social.coop

2 posts2 participants0 posts today

Le Journal du hackerSSH over Openssl over Haproxy - - contourner les blocages <a href="https://www.journalduhacker.net/s/mnw1al/ssh_over_openssl_over_haproxy_contourner" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.journalduhacker.net/s/mnw1al/ssh_over_openssl_over_haproxy_contourner</a> <a href="https://blog.victor-hery.com/2024/02/ssh-openssl-haproxy.html" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://blog.victor-hery.com/2024/02/ssh-openssl-haproxy.html</a> <a href="https://framapiaf.org/tags/h%C3%A9bergement" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#hébergement</a> <a href="https://framapiaf.org/tags/openssh" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#openssh</a>

Neustradamus :xmpp: :linux:<a href="https://mastodon.social/tags/OpenSSH" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenSSH</a> 10.0 has been released (<a href="https://mastodon.social/tags/SSH" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SSH</a> / <a href="https://mastodon.social/tags/SecureShell" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SecureShell</a> / <a href="https://mastodon.social/tags/OpenBSD" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenBSD</a>) <a href="https://openssh.com/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://openssh.com/</a>

Maquinari.catOpenSSH arriba a la versió 10.0. Entre d'altres, inclou l'algoritme mlkem768x25519-sha256, que diuen és a prova d'ordinadors quàntics.<a href="https://www.phoronix.com/news/OpenSSH-10.0-Released" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.phoronix.com/news/OpenSSH-10.0-Released</a><a href="https://mastodon.social/tags/OpenSSH" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenSSH</a> <a href="https://mastodon.social/tags/Qu%C3%A0ntic" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Quàntic</a> <a href="https://mastodon.social/tags/mlkem768x25519" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#mlkem768x25519</a>-sha256

Alejandro Baez<a href="https://fosstodon.org/tags/openssh" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#openssh</a> now defaults to <a href="https://fosstodon.org/tags/mlkem768x25519" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#mlkem768x25519</a> algorithm for keys. In other words, welcome to quantum resistance being a thing. 😎Congrats to the team on this release! <a href="https://www.openssh.com/txt/release-10.0" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.openssh.com/txt/release-10.0</a>

Jeff ForcierI see <a href="https://social.coop/tags/OpenSSH" class="mention hashtag" rel="tag">#OpenSSH</a> got to fully removing DSA key support, so that means my “probably do that in <a href="https://social.coop/tags/Paramiko" class="mention hashtag" rel="tag">#Paramiko</a>” todo list item has no more excuses 🤔Well, ok, it still has a few excuses (will be years before the average sshd is OpenSSH 10.0+) but still. Needs happenin' sometime and it ain't like old releases go away, so.

nixCraft 🐧OpenSSH 10.0/10.0p2 released <a href="https://www.openssh.com/releasenotes.html#10.0p1" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.openssh.com/releasenotes.html#10.0p1</a><a href="https://mastodon.social/tags/unix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#unix</a> <a href="https://mastodon.social/tags/openssh" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#openssh</a> <a href="https://mastodon.social/tags/linux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#linux</a> <a href="https://mastodon.social/tags/opensource" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#opensource</a>

Parade du Grotesque 💀Also: <a href="https://mastodon.sdf.org/tags/Slackware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Slackware</a> 15 has a security update for Python3:<a href="http://www.slackware.com/security/viewer.php?l=slackware-security&y=2025&m=slackware-security.326755" rel="nofollow noopener noreferrer" target="_blank">http://www.slackware.com/security/viewer.php?l=slackware-security&y=2025&m=slackware-security.326755</a>Slackware-current just adopted <a href="https://mastodon.sdf.org/tags/OpenSSH" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenSSH</a> 10.0.p1 & <a href="https://mastodon.sdf.org/tags/OpenSSL" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenSSL</a> 3.5n/openssh-10.0p1-x86_64-1.txz: Upgraded. Potentially-incompatible changes include the removal of the weak DSA signature algorithm, completing the deprecation process that began in 2015 (when DSA was disabled by default) and repeatedly warned over the last 12 months.n/openssl-3.5.0-x86_64-1.txz: Upgraded. New LTS release, supported until 08 Apr 2030.

Edwin G. :mapleleafroundel:Portable OpenSSH 10.0p1 will not exist. It will be known as OpenSSH 10.0p2.<a href="https://lists.mindrot.org/pipermail/openssh-unix-announce/2025-April/000163.html" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://lists.mindrot.org/pipermail/openssh-unix-announce/2025-April/000163.html</a> - - - OpenSSH portable 10.0p1 n’existera pas. Ce sera connue comme OpenSSH 10.0p2. // Publication en anglais //<a href="https://mstdn.moimeme.ca/tags/OpenSSH" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenSSH</a> <a href="https://mstdn.moimeme.ca/tags/SSH" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SSH</a>

Senioradmin<a href="https://social.tchncs.de/tags/OpenSSH" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenSSH</a> 9.8 und höher kommt allmählich auf die Server. Da wird die Option PerSourcePenalties interessant (siehe <a href="https://undeadly.org/cgi?action=article;sid=20240607042157" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://undeadly.org/cgi?action=article;sid=20240607042157</a> ) die fail2ban u.ä. überflüssig machen könnte.Konfig-Beispiele sind aber noch rar gesät. Nach der manpage zu urteilen, sollte aber PerSourcePenalties authfail:3600sdafür sorgen dass IPs, die Brute-Force Attacken fahren für 1 Stunde geblockt werden, korrekt? <a href="https://social.tchncs.de/tags/SSH" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SSH</a>

Peter N. M. HansteenOpenSSH 10.0 Released <a href="https://www.undeadly.org/cgi?action=article;sid=20250410053152" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.undeadly.org/cgi?action=article;sid=20250410053152</a> <a href="https://mastodon.social/tags/openbsd" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#openbsd</a> <a href="https://mastodon.social/tags/openssh" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#openssh</a> <a href="https://mastodon.social/tags/ssh" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ssh</a> <a href="https://mastodon.social/tags/security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#security</a> <a href="https://mastodon.social/tags/networking" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#networking</a> <a href="https://mastodon.social/tags/development" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#development</a> <a href="https://mastodon.social/tags/newrelease" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#newrelease</a> <a href="https://mastodon.social/tags/devops" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#devops</a> <a href="https://mastodon.social/tags/sysadmin" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#sysadmin</a> <a href="https://mastodon.social/tags/freesoftware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#freesoftware</a> <a href="https://mastodon.social/tags/libresoftware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#libresoftware</a>

ティージェーグレェOoph, updated the sshd-session.c patch that MacPorts uses (to try to sandbox things, whoever did that was before my time) and while the patch I modified applies OK, the OpenSSH 10.0p1 build still fails with MacPorts' additional "special sauce". I updated the Trac issue with as far as I got here: <a href="https://trac.macports.org/ticket/72317" rel="nofollow noopener noreferrer" target="_blank">https://trac.macports.org/ticket/72317</a> But I need to step AFK for a while and won't be able to look at this again for several hours. If others want to take a crack at it and fix whatever I failed to get correct, contributions are more than welcome! Thanks! (and here I was thinking the legacy_dsa variant removal would be my potential stumbling block. Nope! sigh I should have tested the snapshot more thoroughly I guess, but I still don't have a functional mpbb locally and I don't even want to get into my "methodology" for diffing this stuff locally, it's basically line by line with not such great tools.) Near as I can discern sshd-session.c got reworked a bit since 9.9p2 and my shoot from the hip attempt is insufficient. <a href="https://snac.bsd.cafe?t=openssh" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenSSH</a> <a href="https://snac.bsd.cafe?t=macports" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#MacPorts</a>

r1w1s1OpenSSH 10.0 is out! 🎉 One of the most critical tools in any Unix admin’s toolbox just got even better. 📜 Release notes: <a href="https://www.openssh.com/releasenotes.html#10.0p1" rel="nofollow noopener noreferrer" target="_blank">https://www.openssh.com/releasenotes.html#10.0p1</a> Huge thanks to the OpenSSH devs for keeping the Internet safer with every release. <a href="https://snac.bsd.cafe?t=openssh" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#openssh</a> <a href="https://snac.bsd.cafe?t=linux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#linux</a> <a href="https://snac.bsd.cafe?t=openbsd" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#openbsd</a> <a href="https://snac.bsd.cafe?t=bsd" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#bsd</a>

RavenOpenSSH 10.0 released with hybrid post-quantum algorithm mlkem768x25519-sha256 as default key agreement, new cipher preference list, new options, bug fixes<a href="https://www.openssh.com/releasenotes.html" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.openssh.com/releasenotes.html</a><a href="https://mastodon.bsd.cafe/tags/openssh" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#openssh</a> <a href="https://mastodon.bsd.cafe/tags/openbsd" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#openbsd</a> <a href="https://mastodon.bsd.cafe/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a> <a href="https://mastodon.bsd.cafe/tags/secureshell" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#secureshell</a> <a href="https://mastodon.bsd.cafe/tags/postquantumcryptography" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#postquantumcryptography</a>

LavX NewsOpenSSH 10.0: A Leap Forward in Secure Shell TechnologyThe release of OpenSSH 10.0 introduces significant enhancements in security and functionality, solidifying its status as a cornerstone of secure communications in the tech industry. With new features ...<a href="https://news.lavx.hu/article/openssh-10-0-a-leap-forward-in-secure-shell-technology" rel="nofollow noopener noreferrer" target="_blank">https://news.lavx.hu/article/openssh-10-0-a-leap-forward-in-secure-shell-technology</a><a href="https://mastodon.cloud/tags/news" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#news</a> <a href="https://mastodon.cloud/tags/tech" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#tech</a> <a href="https://mastodon.cloud/tags/OpenSSH" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenSSH</a> <a href="https://mastodon.cloud/tags/Ed25519" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Ed25519</a> <a href="https://mastodon.cloud/tags/SecureShell" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SecureShell</a>

Bryan Steele :flan_beard:<a href="https://bsd.network/tags/OpenSSH" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenSSH</a> 10.0 release notes: <a href="https://www.openssh.com/txt/release-10.0" rel="nofollow noopener noreferrer" target="_blank">https://www.openssh.com/txt/release-10.0</a>In addition to removing DSA, this splits the user authentication code from the sshd-session binary into a separate sshd-auth binary. Also only <a href="https://bsd.network/tags/OpenBSD" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenBSD</a>, this new sshd-authd is relinked on boot, just like sshd-session & sshd.

Kevin Karhan :verified:<a href="https://infosec.exchange/@JessTheUnstill" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@JessTheUnstill</a> <a href="https://infosec.exchange/@Pibble" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@Pibble</a> And yes, I treat all devices as insecure and would rather invest the time and effort needed get <a href="https://infosec.space/tags/TechIlliterates" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#TechIlliterates</a> up to speed on the <a href="https://infosec.space/tags/OfflinePGP" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OfflinePGP</a> <a href="https://www.youtube.com/watch?v=vdab4T_CoN8" rel="nofollow noopener noreferrer" target="_blank">method!</a><ul><li>Sounds cumbersome, but when your threat model literally goes against the #1 <a href="https://infosec.space/tags/Hacking" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Hacking</a> <a href="https://infosec.space/tags/Regime" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Regime</a> (<a href="https://infosec.space/tags/USA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#USA</a>) with more <a href="https://infosec.space/tags/Exploits" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Exploits</a> stockpiled than any hacking forum (cuz <a href="https://infosec.space/tags/NOBUS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NOBUS</a> <a href="https://en.wikipedia.org/wiki/NOBUS" rel="nofollow noopener noreferrer" target="_blank">doctrine</a>), you gotta have to upgrade.</li></ul>Given the cheapness of storage (legitimate 1TB microSD cards exist and they ain't 4-digit items!) I'd legitimately look into <a href="https://infosec.space/tags/OTP" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OTP</a> <a href="https://infosec.space/tags/encryption" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#encryption</a> and (IF I had the €€€€€€ to do so!) would even sponsor implementing it in <a href="https://infosec.space/tags/OpenVPN" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenVPN</a>, <a href="https://infosec.space/tags/WireGuard" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#WireGuard</a> and <a href="https://infosec.space/tags/OpenSSH" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenSSH</a> (for <a href="https://infosec.space/tags/SSH" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SSH</a>-Tunmeling).<ul><li>The <a href="https://infosec.space/tags/US" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#US</a> is a <a href="https://infosec.space/tags/RogueNation" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#RogueNation</a> with a Rogue Government! The sooner we accept this reality the sooner we can not only adjust to it but act accordingly…</li></ul>I sincerely wish y'all could legitimately call me a tinfoilhat but so far I've been proven right all the time...

Tomáš<a href="https://merveilles.town/tags/unix_surrealism" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#unix_surrealism</a> <a href="https://merveilles.town/tags/openbsd" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#openbsd</a> <a href="https://merveilles.town/tags/openssh" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#openssh</a> <a href="https://merveilles.town/tags/ssh" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ssh</a> <a href="https://merveilles.town/tags/comic" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#comic</a> <a href="https://merveilles.town/tags/runbsd" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#runbsd</a> <a href="https://merveilles.town/tags/fish" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#fish</a> <a href="https://merveilles.town/tags/puffy" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#puffy</a>

Morten LinderudDid a new release of `ssh-tpm-agent`, `v0.8.0`.Notable changes is hierarchy keys, keyctl backed passwords and some preliminary landlock support.<a href="https://github.com/Foxboron/ssh-tpm-agent/releases/tag/v0.8.0" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://github.com/Foxboron/ssh-tpm-agent/releases/tag/v0.8.0</a><a href="https://chaos.social/tags/OpenSSH" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenSSH</a> <a href="https://chaos.social/tags/TPM" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#TPM</a> <a href="https://chaos.social/tags/Security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Security</a> <a href="https://chaos.social/tags/Golang" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Golang</a> <a href="https://chaos.social/tags/landlock" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#landlock</a>

Jonathan MatthewsWhat do you use to manage the contents of ~/.ssh/authorized_keys? Roughly, in how many distinct remote locations do you manage that file? Do they generally contain the same set of keys, or is there some variation? <a href="https://fosstodon.org/tags/ssh" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ssh</a> <a href="https://fosstodon.org/tags/OpenSSH" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenSSH</a> <a href="https://fosstodon.org/tags/SysAdmin" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SysAdmin</a> <a href="https://fosstodon.org/tags/DevOps" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DevOps</a>

Garrett WollmanSuppose you have `AllowUsers foo` set in sshd_config. Normally, this will result in logs like:[date] [host] sshd-session[pid]: Invalid user ubuntu from 195.178.110.18 port 44128But sometimes, you see this instead:[date] [host] sshd-session[pid]: error: PAM: Authentication error for illegal user centos from 82.193.122.91What are the circumstances in which the attacker is able to get through sshd to interact with the PAM stack despite having given a non-permitted login? <a href="https://mastodon.social/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a> <a href="https://mastodon.social/tags/openssh" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#openssh</a>

Recent searches

Search options

Administered by:

Server stats:

#openssh