Language Selection

English French German Italian Portuguese Spanish

OpenSSH 8.2 was released on 2020-02-14.

Filed under
Security
BSD

It is now possible[1] to perform chosen-prefix attacks against the SHA-1 hash algorithm for less than USD$50K. For this reason, we will be disabling the "ssh-rsa" public key signature algorithm that depends on SHA-1 by default in a near-future release.

This algorithm is unfortunately still used widely despite the existence of better alternatives, being the only remaining public key signature algorithm specified by the original SSH RFCs.

Read more

Also: DragonFlyBSD Improves Its TMPFS Implementation For Better Throughput Performance

OpenSSH 8.2 Released With FIDO/U2F Support

  • OpenSSH 8.2 Released With FIDO/U2F Support

    OpenSSH 8.2 is out this Valentine's Day as the leading SSH suite. Besides working to disable the SSH-RSA public key signature algorithm due to SHA1 collision attacks, OpenSSH 8.2 also comes with new features.

    The shiny new feature of OpenSSH 8.2 is support for FIDO/U2F hardware authenticators. FIDO/U2F two-factor authentication hardware can now work with OpenSSH 8.2+, including ssh-keygen can be used to generate a FIDO token backed key. Communication to the hardware token with OpenSSH is managed by a middleware library specified via the SSH/SSHD configuration, including the option for its own built-in middleware for supporting USB tokens.

OpenSSH adds support for FIDO/U2F security keys

New Qt5 and OpenSSH in [Slackware] Current

  • New Qt5 and OpenSSH in [Slackware] Current

    Another big thing happening in -current is the new OpenSSH 8.2 release which will bring some incompatible changes, especially if you are still using ssh-rsa as the algorithm. To test whether your machine is affected, try to run this command in your shell

    ssh -oHostKeyAlgorithms=-ssh-rsa user@host

    If you managed to connect using the above command, it means that your OpenSSH software is fine, but if you don't, then it needs to be upgraded.

Corbet at LWN

  • OpenSSH 8.2 released

    OpenSSH 8.2 is out. This release removes support for the ssh-rsa key algorithm, which may disrupt connectivity to older servers; see the announcement for a way to check whether a given server can handle newer, more secure algorithms. Also new in this release is support for FIDO/U2F hardware tokens.

OpenSSH Now Supports FIDO/U2F Security Keys

  • OpenSSH Now Supports FIDO/U2F Security Keys

    OpenSSH is, by far, the single most popular tool for logging into remote servers and desktops. SSH logins are generally considered fairly safe, but not 100%. If you’re not satisfied with the out the box security offered by OpenSSH, you can always opt to go with SSH key authentication. If that’s not enough, there’s always 2 Factor Authentication, which would then require you to enter a PIN generated by an application such as OTPClient or Authy.

    As of OpenSSH 8.2, there’s a newly supported option, FIDO/U2F security keys. What this means is that you can now use 2FA hardware keys (such as the Yubi Key) to authenticate your SSH login attempt.

    2FA is often considered the easiest method of adding an additional layer of security to SSH logins. However, for many, Hardware Keys are considered the single most secure means of preventing hackers from brute-forcing your SSH passwords. To make things easy, the OpenSSH developers have made it possible to generate a FIDO token-backed key using the ssh-keygen command. So anyone used to creating SSH keys shouldn’t have any problem getting up to speed with integrating hardware keys into SSH.

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

More in Tux Machines

Septor 2020.5

Tor Browser is fully installed (10.0.2) System upgrade from Debian Buster repos as of October 21, 2020 Update Linux Kernel to 5.9.0-1 Update Thunderbird to 78.3.1-2 Update Tor to 0.4.4.5 Update Youtube-dl to 2020.09.20 Read more

Incremental backup with Butterfly Backup

This article explains how to make incremental or differential backups, with a catalog available to restore (or export) at the point you want, with Butterfly Backup. Read more

Regressions in GNU/Linux Evolution

  • When "progress" is backwards

    Lately I see many developments in the linux FOSS world that sell themselves as progress, but are actually hugely annoying and counter-productive. Counter-productive to a point where they actually cause major regressions, costs, and as in the case of GTK+3 ruin user experience and the possibility that we'll ever enjoy "The year of the Linux desktop". [...] We live in an era where in the FOSS world one constantly has to relearn things, switch to new, supposedly "better", but more bloated solutions, and is generally left with the impression that someone is pulling the rug from below one's feet. Many of the key changes in this area have been rammed through by a small set of decision makers, often closely related to Red Hat/Gnome/freedesktop.org. We're buying this "progress" at a high cost, and one can't avoid asking oneself whether there's more to the story than meets the eye. Never forget, Red Hat and Microsoft (TM) are partners and might even have the same shareholders.

  • When "progress" is backwards

Graphics: Vulkan, Intel and AMD

  • NVIDIA Ships Vulkan Driver Beta With Fragment Shading Rate Control - Phoronix

    This week's Vulkan 1.2.158 spec release brought the fragment shading rate extension to control the rate at which fragments are shaded on a per-draw, per-primitive, or per-region basis. This can be useful similar to OpenGL and Direct3D support for helping to allow different, less important areas of the screen be shaded less than areas requiring greater detail/focus. NVIDIA on Tuesday released the 455.26.02 Linux driver (and 457.00 version for Windows) that adds this fragment shading rate extension.

  • Intel Begins Adding Alder Lake Graphics Support To Their Linux Driver - Phoronix

    Intel has begun adding support for Alderlake-S to their open-source Linux kernel graphics driver. An initial set of 18 patches amounting to just around 300 lines of new kernel code was sent out today for beginning the hardware enablement work on Alderlake-S from the graphics side. Yes, it's only a few hundred lines of new driver code due to Alder Lake leveraging the existing Gen12/Tigerlake support. The Alder Lake driver patches similarly re-use some of the same workarounds and changes as set for the 14nm Rocket Lake processors with Gen12 graphics coming out in Q1.

  • AMD Linux Driver Preparing For A Navi "Blockchain" Graphics Card - Phoronix

    While all eyes are on the AMD Radeon RX 6000 "Big Navi" graphics cards set to be announced next week, it also looks like AMD is preparing for a Navi 1x "Blockchain" graphics card offering given the latest work in their open-source Linux driver. Patches posted today provide support for a new Navi graphics card referred to as the "navi10 blockchain SKU." The Navi 10 part has a device ID of 0x731E. From the AMDGPU Linux kernel driver perspective, the only difference from the existing Navi 10 GPU support is these patches disable the Display Core Next (DCN) and Video Core Next (VCN) support with this new SKU not having any display support.