require the user explicitly
authorise operations by touching or tapping them.

Generating a FIDO key requires the token be attached, and will
usually require the user tap the token to confirm the operation:

$ ssh-keygen -t ecdsa-sk -f ~/.ssh/id_ecdsa_sk
Generating public/private ecdsa-sk key pair.
You may need to touch your security key to authorize key generation.
Enter file in which to save the key (/home/djm/.ssh/id_ecdsa_sk):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/djm/.ssh/id_ecdsa_sk
Your public key has been saved in /home/djm/.ssh/id_ecdsa_sk.pub

This will yield a public and private key-pair. The private key file
should be useless to an attacker who does not have access to the
physical token. After generation, this key may be used like any
other supported key in OpenSSH and may be listed in authorized_keys,
added to ssh-agent(1), etc. The only additional stipulation is that
the FIDO token that the key belongs to must be attached when the key
is used.

To enable FIDO/U2F support, this change regenerates ssh_namespace.h,
adds ssh-sk-helper, and sets ENABLE_SK_INTERNAL (unless building
WITHOUT_USB).

devd integration is not included in this change, and is under
investigation for the base system. In the interim the security/u2f-devd
port can be installed to provide appropriate devd rules.

Reviewed by: delphij, kevans
Relnotes: Yes
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D32509

(cherry picked from commit e9a994639b2af232f994ba2ad23ca45a17718d2b)

show more ...

openssh: update to OpenSSH v8.7p1

Some notable changes, from upstream's release notes:

- sshd(8): Remove support for obsolete "host/port" syntax.
- ssh(1): When prompting whether to record a new ho

openssh: update to OpenSSH v8.7p1

Some notable changes, from upstream's release notes:

- sshd(8): Remove support for obsolete "host/port" syntax.
- ssh(1): When prompting whether to record a new host key, accept the key
fingerprint as a synonym for "yes".
- ssh-keygen(1): when acting as a CA and signing certificates with an RSA
key, default to using the rsa-sha2-512 signature algorithm.
- ssh(1), sshd(8), ssh-keygen(1): this release removes the "ssh-rsa"
(RSA/SHA1) algorithm from those accepted for certificate signatures.
- ssh-sk-helper(8): this is a new binary. It is used by the FIDO/U2F
support to provide address-space isolation for token middleware
libraries (including the internal one).
- ssh(1): this release enables UpdateHostkeys by default subject to some
conservative preconditions.
- scp(1): this release changes the behaviour of remote to remote copies
(e.g. "scp host-a:/path host-b:") to transfer through the local host
by default.
- scp(1): experimental support for transfers using the SFTP protocol as
a replacement for the venerable SCP/RCP protocol that it has
traditionally used.

Additional integration work is needed to support FIDO/U2F in the base
system.

Deprecation Notice
------------------

OpenSSH will disable the ssh-rsa signature scheme by default in the
next release.

Reviewed by: imp
MFC after: 1 month
Relnotes: Yes
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D29985

(cherry picked from commit 19261079b74319502c6ffa1249920079f0f69a72)
(cherry picked from commit f448c3ed4ae1281861913a56377f9d93d49f8e8e)
(cherry picked from commit 1f290c707a19d1695c303e6c8ead9cc414ccc6dc)
(cherry picked from commit 0f9bafdfc325779e4ecc5154d5bb06c752297138)
(cherry picked from commit adb56e58e8db84d8087ebe3d3e7def0074cb5a90)
(cherry picked from commit 576b58108c1723c85e4dd00355e29bfe301dab11)
(cherry picked from commit 1c99af1ebe61cbaf633792941640dcd254acf921)
(cherry picked from commit 87152f34054921632016bc5eb4ab9f836fbaa522)
(cherry picked from commit 172fa4aa7577915bf5ace5783251821d3774dc05)

show more ...

openssh: sync update document with main

(cherry picked from commit 519496a5985549d2935cf296a709b1e726b1b5e5)
(cherry picked from commit 576b477ba41c9916fae3a83e6b4dd98c682a0c2f)
(cherry picked from

openssh: sync update document with main

(cherry picked from commit 519496a5985549d2935cf296a709b1e726b1b5e5)
(cherry picked from commit 576b477ba41c9916fae3a83e6b4dd98c682a0c2f)
(cherry picked from commit 35a034250896584a63204f60fa57e6eddca049ac)
(cherry picked from commit f3fd88507489f6b80402ab7a0fb195ca9c708334)
(cherry picked from commit b645ee1815daf96ee9512633b55c423bc897b244)
(cherry picked from commit 438fd19dc327400e5fbcebfcb9fe9361b317e791)

show more ...

openssh: port upgrade doc and script to git

Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D28564

(cherry picked from commit 74c59ab790db0062b768bb9742e4d1a

openssh: port upgrade doc and script to git

Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D28564

(cherry picked from commit 74c59ab790db0062b768bb9742e4d1ad036501ad)

show more ...