#OpenSSH10 setzt auf Standards für quantensicheren Schlüsselaustausch | Security https://www.heise.de/news/OpenSSH-10-setzt-auf-Standards-fuer-quantensicheren-Schluesselaustausch-10345975.html #Verschlüsselung #encryption #SSH #OpenSSH
La décima versión de OpenSSH viene con el algoritmo mlkem768xto25519-sha256 activado por defecto, que se considera seguro ante ataques con ordenadores cuánticos y además se ha convertido en norma en el NIST #openssh -> https://hardlimit.com/archivo.php?n=2286
I see #OpenSSH got to fully removing DSA key support, so that means my “probably do that in #Paramiko” todo list item has no more excuses 
Well, ok, it still has a few excuses (will be years before the average sshd is OpenSSH 10.0+) but still. Needs happenin' sometime and it ain't like old releases go away, so.
Also: #Slackware 15 has a security update for Python3:
http://www.slackware.com/security/viewer.php?l=slackware-security&y=2025&m=slackware-security.326755
Slackware-current just adopted #OpenSSH 10.0.p1 & #OpenSSL 3.5
n/openssh-10.0p1-x86_64-1.txz: Upgraded. Potentially-incompatible changes include the removal of the weak DSA signature algorithm, completing the deprecation process that began in 2015 (when DSA was disabled by default) and repeatedly warned over the last 12 months.
n/openssl-3.5.0-x86_64-1.txz: Upgraded. New LTS release, supported until 08 Apr 2030.
Portable OpenSSH 10.0p1 will not exist. It will be known as OpenSSH 10.0p2.
https://lists.mindrot.org/pipermail/openssh-unix-announce/2025-April/000163.html
- - -
OpenSSH portable 10.0p1 n’existera pas. Ce sera connue comme OpenSSH 10.0p2.
// Publication en anglais //
#OpenSSH 9.8 und höher kommt allmählich auf die Server. Da wird die Option PerSourcePenalties interessant (siehe https://undeadly.org/cgi?action=article;sid=20240607042157 ) die fail2ban u.ä. überflüssig machen könnte.
Konfig-Beispiele sind aber noch rar gesät. Nach der manpage zu urteilen, sollte aber
PerSourcePenalties authfail:3600s
dafür sorgen dass IPs, die Brute-Force Attacken fahren für 1 Stunde geblockt werden, korrekt?
Release notes: https://www.openssh.com/releasenotes.html#10.0p1OpenSSH 10.0 released with hybrid post-quantum algorithm mlkem768x25519-sha256 as default key agreement, new cipher preference list, new options, bug fixes
OpenSSH 10.0: A Leap Forward in Secure Shell Technology
The release of OpenSSH 10.0 introduces significant enhancements in security and functionality, solidifying its status as a cornerstone of secure communications in the tech industry. With new features ...
https://news.lavx.hu/article/openssh-10-0-a-leap-forward-in-secure-shell-technology
#OpenSSH 10.0 release notes: https://www.openssh.com/txt/release-10.0
In addition to removing DSA, this splits the user authentication code from the sshd-session binary into a separate sshd-auth binary. Also only #OpenBSD, this new sshd-authd is relinked on boot, just like sshd-session & sshd.
@JessTheUnstill @Pibble
And yes, I treat all devices as insecure and would rather invest the time and effort needed get #TechIlliterates up to speed on the #OfflinePGP method!
Given the cheapness of storage (legitimate 1TB microSD cards exist and they ain't 4-digit items!) I'd legitimately look into #OTP #encryption and (IF I had the €€€€€€ to do so!) would even sponsor implementing it in #OpenVPN, #WireGuard and #OpenSSH (for #SSH-Tunmeling).
I sincerely wish y'all could legitimately call me a tinfoilhat but so far I've been proven right all the time...
Did a new release of `ssh-tpm-agent`, `v0.8.0`.
Notable changes is hierarchy keys, keyctl backed passwords and some preliminary landlock support.
https://github.com/Foxboron/ssh-tpm-agent/releases/tag/v0.8.0
A few words on SSH public keys read from AuthorizedKeysFile(s) and obtained programmatically from OpenSSH's AuthorizedKeysCommand program.
https://jpmens.net/2025/03/25/authorizedkeyscommand-in-sshd/
