news
OpenSSH 10.1: New DSCP Handling, SHA1 SSHFP Deprecation Announced
Quoting: OpenSSH 10.1: New DSCP Handling, SHA1 SSHFP Deprecation Announced —
The OpenSSH project, developed and maintained under the OpenBSD umbrella, announced the release of OpenSSH 10.1, a widely adopted secure toolset for remote login and file transfer over encrypted connections. It is now available for download on its official mirrors.
A key change in this release is the upcoming deprecation of SHA1 SSHFP DNS records, which will soon be ignored due to weaknesses in the SHA1 algorithm. From now on, ssh-keygen -r will generate only SHA256-based SSHFP records.
OpenSSH 10.1 also introduces a warning for non-post-quantum key agreements, highlighting the risk of “store now, decrypt later” attacks. This behavior is managed by the new WarnWeakCrypto option, enabled by default.
An update
Two more:
-
OpenSSH 10.1 released
The OpenSSH project has released OpenSSH 10.1, which is also the release that will be part of the upcoming OpenBSD 7.8 release.
-
OpenSSH 10.1 released
OpenSSH 10.1 has been released. Along with "
a minor security fix
" and some other bug fixes, this release disallows control characters in user names passed via the command line, adds better logging around certificate refusals, and a new RefuseConnection server configuration option. -
OpenSSH 10.1: New DSCP Handling, SHA1 SSHFP Deprecation Announced
This version brings major DSCP (IPQoS) changes. Interactive SSH traffic now defaults to the Expedited Forwarding class for better latency, while non-interactive traffic, such as SFTP transfers, uses the system default. Plus, legacy IPv4 ToS keywords like lowdelay, reliability, and throughput are now ignored, replaced by modern DSCP markings.
-
[openssh-unix-announce] Announce: OpenSSH 10.1 released
* A future release of OpenSSH will deprecate support for SHA1 SSHFP records due to weaknesses in the SHA1 hash function. SHA1 SSHFP DNS records will be ignored and ssh-keygen -r will generate only SHA256 SSHFP records.
The SHA256 hash algorithm, which has no known weaknesses, has been supported for SSHFP records since OpenSSH 6.1, released in 2012.