git: b8d0a9401efe - main - security/openssh-portable: Update to 10.6p1
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Sat, 10 Oct 2026 17:43:43 UTC
The branch main has been updated by bdrewery:
URL: https://cgit.FreeBSD.org/ports/commit/?id=b8d0a9401efe21977c43c0f60cf534042a070f56
commit b8d0a9401efe21977c43c0f60cf534042a070f56
Author: Bryan Drewery <bdrewery@FreeBSD.org>
AuthorDate: 2026-10-10 17:11:45 +0000
Commit: Bryan Drewery <bdrewery@FreeBSD.org>
CommitDate: 2026-10-10 17:43:40 +0000
security/openssh-portable: Update to 10.6p1
Release notes: https://www.openssh.org/txt/release-10.6
---
security/openssh-portable/Makefile | 4 +--
security/openssh-portable/distinfo | 8 ++----
security/openssh-portable/files/patch-servconf.h | 18 ++++++------
security/openssh-portable/files/patch-ssh-agent.1 | 12 ++++----
security/openssh-portable/files/patch-ssh-agent.c | 32 +++++++++++-----------
.../openssh-portable/files/patch-sshd_config.5 | 18 ++++++------
6 files changed, 45 insertions(+), 47 deletions(-)
diff --git a/security/openssh-portable/Makefile b/security/openssh-portable/Makefile
index 1a41dae0af39..e4a33f73496a 100644
--- a/security/openssh-portable/Makefile
+++ b/security/openssh-portable/Makefile
@@ -1,6 +1,6 @@
PORTNAME= openssh
-DISTVERSION= 10.5p1
-PORTREVISION= 1
+DISTVERSION= 10.6p1
+PORTREVISION= 0
PORTEPOCH= 1
CATEGORIES= security
MASTER_SITES= OPENBSD/OpenSSH/portable
diff --git a/security/openssh-portable/distinfo b/security/openssh-portable/distinfo
index 841c7a002ea4..5db73866f6fd 100644
--- a/security/openssh-portable/distinfo
+++ b/security/openssh-portable/distinfo
@@ -1,5 +1,3 @@
-TIMESTAMP = 1786486251
-SHA256 (openssh-10.5p1.tar.gz) = d44d28a839ea9daf969cc69150fde59910b2b39361dad81a3bd6cbd19218db11
-SIZE (openssh-10.5p1.tar.gz) = 2333659
-SHA256 (openssh-10.4p1-gsskex-all-debian-rh-10.4p1.patch) = dc88ff53591dcafcb6ac148d451eb1b9adc9d2c047e68509354ea4f07dc56f41
-SIZE (openssh-10.4p1-gsskex-all-debian-rh-10.4p1.patch) = 124953
+TIMESTAMP = 1791650655
+SHA256 (openssh-10.6p1.tar.gz) = a9dc9565dffe8640f64d863cd29a32bc4a3dbdec0566a7fc44c5d6ee767d5f39
+SIZE (openssh-10.6p1.tar.gz) = 2355244
diff --git a/security/openssh-portable/files/patch-servconf.h b/security/openssh-portable/files/patch-servconf.h
index bd0371e8d3f3..d57c6cb4d6e9 100644
--- a/security/openssh-portable/files/patch-servconf.h
+++ b/security/openssh-portable/files/patch-servconf.h
@@ -1,10 +1,10 @@
Match FreeBSD base defaults.
---- servconf.h.orig 2026-08-11 15:11:01.587859000 -0700
-+++ servconf.h 2026-08-11 15:11:41.015171000 -0700
-@@ -157,6 +157,12 @@ SSHCONF_NONCONF(timingsecret)
- SSHCONF_CUSTOM(PerSourcePenalties, persourcepenalties, SSHCFG_GLOBAL, SSHCFG_COPY_NONE) \
+--- servconf.h.orig 2026-10-10 09:53:32.414646000 -0700
++++ servconf.h 2026-10-10 09:55:49.384828000 -0700
+@@ -163,6 +163,12 @@ SSHCONF_NONCONF(timingsecret)
SSHCONF_CUSTOM(RekeyLimit, rekeylimit, SSHCFG_ALL, SSHCFG_COPY_MATCH) \
+ SSHCONF_CUSTOM(PubkeyAuthOptions, pubkey_auth_options, SSHCFG_ALL, SSHCFG_COPY_MATCH) \
SSHCONF_NONCONF(timingsecret)
+
+#ifdef USE_PAM
@@ -15,7 +15,7 @@ Match FreeBSD base defaults.
#define SSHD_CONFIG_ENTRIES_MAIN \
SSHCONF_INT(address_family, AddressFamily, SSHCFG_GLOBAL, multistate_addressfamily, AF_UNSPEC, SSHCFG_COPY_NONE) \
-@@ -166,7 +172,7 @@ SSHCONF_INT(login_grace_time, LoginGraceTime, SSHCFG_G
+@@ -172,7 +178,7 @@ SSHCONF_INT(login_grace_time, LoginGraceTime, SSHCFG_G
SSHCONF_STRING(pid_file, PidFile, SSHCFG_GLOBAL, SSHCFG_COPY_NONE) \
SSHCONF_STRING(moduli_file, ModuliFile, SSHCFG_GLOBAL, SSHCFG_COPY_NONE) \
SSHCONF_INT(login_grace_time, LoginGraceTime, SSHCFG_GLOBAL, NULL, SSHD_DEFAULT_LOGIN_GRACE_TIME, SSHCFG_COPY_NONE) \
@@ -24,8 +24,8 @@ Match FreeBSD base defaults.
SSHCONF_INT(ignore_rhosts, IgnoreRhosts, SSHCFG_ALL, multistate_ignore_rhosts, 1, SSHCFG_COPY_MATCH) \
SSHCONF_INTFLAG(ignore_user_known_hosts, IgnoreUserKnownHosts, SSHCFG_GLOBAL, 0, SSHCFG_COPY_NONE) \
SSHCONF_INTFLAG(print_motd, PrintMotd, SSHCFG_GLOBAL, 1, SSHCFG_COPY_NONE) \
-@@ -190,7 +196,7 @@ SSHCONF_STRING(pubkey_accepted_algos, PubkeyAcceptedAl
- SSHCONF_INT(pubkey_auth_options, PubkeyAuthOptions, SSHCFG_ALL, NULL, 0, SSHCFG_COPY_MATCH) \
+@@ -195,7 +201,7 @@ SSHCONF_STRING(pubkey_accepted_algos, PubkeyAcceptedAl
+ SSHCONF_STRING(ca_sign_algorithms, CASignatureAlgorithms, SSHCFG_ALL, SSHCFG_COPY_MATCH) \
SSHCONF_INTFLAG(pubkey_authentication, PubkeyAuthentication, SSHCFG_ALL, 1, SSHCFG_COPY_MATCH) \
SSHCONF_STRING(pubkey_accepted_algos, PubkeyAcceptedAlgorithms, SSHCFG_ALL, SSHCFG_COPY_MATCH) \
-SSHCONF_INTFLAG(password_authentication, PasswordAuthentication, SSHCFG_ALL, 1, SSHCFG_COPY_MATCH) \
@@ -33,12 +33,12 @@ Match FreeBSD base defaults.
SSHCONF_INTFLAG(kbd_interactive_authentication, KbdInteractiveAuthentication, SSHCFG_ALL, 1, SSHCFG_COPY_MATCH) \
SSHCONF_INTFLAG(permit_empty_passwd, PermitEmptyPasswords, SSHCFG_ALL, 0, SSHCFG_COPY_MATCH) \
SSHCONF_INT(compression, Compression, SSHCFG_GLOBAL, multistate_compression, SSHD_DEFAULT_COMPRESSION, SSHCFG_COPY_NONE) \
-@@ -278,7 +284,7 @@ SSHCONF_ALIAS(KeepAlive, TCPKeepAlive, SSHCFG_GLOBAL)
+@@ -285,7 +291,7 @@ SSHCONF_ALIAS(KeepAlive, TCPKeepAlive, SSHCFG_GLOBAL)
#ifdef USE_PAM
#define SSHD_CONFIG_ENTRIES_PAM \
-SSHCONF_INTFLAG(use_pam, UsePAM, SSHCFG_GLOBAL, 0, SSHCFG_COPY_NONE) \
+SSHCONF_INTFLAG(use_pam, UsePAM, SSHCFG_GLOBAL, 1, SSHCFG_COPY_NONE) \
- SSHCONF_STRING(pam_service_name, PAMServiceName, SSHCFG_ALL, SSHCFG_COPY_NONE)
+ SSHCONF_STRING(pam_service_name, PAMServiceName, SSHCFG_ALL, SSHCFG_COPY_MATCH)
#else
#define SSHD_CONFIG_ENTRIES_PAM \
diff --git a/security/openssh-portable/files/patch-ssh-agent.1 b/security/openssh-portable/files/patch-ssh-agent.1
index d44465be3124..83405113f313 100644
--- a/security/openssh-portable/files/patch-ssh-agent.1
+++ b/security/openssh-portable/files/patch-ssh-agent.1
@@ -4,18 +4,18 @@ r226103 | des | 2011-10-07 08:10:16 -0500 (Fri, 07 Oct 2011) | 5 lines
Add a -x option that causes ssh-agent(1) to exit when all clients have
disconnected.
---- ssh-agent.1.orig 2025-10-05 19:25:16.000000000 -0700
-+++ ssh-agent.1 2025-10-06 08:30:26.521757000 -0700
+--- ssh-agent.1.orig 2026-10-06 01:45:31.000000000 -0700
++++ ssh-agent.1 2026-10-10 09:59:21.023621000 -0700
@@ -43,7 +43,7 @@
.Sh SYNOPSIS
.Nm ssh-agent
.Op Fl c | s
--.Op Fl \&DdTU
-+.Op Fl \&DdTUx
- .Op Fl a Ar bind_address
+-.Op Fl \&DdU
++.Op Fl \&DdUx
+ .Op Fl T | A Ar directory | Fl a Ar bind_address
.Op Fl E Ar fingerprint_hash
.Op Fl O Ar option
-@@ -203,6 +203,8 @@ will delete stale agent sockets regardless of the host
+@@ -228,6 +228,8 @@ will delete stale agent sockets regardless of the host
If this option is given twice,
.Nm
will delete stale agent sockets regardless of the host name that created them.
diff --git a/security/openssh-portable/files/patch-ssh-agent.c b/security/openssh-portable/files/patch-ssh-agent.c
index 9b04f1a9d5c4..ec1bb866f7de 100644
--- a/security/openssh-portable/files/patch-ssh-agent.c
+++ b/security/openssh-portable/files/patch-ssh-agent.c
@@ -8,9 +8,9 @@ r226103 | des | 2011-10-07 08:10:16 -0500 (Fri, 07 Oct 2011) | 5 lines
Add a -x option that causes ssh-agent(1) to exit when all clients have
disconnected.
---- ssh-agent.c.orig 2026-07-06 00:57:12.000000000 -0700
-+++ ssh-agent.c 2026-07-06 13:49:39.833660000 -0700
-@@ -196,11 +196,28 @@ static char *websafe_allowlist;
+--- ssh-agent.c.orig 2026-10-06 01:45:31.000000000 -0700
++++ ssh-agent.c 2026-10-10 10:04:29.143375000 -0700
+@@ -198,11 +198,28 @@ static char *websafe_allowlist;
static int restrict_websafe = 1;
static char *websafe_allowlist;
@@ -39,7 +39,7 @@ disconnected.
close(e->fd);
sshbuf_free(e->input);
sshbuf_free(e->output);
-@@ -213,6 +230,8 @@ close_socket(SocketEntry *e)
+@@ -215,6 +232,8 @@ close_socket(SocketEntry *e)
memset(e, '\0', sizeof(*e));
e->fd = -1;
e->type = AUTH_UNUSED;
@@ -48,7 +48,7 @@ disconnected.
}
static void
-@@ -1932,6 +1951,10 @@ new_socket(sock_type type, int fd)
+@@ -1947,6 +1966,10 @@ new_socket(sock_type type, int fd)
debug_f("type = %s", type == AUTH_CONNECTION ? "CONNECTION" :
(type == AUTH_SOCKET ? "SOCKET" : "UNKNOWN"));
@@ -59,16 +59,16 @@ disconnected.
set_nonblock(fd);
if (fd > max_fd)
-@@ -2225,7 +2248,7 @@ usage(void)
+@@ -2240,7 +2263,7 @@ usage(void)
usage(void)
{
fprintf(stderr,
-- "usage: ssh-agent [-c | -s] [-DdTU] [-a bind_address] [-E fingerprint_hash]\n"
-+ "usage: ssh-agent [-c | -s] [-DdTUx] [-a bind_address] [-E fingerprint_hash]\n"
- " [-O option] [-P allowed_providers] [-t life]\n"
- " ssh-agent [-TU] [-a bind_address] [-E fingerprint_hash] [-O option]\n"
- " [-P allowed_providers] [-t life] command [arg ...]\n"
-@@ -2267,6 +2290,7 @@ main(int ac, char **av)
+- "usage: ssh-agent [-c | -s] [-DdU] [-T | -A directory | -a bind_address]\n"
++ "usage: ssh-agent [-c | -s] [-DdUx] [-T | -A directory | -a bind_address]\n"
+ " [-E fingerprint_hash] [-O option]\n"
+ " [-P allowed_providers] [-t life]\n"
+ " ssh-agent [-U] [-T | -A directory | -a bind_address]\n"
+@@ -2285,6 +2308,7 @@ main(int ac, char **av)
/* drop */
(void)setegid(getgid());
(void)setgid(getgid());
@@ -76,16 +76,16 @@ disconnected.
platform_disable_tracing(0); /* strict=no */
-@@ -2278,7 +2302,7 @@ main(int ac, char **av)
+@@ -2300,7 +2324,7 @@ main(int ac, char **av)
__progname = ssh_get_progname(av[0]);
seed_rng();
-- while ((ch = getopt(ac, av, "cDdksTuUVE:a:O:P:t:")) != -1) {
-+ while ((ch = getopt(ac, av, "cDdksTuUVE:a:O:P:t:x")) != -1) {
+- while ((ch = getopt(ac, av, "cDdksTuUVA:E:a:O:P:t:")) != -1) {
++ while ((ch = getopt(ac, av, "cDdksTuUVA:E:a:O:P:t:x")) != -1) {
switch (ch) {
case 'E':
fingerprint_hash = ssh_digest_alg_by_name(optarg);
-@@ -2335,6 +2359,9 @@ main(int ac, char **av)
+@@ -2360,6 +2384,9 @@ main(int ac, char **av)
usage();
}
break;
diff --git a/security/openssh-portable/files/patch-sshd_config.5 b/security/openssh-portable/files/patch-sshd_config.5
index 05a62be8dd54..e7034eedec77 100644
--- a/security/openssh-portable/files/patch-sshd_config.5
+++ b/security/openssh-portable/files/patch-sshd_config.5
@@ -1,6 +1,6 @@
---- sshd_config.5.orig 2026-04-25 16:05:26.905238000 -0700
-+++ sshd_config.5 2026-04-25 16:16:59.050604000 -0700
-@@ -789,7 +789,9 @@ This was formerly named HostbasedAcceptedKeyTypes.
+--- sshd_config.5.orig 2026-10-10 10:05:08.883799000 -0700
++++ sshd_config.5 2026-10-10 10:08:51.181289000 -0700
+@@ -844,7 +844,9 @@ This was formerly named HostbasedAcceptedKeyTypes.
.Qq ssh -Q HostbasedAcceptedAlgorithms .
This was formerly named HostbasedAcceptedKeyTypes.
.It Cm HostbasedAuthentication
@@ -11,7 +11,7 @@
with successful public key client host authentication is allowed
(host-based authentication).
The default is
-@@ -1489,7 +1491,7 @@ The default is
+@@ -1551,7 +1553,7 @@ The default is
or
.Cm no .
The default is
@@ -20,7 +20,7 @@
.Pp
If this option is set to
.Cm prohibit-password
-@@ -1535,6 +1537,15 @@ The default is
+@@ -1597,6 +1599,15 @@ The default is
.Cm ethernet .
The default is
.Cm no .
@@ -36,7 +36,7 @@
.Pp
Independent of this setting, the permissions of the selected
.Xr tun 4
-@@ -2062,12 +2073,19 @@ The default is
+@@ -2156,12 +2167,19 @@ The default is
.Xr sshd 8
as a non-root user.
The default is
@@ -54,6 +54,6 @@
+The value
+.Cm none
+may be used to disable this.
- .It Cm X11DisplayOffset
- Specifies the first display number available for
- .Xr sshd 8 Ns 's
+ .It Cm WarnWeakCrypto
+ Controls whether warnings are logged when the cryptographic algorithms
+ negotiated for the connection are weak or otherwise recommended against.