We are currently using OpenSSH 8.7p1. We should upgrade OpenSSH to the latest version 9.0p1 (released 2022-04-08) and in turn upgrade OpenSSL and potentially other dependencies.
We are currently on OpenSSL 3.0.0 with the latest release being 3.0.4 (released 2022-06-21).
Vulnerabilities affecting 3.0.0: > CVE-2021-4044 > CVE-2022-0778 > CVE-2022-1343 X.509, so not something we use. > CVE-2021-4160 Only MIPS. > CVE-2022-1292 > CVE-2022-2068 Affects the c_rehash script, which we don't use. > CVE-2022-1434 Affects old cipher suite that isn't even compiled in. > CVE-2022-1473 Doesn't look like it is relevant for OpenSSH's usage. > CVE-2022-2274 Doesn't affect 3.0.0, but it does affect 3.0.4, so we need to include the fix for this.
There is also CVE-2018-25032 for zlib. However, it seems irrelevant since it only affects non-standard settings. I cannot find any use of the referenced settings in our tree.
Tested zlib by running a new client and server and seeing that graphics update still look correct. Tested libtasn1 by checking that the client can still parse smart card certificates.
A quick test has been done for x86_64, win32 and osx64. No obvious problems right now, but a more thorough test run is needed.
I don't see any noteworthy user visible changes apart from the ssh-rsa deprecation, so that's all I've put in the release notes.
Tested with SLES 12 as the server, and clients: * Linux (Fedora 35) * Windows 11 (32-bit and 64-bit) * macOS 12 (native) Tested * Password auth * Public key auth * Smart card auth * Tunnels (smart cards and audio) Also checked the log files for each run and didn't see anything suspicious.
Tested Kerberos auth against a Fedora 36 machine running server build #2744 with Client build #2648 on: • ☑ Windows 11 (64-bit build) • ☑ Windows 11 (32-bit build) • ☑ Fedora 36 (AMD64) • ☑ macOS (x86) Log files looking good!
Tested the armhf client from client build #2648 on Ubuntu 13.04: • ☑ Password • ☑ Public key • ☑ Kerberos • ☑ Smart card No surprises and the logs look very normal :)
I also did some torture-testing of the SSH transport part of the armhf client. This was done by showing an animated full-screen RGB noise (to make things hard for the application layer compression) and playing audio in the background. This resulted in an average SSH CPU usage of roughly 50% for client build #2648 and somewhat higher for the 4.14.0 client. Memory usage was negligible for both clients. So, we seemingly have no obvious performance regressions in the upgraded SSH client.
It tested performance on x86_64 as well by playing a YouTube video at full screen. No noticeable difference compared to 4.14.0 there either. Possibly a slight reduction in CPU usage.
Everything seems to work fine. For testing, things affected are: * ssh and openssl (transport, auth) * libtasn1 (cert reading) * zlib (compression in various places, most prominently in vnc)
Also pushed one of our local modifications upstream: https://github.com/openssh/openssh-portable/pull/330
I have tested client build 2665 and server build 2760. I tested the server on Fedora 36 and Ubuntu 22.04. I performed all tests on the following client platforms: * Fedora 36 * Windows 11 * macOS 12.4 (M1) I verified the following: ✓ Accepting server host key works ✓ Password authentication ✓ Wrong password is rejected ✓ Correct password logs in ✓ OTP with Google-Authenticator ✓ Incorrect PIN is rejected ✓ Correct PIN logs in ✓ Kerberos authentication ✓ No ticket is rejected ✓ Ticket for wrong user is rejected ✓ Correct ticket logs in ✓ Public key authentication ✓ The public part of the key pair doesn't work ✓ Non existing file doesn't work ✓ A private key with too open permissions is rejected ✓ A key with too short length is rejected ✓ A proper private key logs in ✓ Smart card authentication ✓ Our smart card certificate filters work ✓ Incorrect PIN is rejected ✓ Correct PIN logs in ✓ Mapping of certificate to username works ✓ Auto connect works when only one certificate is available ✓ Auto disconnect works when unplugging the smart card reader ✓ Auto disconnect works when removing the smart card ✓ Playing a YouTube video in the session ✓ Graphical updates work well ✓ Audio playback works well and is synced with the image ✓ CPU usage of ssh process looks the same comparing to 4.14.0 All good! I also took the opportunity to write updated tutorials for setting up OTP and Smart card authentication: https://community.thinlinc.com/t/how-to-set-up-one-time-password-otp-authentication-in-thinlinc/409 https://community.thinlinc.com/t/how-to-set-up-authentication-in-thinlinc-with-pkcs-15-smart-cards/408 And I clarified our instructions for using our LAB.LKPG.CENDIO.SE kerberos test realm.
