After three months of intense development, the Release of the new version of "OpenSSH 10.4". This new version It does not only focus on correcting critical vulnerabilitiesbut rather takes a bold step towards the future of cryptography and It drastically improves the efficiency of secure connection processing.
The most striking advance of this installment is the Introduction of experimental support for post-quantum cryptography. The developers have integrated a composite digital signature scheme that merges the power of ML-DSA algorithm 44 with the proven Ed25519 elliptical curve.
Although this feature It is disabled by default, System administrators can manually enable this feature in their configuration and begin generating keys designed to withstand attacks from tomorrow's supercomputers. Alongside this innovation, the internal pattern-matching engine has been replaced by a non-deterministic finite automaton, completely eliminating the slowness and high processing power issues that occurred when evaluating complex configurations with multiple wildcards.
Main new features of OpenSSH 10.4
El The transportation protocol is now relentless in enforcing RFC 4253If a client or server attempts to send messages unrelated to the key exchange during renegotiation, the connection will be terminated immediately. It closes the door to denial-of-service attacks. where a malicious actor could saturate the server's memory by sending junk traffic.
Furthermore, Linux environments that use isolation via seccompany failure to activate security restrictions It will now cause a complete service shutdown, instead of simply registering a warning. and continue operating in a vulnerable state. Finally, configuration dumping via the command line now respects the original case of the directives, greatly facilitating their reading and auditing.
Critical patches for tampering and denial-of-service vulnerabilities
Regarding the security improvements, New version of OpenSSH 10.4 fixes multiple vulnerabilities which jeopardized the integrity of the files and the server. Fixed a serious vulnerability in the Secure Copy Tool (SCP) which allowed a malicious server to trick the client into writing files to the parent directory of the intended destination.
Similarly, A bug in the SFTP client that allowed downloads to unauthorized paths on the local system was patched.Another vital fix affects the internal SFTP server, where excessively long command lines were silently truncated, causing crucial security flags to be ignored if they were located at the end of the instruction.
La Service stability in the face of attacks has also improved considerably, in addition to the fact that it is also resolved a denial-of-service problem that could be exploited before authenticationand the GSSAPI authentication policy was active, and a logic flaw that allowed the creation of unwanted tunnels by ignoring certain restriction rules was fixed.
At the memory level, the SSH client received a patch to prevent a critical freed memory usage error that occurred if a malicious server changed its host key during a key exchange. Finally, internal timers were strengthened to ensure that the minimum delay between failed authentication attempts is always applied, effectively stopping brute-force attacks.
If you are interested in knowing more about it, you can check the details in the following link.
How to install OpenSSH on Linux?
For those who are interested in being able to install this new version of OpenSSH on their systems, for now they can do it downloading the source code of this and performing the compilation on their computers.
This is because the new version has not yet been included in the repositories of the main Linux distributions. To get the source code, you can do from the following link.
Done the download, now we are going to unzip the package with the following command:
tar -xvf openssh-10.4.tar.gz
We enter the created directory:
cd openssh-10.4
Y we can compile with the following commands:
./configure --prefix = / opt --sysconfdir = / etc / ssh make make install