OpenSSH 6.8 发布下载内部代码重构

OpenSSH 6.8 发布，此版本镜像很快提供在 http://www.openssh.com/。此版本是个重要版本，包括新特性和大量内部重构。

OpenSSH（Open Secure Shell）是使用SSH透过计算机网络加密通讯的实现。它是取代由SSH Communications Security所提供的商用版本的开放源代码方案。目前OpenSSH是OpenBSD的子计划。

OpenSSH 是 100% 的完整 SSH 协议版本 1.3, 1.5 和 2.0
实现，包括 sftp 客户端和服务器支持。

相比 OpenSSH 6.7 的更新内容
=========================

潜在不兼容改进
——————————–

* sshd(8): UseDNS 默认为 ‘no’

新特性
————

* 大部分 OpenSSH 的内部代码被重构，现在更像库。

* 添加 FingerprintHash 选项到 ssh(1) 和 sshd(8)；添加 equivalent
命令行标记到其他工具来控制密钥指纹算法。

* ssh(1), sshd(8): Experimental host key rotation support. Add a
protocol extension for a server to inform a client of all its
available host keys after authentication has completed. The client
may record the keys in known_hosts, allowing it to upgrade to better
host key algorithms and a server to gracefully rotate its keys.

The client side of this is controlled by a UpdateHostkeys config
option (default off).

* ssh(1): Add a ssh_config HostbasedKeyType option to control which
host public key types are tried during host-based authentication.

* ssh(1), sshd(8): fix connection-killing host key mismatch errors
when sshd offers multiple ECDSA keys of different lengths.

* ssh(1): when host name canonicalisation is enabled, try to
parse host names as addresses before looking them up for
canonicalisation. fixes bz#2074 and avoiding needless DNS
lookups in some cases.

* ssh-keygen(1), sshd(8): Key Revocation Lists (KRLs) no longer
require OpenSSH to be compiled with OpenSSL support.

* ssh(1), ssh-keysign(8): Make ed25519 keys work for host based
authentication.

* sshd(8): SSH protocol v.1 workaround for the Meyer, et al,
Bleichenbacher Side Channel Attack. Fake up a bignum key before
RSA decryption.

* sshd(8): Remember which public keys have been used for
authentication and refuse to accept previously-used keys.
This allows AuthenticationMethods=publickey,publickey to require
that users authenticate using two _different_ public keys.

* sshd(8): add sshd_config HostbasedAcceptedKeyTypes and
PubkeyAcceptedKeyTypes options to allow sshd to control what
public key types will be accepted. Currently defaults to all.

* sshd(8): Don’t count partial authentication success as a failure
against MaxAuthTries.

* ssh(1): Add RevokedHostKeys option for the client to allow
text-file or KRL-based revocation of host keys.

* ssh-keygen(1), sshd(8): Permit KRLs that revoke certificates by
serial number or key ID without scoping to a particular CA.

* ssh(1): Add a “Match canonical” criteria that allows ssh_config
Match blocks to trigger only in the second config pass.

* ssh(1): Add a -G option to ssh that causes it to parse its
configuration and dump the result to stdout, similar to “sshd -T”.

* ssh(1): Allow Match criteria to be negated. E.g. “Match !host”.

* The regression test suite has been extended to cover more OpenSSH
features. The unit tests have been expanded and now cover key
exchange.

BUG 修复

* ssh-keyscan(1): ssh-keyscan has been made much more robust again
servers that hang or violate the SSH protocol.

* ssh(1), ssh-keygen(1): Fix regression bz#2306: Key path names were
being lost as comment fields.

* ssh(1): Allow ssh_config Port options set in the second config
parse phase to be applied (they were being ignored). bz#2286

* ssh(1): Tweak config re-parsing with host canonicalisation – make
the second pass through the config files always run when host name
canonicalisation is enabled (and not whenever the host name
changes) bz#2267

* ssh(1): Fix passing of wildcard forward bind addresses when
connection multiplexing is in use; bz#2324;

* ssh-keygen(1): Fix broken private key conversion from non-OpenSSH
formats; bz#2345.

* ssh-keygen(1): Fix KRL generation bug when multiple CAs are in
use.

* Various fixes to manual pages: bz#2288, bz#2316, bz#2273

Portable OpenSSH

* Support –without-openssl at configure time

Disables and removes dependency on OpenSSL. Many features,
including SSH protocol 1 are not supported and the set of crypto
options is greatly restricted. This will only work on systems
with native arc4random or /dev/urandom.

Considered highly experimental for now.

* Support –without-ssh1 option at configure time

Allows disabling support for SSH protocol 1.

* sshd(8): Fix compilation on systems with IPv6 support in utmpx; bz#2296

* Allow custom service name for sshd on Cygwin. Permits the use of
multiple sshd running with different service names.

更多改进内容请看发行说明。