Among the 29 debian patches available in version 1:9.9p2-2 of the package, we noticed the following issues:
commit de2c3e778c4b59329ce254cf25b95e0f94b0e261
Merge: 33a1a2cde 8e492f2f5
Author: Colin Watson <cjwatson@debian.org>
Date: Wed Mar 26 11:43:33 2025 +0000
Add COLORTERM NO_COLOR to SendEnv and AcceptEnv
Based on https://salsa.debian.org/ssh-team/openssh/-/merge_requests/32.
commit 8e492f2f5e8633eb4a60687c039839ed48a2c482
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date: Tue Mar 11 07:42:08 2025 +0000
upstream: Check if dbclient supports SHA1 before trying SHA1-based
KEX.
Dropbear 2025.87 removed SHA1 support by default, which means
diffie-hellman-group14-sha1 is not available. Unfortunately there isn't a
flag to query supported KEX, so instead check MACs and if it doesn't have
SHA1 methods, assuming SHA1 based KEXes are likewise not available. Spotted
by anton@.
OpenBSD-Regress-ID: acfa8e26c001cb18b9fb81a27271c3b51288d304
Bug-Debian: https://bugs.debian.org/1100948
Last-Update: 2025-03-20
Patch-Name: dropbear-check-sha1.patch
commit 5cc4b1728c1dcd2058b88c62eb8db0ae2cf25182
Author: Daan De Meyer <daan.j.demeyer@gmail.com>
Date: Mon Mar 20 20:22:14 2023 +0100
Only set PAM_RHOST if the remote host is not "UNKNOWN"
When using sshd's -i option with stdio that is not a AF_INET/AF_INET6
socket, auth_get_canonical_hostname() returns "UNKNOWN" which is then
set as the value of PAM_RHOST, causing pam to try to do a reverse DNS
query of "UNKNOWN", which times out multiple times, causing a
substantial slowdown when logging in.
To fix this, let's only set PAM_RHOST if the hostname is not "UNKNOWN".
Author: Daan De Meyer <daan.j.demeyer@gmail.com>
Last-Update: 2024-04-03
Patch-Name: pam-avoid-unknown-host.patch
commit b6d050b15e5b9a5b7ea36a14ae948ff0c91b568e
Author: Colin Watson <cjwatson@debian.org>
Date: Wed Apr 3 11:52:04 2024 +0100
Add Autoconf cache variables for OSSH_CHECK_*FLAG_*
This allows overriding them on configure's command line in case the
automatic checks go wrong somehow. bz#3673
Forwarded: https://bugzilla.mindrot.org/show_bug.cgi?id=3673#c3
Last-Update: 2024-04-03
Patch-Name: configure-cache-vars.patch
commit 975326249dc02f98a4bb47481baf5e285e9e3d59
Author: Colin Watson <cjwatson@debian.org>
Date: Sun Mar 31 00:24:11 2024 +0000
regress: Redirect conch stdin from /dev/zero
This is more convenient than requiring a controlling terminal.
Forwarded: https://bugzilla.mindrot.org/show_bug.cgi?id=3676
Last-Update: 2024-03-31
Patch-Name: regress-conch-dev-zero.patch
commit 1941036611f5ac45bee5b8780e943b91a09d3616
Author: Colin Watson <cjwatson@debian.org>
Date: Mon Mar 11 16:24:49 2024 +0000
Skip utimensat test on ZFS
On ZFS (which may be used by e.g. `autopkgtest-virt-incus`), `utimensat`
seems to leave the access time set to 0. It's not clear why.
Forwarded: no
Last-Update: 2024-03-11
Patch-Name: skip-utimensat-test-on-zfs.patch
commit 07a3243095e487b1c2de427cfc2d7f9e2aa350fd
Author: Steve Langasek <steve.langasek@ubuntu.com>
Date: Thu Sep 1 16:03:37 2022 +0100
Support systemd socket activation
Unlike inetd socket activation, with systemd socket activation the
supervisor passes the listened-on socket to the child process and lets
the child process handle the accept(). This lets us do delayed start
of the sshd daemon without becoming incompatible with config options
like ClientAliveCountMax.
Author: Colin Watson <cjwatson@debian.org>
Last-Update: 2024-08-02
Patch-Name: systemd-socket-activation.patch
commit 94a9217aacff208481dc0a80713be0db893aeffb
Author: Colin Watson <cjwatson@debian.org>
Date: Mon Apr 8 10:46:29 2019 +0100
Revert "upstream: Update default IPQoS in ssh(1), sshd(8) to DSCP AF21 for"
This reverts commit 5ee8448ad7c306f05a9f56769f95336a8269f379.
The IPQoS default changes have some unfortunate interactions with
iptables (see https://bugs.debian.org/923880) and VMware, so I'm
temporarily reverting them until those have been fixed.
Bug-Debian: https://bugs.debian.org/923879
Bug-Debian: https://bugs.debian.org/926229
Bug-Ubuntu: https://bugs.launchpad.net/bugs/1822370
Last-Update: 2019-04-08
Patch-Name: revert-ipqos-defaults.patch
commit 066a14178d249961b7d1a30de1f2e9b008c725ac
Author: Colin Watson <cjwatson@debian.org>
Date: Sun Mar 5 02:02:11 2017 +0000
Restore reading authorized_keys2 by default
Upstream seems to intend to gradually phase this out, so don't assume
that this will remain the default forever. However, we were late in
adopting the upstream sshd_config changes, so it makes sense to extend
the grace period.
Bug-Debian: https://bugs.debian.org/852320
Forwarded: not-needed
Last-Update: 2017-03-05
Patch-Name: restore-authorized_keys2.patch
commit 40add5588253d9d69713caba03bfeb0227d5d298
Author: Colin Watson <cjwatson@debian.org>
Date: Sun Feb 9 16:10:18 2014 +0000
Various Debian-specific configuration changes
ssh: Enable ForwardX11Trusted, returning to earlier semantics which cause
fewer problems with existing setups (http://bugs.debian.org/237021).
ssh: Set 'SendEnv LANG LC_* COLORTERM NO_COLOR' by default
(http://bugs.debian.org/264024).
ssh: Enable HashKnownHosts by default to try to limit the spread of ssh
worms.
ssh: Enable GSSAPIAuthentication by default.
ssh: Include /etc/ssh/ssh_config.d/*.conf.
sshd: Enable PAM, disable KbdInteractiveAuthentication, and disable
PrintMotd.
sshd: Enable X11Forwarding.
sshd: Set 'AcceptEnv LANG LC_* COLORTERM NO_COLOR' by default.
sshd: Change sftp subsystem path to /usr/lib/openssh/sftp-server.
sshd: Include /etc/ssh/sshd_config.d/*.conf.
sshd: Document Debian's default for SshdSessionPath.
regress: Run tests with 'UsePAM yes', to match sshd_config.
Document all of this.
Author: Russ Allbery <rra@debian.org>
Author: Luca Boccassi <bluca@debian.org>
Forwarded: not-needed
Last-Update: 2025-03-26
Patch-Name: debian-config.patch
![[bug history graph]](https://qa.debian.org/data/bts/graphs/o/openssh.png){kind=link}