How to update to OpenSSH 10.4: complete guide to the new features and fixes

OpenSSH 10.4 is the new version of the popular tool for securely connecting to remote networks, introducing significant improvements in terms of security, protocol management, and support for post-quantum cryptography. This version is particularly useful for system administrators, developers, and advanced users who need secure and reliable SSH connections.

The main new features include:

• Security fixes: Resolution of vulnerabilities that could be exploited by malicious servers, such as downloading files to unintended locations or writing files to unintended directories.
• Stricter SSH protocol management: Implementation of more severe behaviors to prevent the sending of non-conforming messages during key renegotiation.
• Experimental support for post-quantum cryptography: Introduction of a composite signature algorithm that combines ML-DSA 44 and Ed25519, useful for preparing for future threats related to quantum computers.
• Performance improvements: Replacement of the wildcard pattern matcher with a non-deterministic finite automaton to avoid exponential behavior in the worst case.
• Bug fixes: Resolution of various issues related to crashes, memory leaks, configuration parsing, X11 channel management, and more.

This version is essential for anyone using OpenSSH to ensure secure connections and prepare for future cyber threats.

Prerequisites

• Hardware: A system compatible with OpenSSH 10.4
• Software: OpenSSH 10.4 installed on the system
• Permissions: Access as root user or with administrator privileges
• Environment: Operating system supported by OpenSSH (e.g., Linux, BSD, macOS)

PROCEDURE: Upgrading to OpenSSH 10.4

At the end of this guide, you will have upgraded your system to OpenSSH 10.4, benefiting from security fixes, protocol improvements, and initial support for post-quantum cryptography.

• Check the current version of OpenSSH installed on your system. Open a terminal and type: ssh -V
• Download the OpenSSH 10.4 package from the official website. Open a terminal and type: wget https://cdn.openssh.com/openssh-10.4.tar.gz
• Extract the downloaded file. Open a terminal and type: tar -xvzf openssh-10.4.tar.gz
• Configure the package for compilation. Open a terminal and type: ./configure

Verification and Troubleshooting

After upgrading to OpenSSH 10.4, it is important to verify the correct functioning of the new features and resolve any issues.

How to test if it works

• Test SFTP security: Verify that files are downloaded to the correct locations using the command "sftp host:/path .". Ensure that a malicious server can no longer redirect files to unintended locations.
• Test SCP security: Copy files between two remote destinations and verify that a malicious server can no longer write files to the parent directory of the intended destination.
• Test SFTP command line length: Use SFTP commands with more than nine arguments and verify that they are no longer silently truncated.
• Test pre-authentication DoS: If you use GSSAPIAuthentication, verify that the sshd server is no longer vulnerable to denial-of-service attacks before authentication.
• Test authentication delay: Verify that sshd correctly applies the minimum authentication delay as configured.
• Test key re-exchange: Verify that the ssh client correctly handles a host key change by the server during a key re-exchange.
• Test SSH transport protocol: Verify that ssh and sshd disconnect peers that send non-key-exchange messages during post-authentication key re-exchange.
• Test server configuration: Run "sshd -G" and verify that directives are printed in mixed case.
• Test seccomp sandbox: On Linux systems, verify that failures in enabling SECCOMP or NONEWPRIVS are now fatal.
• Test post-quantum support: If you want to test the experimental support for the post-quantum signature scheme, add ML-DSA 44 and Ed25519 to the HostKeyAlgorithms or PubkeyAcceptedAlgorithms options.

What to do if it fails

• Configuration issues: If you encounter configuration issues, verify that the configuration files do not contain invalid cipher or MAC lists.
• Compatibility issues: If you use scripts that parse the output of "sshd -G", update them to handle directive names in mixed case.
• Sandbox issues: If your system does not support SECCOMP or NONEWPRIVS, disable the sandbox during configuration.
• Memory issues: If you encounter memory leaks, verify that there are no crashes or memory management issues during intensive use of ssh or sshd.
• Portability issues: If you encounter issues on specific systems, check the release notes for any portability updates.

For more details, consult the OpenSSH 10.4 release notes.

Conclusions

At the end of this guide, you will have understood the main new features and improvements introduced by OpenSSH 10.4, with a focus on security fixes and new features.

Educational Summary

• Security fixes: OpenSSH 10.4 introduces important fixes to prevent vulnerabilities such as downloading files to unintended locations and unauthorized access to parent directories.
• New features: Among the most relevant new features is the experimental support for a combined post-quantum signature algorithm.
• Compatibility: Some changes may affect scripts that parse the output of "sshd -G" or systems that use the seccomp sandbox.
• Bug fixes: Numerous bugs have been fixed, improving the stability and security of the software.

Call to Action

To take full advantage of the new features and fixes, upgrade your OpenSSH installation and consult the release notes for technical details and specific instructions.