[ssh_x509] PKIX-SSH release 15.0

[ssh_x509 at roumenpetrov.info]

Hello,

ssh_x509 at roumenpetrov.info wrote:
> Hello,
>
> PKIX-SSH 15.0 is available for download. Detailed announce will bu published soon.
>
> Main changes - do not prefer EtM algorithms and disabled DSA key by default.
>
Actually "do not prefer EtM" was part of 14.4.1.

The new major release includes following changes:

(x) Features:

(*) build without DSA keys
A configuration option could be used to enable public algorithms based on DSA keys.
Also regression tests prefer Intermediate CA with EC keys if build is with OpenSSL 1.1+.

(*) use poll for main loops
Convert daemon and client main loop from pselect to ppoll.

(*) stricter handling of channel window limits
This makes client and server more strict in handling non-compliant peers that send more data than the advertised channel window allows. Previously the additional data would be silently discarded. This change will cause client or server to terminate the connection if the channel window is exceeded by more than a small grace allowance (~10%).

(*) client as login shell
Manage case when terminal program executes secsh client as login shell.

(*) "global" ChannelTimeout
Add a "global" ChannelTimeout to client and daemon.


(x) Bugs:

(*) non-completed connection
Manage non-completed connection in channel post processing.

(*) long messages
Ensure eof on long messages to standard error.

(*) space in configuration directive
Do not append space if subsystem lacks arguments.

(*) parse single string array options separately
In match block allows option override where first argument could be a specific keyword.

(*) signal logs
Avoid logging in ssh agent signal handler.


(x) Misc:

(*) harden madvise rules in Linux seccomp sandbox
Linux madvise(2) syscalls support quite a number of flags and is not expected that secsh daemon to use them. This should exclude kernel attack surface by filtering madvise arguments.

(*) build configuration
Use autoconf macro for fgrep. Note egrep and fgrep commands have been deprecated since 2007. Command is standardized by POSIX with -E and -F flags.
Use plain apostrophes in configuration quotes. Follow autoconf 2.72 changes.

(*) unlimited argument name in configuration
Do not restrict number of canonical domains and CNAMEs when canonicalizing hostnames.

(*) manuals
Documentation and usage corrections and improvements.

(*) force use of ssh askpass for pkcs#11 tests
Avoid to run a program in a new session i.e., replaces perl based setsid functionality.

(*) change pkcs#11 module used in tests
Use SoftHSM2 module in agent pkcs#11 regression tests. Also test EC key as well.

(*) add certificate tests with pkcs#11 token and pkcs#11 engine
Based on SoftHSM2 module. Test are not enabled by default as depend on many external packages.

(*) certificate regression tests
Prefer SHA256 digest to create test certificates. Activated if build is with OpenSSL 1.1+. Test with 2048-bit RSA keys. In hostkey algorithm tests use only RSA based Intermediate CA.

(*) interoperability tests
Improve conch and putty interoperability tests. Added tests with dropbear client.

(*) SHA1 signatures in regression tests
Enable SHA1 signatures in regression tests if deprecated by system policy.


> Regards,
> Roumen Petrov


Roumen

-- 
Advanced secure shell implementation with X.509 certificate support
http://roumenpetrov.info/secsh/