[ssh_x509] PKIX-SSH release 15.3

[ssh_x509 at roumenpetrov.info]

Hello,

Regular release PKIX-SSH 15.3 is available for download.

(x) Features:
(*) notify systemd on listen and reload
Also support "systemd" service file.

(*) up to date ssh-copy-id
Synchronise ssh-copy-id "install script" with upstream.

(*) update the Streamlined NTRU Prime code
Switch from "ref" to faster "compact" implementation. Use 
sntrup761x25519-sha512 key exchange method as alias to existing one 
hybrid key exchange algorithm now has an IANA-assigned name.

(*) ML-KEM768 key exchange
Add experimental support for hybrid post-quantum key exchange ML-KEM768 
(coupled with X25519).

(*) randomise grace login time (up to 4 extra seconds)

(*) place shielded keys into memory excluded from a core dump
Note key-shielding is not enabled by default. Limited to Linux and *BSD.

(*) add daemon option "RefuseConnection"


(x) Bugs:
(*) correct proxy multiplexing bug
If a mux started with ControlPersist then later has a forwarding added 
using mux proxy connection and the forwarding was used, then when the 
mux proxy session terminates, the mux master process will send a channel 
close to the server with a bad channel id and crash the connection. This 
was caused by stupidly reusing c->remote_id for multiplexing channel 
associations.

(*) apply authorized keys options only when signature verification pass
Prevents key options to be applied to subsequent keys listed in 
authorized keys.

(*) fix memory leak when is processed daemon subsystem configuration


(x) Misc:
(*) consistently look for the last @ in the match user pattern
This makes it possible to use usernames that contain '@' characters.

(*) allow short key names only in key generation utility
Be more strict when is parsed key-type name.

(*) restore daemon functionality on Android
Copy more session specific user variables. Do not check daemon for 
absolute path. Do not drop supplementary groups as is not allowed by 
selinux rules.

(*) modernise key generation
Use "keygen" functionality in program code if build is with OpenSSL 1.1 
or newer.

(*) documentation
Documentation and manual page improvements.

(*) code and regression tests clean-up
Includes performance improvements in rekey regression test.


Regards,
Roumen Petrov