Call for testing: OpenSSH 10.4

[Dmitry Belyavskiy]

On Sun, Jul 5, 2026 at 8:47 AM Damien Miller <djm at mindrot.org> wrote:

> On Sun, 5 Jul 2026, Dmitry Belyavskiy wrote:
>
> > Dear Damien,
> >
> > On Sun, Jul 5, 2026 at 2:11 AM Damien Miller <djm at mindrot.org> wrote:
> >
> >
> >       Redhat's patch to sshd has it attempt an extra rsa/sha1
> >       signature per
> >       connection because of a lack of a better way to do it. RSA
> >       signatures
> >       aren't super expensive, but this seems like a wasteful way to
> >       find out
> >       (effectively) whether a flag has been set.
> >
> >
> > Is it really per-connection? I was sure it happens in the main sshd
> process
> > and then inherited by a child.
>
> No, at least in Fedroa, it happens in sshd-session, which is per-session
>
>
> https://src.fedoraproject.org/rpms/openssh/blob/rawhide/f/0041-openssh-8.7p1-nohostsha1proof.patch#_336
>

I would be happy to move it back to sshd, but yes, I recall that after
refactoring and separating sshd-session I didn't manage to keep this check
in the main process

-- 
Dmitry Belyavskiy