Skip to content

Releases: PowerShell/Win32-OpenSSH

v9.8.1.0p1-Preview

10 Oct 19:23
e5a9144
Compare
Choose a tag to compare

This is a preview-release (non-production ready)

This release includes:

v9.8.0.0p1-Preview

08 Oct 17:59
8ada677
Compare
Choose a tag to compare

This is a preview-release (non-production ready)

Note that the change from "beta" to "preview" is simply to align with release naming requirements.

This release includes:

v9.5.0.0p1-Beta

18 Dec 16:57
eb18b63
Compare
Choose a tag to compare

This is a beta-release (non-production ready)

This release includes:

v9.4.0.0p1-Beta

10 Oct 20:43
7b16a73
Compare
Choose a tag to compare

This is a beta-release (non-production ready)

This release includes:

  • Upstream changes from OpenSSH 9.3p2 and OpenSSH 9.4.

  • Breaking changes - see upstream release notes for more information:

    • the ssh-agent will now refuse requests to load PKCS#11 modules issued by remote clients by default. A flag has been added to restore the previous behavior "-Oallow-remote-pkcs11".
  • Security Fixes:

    • the sshd service will check the $env:ProgramData\ssh folder permissions upon startup to ensure only SYSTEM and Administrator accounts have write access to the folder; similar to the existing check upon install in contrib\win32\openssh\install-sshd.ps1.
  • Non-Security Fixes:

v9.2.2.0p1-Beta

17 Apr 17:15
e574bb3
Compare
Choose a tag to compare

This is a beta-release (non-production ready)

This release includes:

v9.2.0.0p1-Beta

21 Feb 17:44
4f0c9a0
Compare
Choose a tag to compare

This is a beta-release (non-production ready)

This release includes:

  • Upstream changes from OpenSSH 9.2, which fixes a number of security bugs.

  • Breaking changes - see upstream release notes for more information:

    • adds EnableEscapeCommandline to ssh_config, a new option, that controls whether the client-side ~C escape sequence that provides a command-line is available. EnableEscapeCommandline defaults to "no", which disables the ~C escape sequence that was previously enabled by default.
  • Security:

    • The sftp server will not attempt to add the Mark-of-the-Web (MOTW) for files uploaded from sftp clients, which reverts the behavior added in 9.1. This is on par with scp behavior for file uploads. File download behavior via scp and sftp remains the same as 9.1, with a best effort attempt to add the MOTW. This change was prompted by Community feedback, as discussed in #2029.
  • Fixes for #2018 and #2019.

v9.1.0.0p1-Beta

13 Dec 21:03
6c16799
Compare
Choose a tag to compare

This is a beta-release (non-production ready)

This release includes:

  • Upstream changes from OpenSSH 9.0 & OpenSSH 9.1.

  • Breaking changes - see upstream release notes for more information:

    • Switches scp from using the legacy scp/rcp protocol to using the sftp protocol by default.
    • SetEnv directives in ssh_config and sshd_config are now first-match-wins to match other directives. Previously if an environment variable was multiply specified the last set value would have been used.
    • ssh-keygen -A (generate all default host key types) will no longer generate DSA keys.
  • Security Fixes:

    • adds Mark of the Web (MOTW) to scp/sftp file transfers, when possible.
  • Fixes for various reliability issues listed here.

  • LibFido2 upgrade to version 1.12.0.

  • LibreSSL upgrade to version 3.6.1.

  • ZLib upgrade to version 1.2.13.

V8.9.1.0p1-Beta

23 Mar 00:14
ad3edb4
Compare
Choose a tag to compare

This release includes

  • Security fixes

    • Upgrade to LibreSSL 3.4.3. Please refer to #1917
  • Non-security fixes

    • [FIDO] PIN is asked twice with keys generated with -O verify-required. #1918
    • SSH-Agent installed through MSI is missing required privileges. #1914
    • install-sshd.ps1 to allow silent installation #1916

V8.9.0.0p1-Beta

18 Mar 00:09
42bef92
Compare
Choose a tag to compare

This release includes

  • Upstream changes from OpenSSH 8.9. Please note this release doesn't have ssh-agent restriction feature. This is tracked as part of #1902.

  • Breaking change

    • This release disables RSA signatures using the SHA-1 hash algorithm by default. For more information, refer to "Potentially-incompatible changes" here.
  • Security fixes

    • Validate the ACLs of $env:programdata\ssh folder, it's contents. This is not applicable for windows 10+ / windows server 2019+. For more information, refer to #1900
  • Non-security fixes

    • FIDO/U2F hardware authenticators support to Win32-OpenSSH. Thanks to @martelletto, @akshayku.
    • PKCS11 support to ssh-agent. Thanks to @yan4321.
    • MSI installation package. Thanks to @tmeckel, @heaths.
    • Fixes for various reliability issues listed here.

V8.6.0.0p1-Beta

27 May 16:49
8f5d67b
Compare
Choose a tag to compare

This release includes

  • Upstream changes from OpenSSH 8.6. Please note this release doesn't have FIDO support.

  • Breaking change

    • SSH askpass requires SSH_ASKPASS_REQUIRE environment variable to be set as "prefer" (or) "force".
  • Security fixes

    • For non en-us OS, enforce authorized keys for admin users are read from $env:programdata\ssh\administrators_authorized_keys (#1757)
    • Ensure only admin users have access to modify the registry entries like DefaultShell (#1754)
    • Use $env:programdata\ssh\ssh_config only if it has correct file permissions (non-admin users shouldn't have write permissions)
      (#1753)
  • Non-security fixes

    • Allow authorizedKeysCommand to work with the System user. Thanks to @bkatyl, @NoMoreFood.
    • Add moduli support.
    • Allow support to configure the custom shell arguments.
    • Allow SSH connection when the machine name is the same as the user name. Thanks to @oldium.
    • For downlevel OS (win10 below), fix the scrolling issue after reaching the end of the screen.
    • Write non-English characters to ETW / logfile.
    • X11 related bugs . Thanks to @riverar.
    • Fixes for various reliability issues listed here.