OpenSSH will now adapt IP QoS to actual sessions and traffic https://www.undeadly.org/cgi?action=article;sid=20250818113047 #openbsd #openssh #ssh #qos #adaptive #networking #security #qualityofservice
Freexian’s July 2025 Debian contributions report highlights our active role in Debian, from sponsoring and participating in DebConf 25 to contributing talks, infrastructure work, and community planning.
Full details: https://www.freexian.com/blog/debian-contributions-07-2025/
Post-Quantum Cryptography Advice Added to OpenSSH Website https://www.undeadly.org/cgi?action=article;sid=20250811110058 #openbsd #openssh #ssh #cryptography #postquantum #postq #crypto #security #libresoftware #freesoftware #bsd
Heads up, upcoming changes to the IPQoS default and config syntax in #OpenSSH ssh(1)/sshd(8) have landed in #OpenBSD -current.
job@ modified src/usr.bin/ssh/*: Set default IPQoS for interactive sessions to Expedited Forwarding (EF)
Marking interactive session data with DSCP value EF (RFC3246, RFC3247) helps inform the network on relative priority compared to other traffic.
This is especially useful for differentiated treatment over wireless media.Following the reconciled IETF Diffserv to IEEE 802.11 mappings (RFC 8325), traffic marked with DSCP value EF maps to User Priority 6 in QoS Control, in turn mapping to the high priority WMM AC_VO access category.
OK djm@
job@ modified src/usr.bin/ssh/*: Deprecate support for IPv4 type-of-service (TOS) IPQoS keywords
Type of Service (ToS) was deprecated in the late nineties and replaced with the Differentiated Services architecture. Diffserv has significant advantages for operators because this mechanism offers more granularity.
OpenSSH switched its default IPQoS from ToS to DSCP values in 2018.
IPQoS configurations with 'lowdelay', 'reliability', or 'throughput' will be ignored and instead the system default QoS settings apply.
Additionally, a debug message is logged about the deprecation with a suggestion to use DSCP.with/OK deraadt@ sthen@ djm@
I see TUI and Rust in the same sentence. I install.
**ssh-list** — SSH connection manager in your terminal.
Supports adding, editing, sorting connections with custom SSH options.
Written in Rust & built with @ratatui_rs
#OpenSSH in Trixie is being upgraded, which does two important things.
1) It adds a hybrid post quantum key exchange (screenshot of a verbose login to my server attached).
2) It disables DSA keys entirely. As in, you can't even manually enable them. They've been disabled "by default" for years, but now they're just straight up removed. If you need to log into an old machine with a DSA key, there is now a separate openssh-client-ssh1 package and ssh1 command.
So it looks like #OpenSSH is getting a new feature to auto-ban users after a number of failed login attempts. This looks like it might even work for public-key auth, which doesn't always get logged in a way that other tools like Fail2Ban can monitor.
Link: https://michael-prokop.at/blog/2025/04/13/openssh-penalty-behavior-in-debian-trixie-newintrixie/
@clacke Yes and no…
Instead of the overhead of containers, my 'jump' machines bind specific keys to the ssh commands that do the specifically authorized next hops and (where possible) restrict to specific client IPs. The OS of those machines are only accessible over a VPN or (for some VMs) a tightly secured web interface that has VNC over WebSockets inside a private network to their virtual consoles.
When you have an ssh jumphost, the trivial setup is one that conflates OS access and application access.
The application is ssh, providing the jump to the privileged network, but ssh also allows OS access, potentially allowing privilege escalation within the jumphost.
Are people taking this seriously and e.g. running an unprivileged sshd inside a container? Access the OS over port 22 to the privileged sshd, restricting that to the segregated admin network, access the jumping over port 2222 and minimize the attack surface on the outer host?
I'm betting the answer here is "this isn't possible" but if anyone knows how to tell OpenSSH that when it's enumerating pubkeys it should check which of the two known authentication dongles is actually plugged into the computer, and only prompt me to unlock the SK key that belongs to that dongle, not both of them, please tell me how.
OpenSSH Config Tags How To
https://mrod.space/2023/09/04/using-tags-in-ssh-config
To be honest I did not know tags existed in #OpenSSH
With a focus on usability, @almalinux OS 10 has been released
https://www.admin-magazine.com/News/AlmaLinux-OS-10-Released?utm_source=mam
#EnterpriseLinux #AlmaLinux #RHEL #cryptography #OpenSSH #sudo #SecureBoot
TIL: According to the ssh_config man page, comments in ~/.ssh/config need to be on their own line. In other words,
Host foo # my awesome host
is not a valid comment.
The ssh command seems pretty relaxed about this, but other tools (e.g. Paramiko) are not necessarily.
Multiplexing will boost your SSH connectivity or speed by reusing existing TCP connections to a remote host. Here are commands that you can use to control multiplexing when using OpenSSH server or client on your Linux, macOS, FreeBSD or Unix-like systems. Not sure what SSH multiplexing is? Learn how to set it up and use it to speed up your SSH sessions with our handy guide: https://www.cyberciti.biz/faq/ssh-multiplexing-control-command-to-check-forward-list-cancel-stop-connections/
This article shows that DSA has finally been removed
#SSH #openSSH #DSA #programming #coding #OpenSource #openBSD #BSD #secureShell #Infosec
An unimportant remnant of the past has been removed from open SSH;
DSA.
Read about it in this article the next article linked will show you that it has been removed finally
#SSH #openSSH #DSA #programming #coding #OpenSource #openBSD #BSD #secureShell #Infosec
GitHub: 
Bill Cole 
