Your message dated Tue, 06 Oct 2026 17:34:51 +0000
with message-id <[email protected]>
and subject line Bug#1142934: fixed in openssh-gssapi 1:10.6p1-1
has caused the Debian Bug report #1142934,
regarding openssh-server: ssh_host_mldsa44_ed25519_key.pub not generated by the
postinst
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1142934: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1142934
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: openssh-server
Version: 1:10.4p1-2
Severity: wishlist
Dear Maintainer,
OpenSSH upstream added a new hybrid hostkey type
ssh_host_mldsa44_ed25519_key.pub.
It is enabled by default, and can be created with ssh-keygen -A.
The openssh-server postinst script however doesn't use ssh-keygen -A and
instead only generates hostkeys of known types and the ones that are configured
in the sshd config.
It appears that it currently doesn't know about mldsa44_ed25519 host key type,
please add support for this new host key type.
```
Setting up openssh-server (1:10.4p1-2) ...
Creating config file /etc/ssh/sshd_config with new version
Creating SSH2 RSA key; this may take some time ...
3072 SHA256:YnsFWosh7fXafsy54N5Ly8Xhcs2cyN3G7QSqNbOru2o root@7b108694ebc2 (RSA)
Creating SSH2 ECDSA key; this may take some time ...
256 SHA256:Bd/QtLaV17Kb00huRz1wOeDnSgxQDe3XvffKshbAgWg root@7b108694ebc2 (ECDSA)
Creating SSH2 ED25519 key; this may take some time ...
256 SHA256:Nsx0T7zLEBNiYkELwLbX44pkYqG0DMEBalJ+bNB23ss root@7b108694ebc2
(ED25519)
...
# ssh-keygen -A
ssh-keygen: generating new host keys: MLDSA44-ED25519
...
# ls -latr *.pub
-rw-r--r-- 1 root root 571 Jul 28 10:52 ssh_host_rsa_key.pub
-rw-r--r-- 1 root root 179 Jul 28 10:52 ssh_host_ecdsa_key.pub
-rw-r--r-- 1 root root 99 Jul 28 10:52 ssh_host_ed25519_key.pub
-rw-r--r-- 1 root root 1895 Jul 28 10:53 ssh_host_mldsa44_ed25519_key.pub
```
Likely postinst needs to learn about mldsa44_ed25519 type/filename.
-- System Information:
Debian Release: forky/sid
APT prefers questing-updates
APT policy: (500, 'questing-updates'), (500, 'questing-security'), (500,
'questing'), (100, 'questing-backports')
Architecture: amd64 (x86_64)
Kernel: Linux 7.1.3-zabbly+ (SMP w/12 CPU threads; PREEMPT)
Kernel taint flags: TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages openssh-server depends on:
ii debconf [debconf-2.0] 1.5.91
ii init-system-helpers 1.68
ii libaudit1 1:4.0.5-1build1
ii libc6 2.42-0ubuntu3.1
ii libcom-err2 1.47.2-3ubuntu2
ii libcrypt1 1:4.4.38-1build1
ii libgssapi-krb5-2 1.21.3-5ubuntu2
ii libkrb5-3 1.21.3-5ubuntu2
ii libpam-modules 1.7.0-5ubuntu2
ii libpam-runtime 1.7.0-5ubuntu2
ii libpam0g 1.7.0-5ubuntu2
ii libselinux1 3.8.1-1build1
ii libssl3t64 3.5.3-1ubuntu3.4
ii libwrap0 7.6.q-36build1
ii openssh-client 1:10.0p1-5ubuntu5.4
ii openssh-sftp-server 1:10.0p1-5ubuntu5.4
ii procps 2:4.0.4-8ubuntu3
ii systemd [systemd-sysusers] 257.9-0ubuntu2.5
ii sysvinit-utils [lsb-base] 3.14-4ubuntu1
ii ucf 3.0052
ii zlib1g 1:1.3.dfsg+really1.3.1-1ubuntu2
Versions of packages openssh-server recommends:
ii libpam-systemd [logind] 257.9-0ubuntu2.5
ii ncurses-term 6.5+20250216-2ubuntu0.1
ii ssh-import-id 5.11-0ubuntu3
ii xauth 1:1.1.2-1.1
Versions of packages openssh-server suggests:
pn molly-guard <none>
pn monkeysphere <none>
pn ssh-askpass <none>
ii ufw 0.36.2-9
-- debconf information excluded
--- End Message ---
--- Begin Message ---
Source: openssh-gssapi
Source-Version: 1:10.6p1-1
Done: Colin Watson <[email protected]>
We believe that the bug you reported is fixed in the latest version of
openssh-gssapi, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Colin Watson <[email protected]> (supplier of updated openssh-gssapi package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Tue, 06 Oct 2026 18:13:30 +0100
Source: openssh-gssapi
Architecture: source
Version: 1:10.6p1-1
Distribution: unstable
Urgency: medium
Maintainer: Debian OpenSSH Maintainers <[email protected]>
Changed-By: Colin Watson <[email protected]>
Closes: 1142934 1148624
Changes:
openssh-gssapi (1:10.6p1-1) unstable; urgency=medium
.
* New upstream release:
- scp(1): begin deprecating the -R flag, which is used to perform a
remote-to-remote copy by executing scp on a remote host. This option
is a fragile optimisation that is difficult to use because it requires
credentials on the remote host. It also creates security risks if the
shell quoting rules on the remote system where the copy is performed
differ from the client's expectations.
.
From OpenSSH 10.6, this option will continue to work but will cause a
deprecation warning to be emitted to standard error. In a future
release, the option will be ignored and will leave in place the
default remote-to-remote copy behaviour (copy via the host running
scp).
- SECURITY: sftp(1): more strictly validate paths returned from the
server to avoid some cases where a server could return paths that
could manipulate a recursive copy operation into writing outside its
target directory.
- SECURITY: sshd(8): when GSSAPIAuthentication is in use, only store
GSSAPI credentials when authentication has succeeded. Avoids a
situation where credentials from a failed GSSAPIAuthentication attempt
may persist and be made inappropriately available if another
authentication subsequently succeeds.
- SECURITY: sshd(8): reset GSSAPIAuthentication before authentication,
avoiding state from one authentication attempt being confused with
that of a later attempt.
- SECURITY: sshd(8), ssh(1): disable LZ77 dictionary coder to mitigate
side-channel leaks. A chosen-plaintext attack method exists which
makes use of dictionary-based compression to recover secrets from one
channel by interacting with the SSH session's shared compression
dictionary through another channel.
.
Attacker-controlled input can recognizably reflect into the total
length of transmitted ciphertexts by virtue of LZ77 replacing repeated
strings with back-references into the SSH session's encoder search
buffer, which is shared across all channels. For this reason, the
documentation already recommended against enabling compression for
connections that share trusted and untrusted traffic.
.
This change will reduce the effectiveness of the Compression option.
Users are encouraged to use application-level compression over the SSH
protocol where possible, as this will typically be more effective and
will be completely immune to this type of attack.
- SECURITY: ssh(1): disallow '$' and '\' characters in usernames entered
on the command-line to avoid usernames from untrusted sources yielding
injection in shell context via ProxyCommand, Match exec, etc.
Usernames specified via the configuration files are not subject to
this control.
.
We continue to recommend against directly exposing ssh(1) and other
tools' command-lines to untrusted input. Mitigations such as this
cannot be absolute given the variety of shells and user configurations
in use.
- SECURITY: ssh-keygen(1): correct handling of Daylight Saving Time when
converting dates. Previous handling could cause errors of up to +/- 1
hour (unless you are in the Antarctica/Troll timezone, where the error
could be +/- 2 hours). These errors could result in creation of
certificates with incorrect expiry times.
- SECURITY: sshd(8), ssh(1): ensure that compressed payloads don't
inflate past the maximum supported packet length.
- SECURITY: sshd(8): fully honor the authorized_keys "restrict" keyword,
which was not being properly applied to tunnel forwarding
(PermitTunnel, disabled by default).
- SECURITY: sshd(8): correctly handle some options that accept "none".
Some options, including AuthorizedPrincipalsFile, were documented as
accepting "none" as a way to disable them; however, when overridden by
an sshd_config(5) Match keyword, this argument was being incorrectly
interpreted as a literal file.
- All: enable hybrid post-quantum ssh-mldsa44-ed25519 signature
algorithm. Note that this no longer uses the "@openssh.com" vendor
extension suffix that the previous experimental implementation used.
Keys generated with the previous experimental support must be
regenerated and/or removed.
- sshd(8): Add the WarnWeakCrypto option to sshd_config(5). This option
was previously available for the client only. This option is enabled
by default and will log when the client uses a key agreement scheme
that is not post-quantum safe.
- ssh-keygen(1), ssh-add(1): preserve user-verification (PIN or
biometric) requirement for resident keys loaded from a FIDO token, by
checking the credential's credProtect policy.
- ssh(1): include local and remote version strings in the ~I connection
information display.
- ssh-add(1): add a -P flag to skip PIN entry for FIDO and PKCS#11
tokens that do not require it.
- sftp(1): add '-p' flag for mkdir/lmkdir to create directories as
required. This flag has similar ergonomics to mkdir(1), and
previously-existing directories do not cause an error.
- ssh-keygen(1): add a "hexdump" key export mode that dumps the SSH
wire-formatted key blob in hex format. Useful when writing
documentation, tests, etc. E.g. `ssh-keygen -em hexdump -f /key`.
- ssh(1), sshd(8): ChannelTimeout now accepts timeouts with fractional
seconds.
- sshd(8): allow specification of the location of $SSH_AUTH_SOCK used
for agent forwarding using a new AgentSocketPath option. This supports
both using a user-specific path, such as the default of a subdirectory
of $HOME ("user:.ssh/agent"), and the previous approach of allowing
agent forwarding sockets to be located in a shared directory (e.g.
"shared:/tmp"). Sockets created in shared directories will be created
inside a subdirectory with a randomised name.
- ssh-agent(1): allow specification of agent socket directories using a
-A flag. It accepts "user:" and "shared:" directory styles similar to
the sshd AgentSocketPath option.
- sshd(8): account for public key authentication "key ok" tests
separately to auth attempts. Add a `PubkeyOptions max-pk-ok:nnnn`
option to allow a number of PK_OK tests (asking whether the server
might accept a given public key) that do not count against
MaxAuthTries, defaulting to 6 attempts. After these attempts are
exhausted, further attempts count as failed authentications against
MaxAuthTries. Practically, this allows more keys on disk or held in
ssh-agent to be checked for use before the server disconnects.
- ssh(1), sshd(8): extend the existing TCPKeepAlive option to also
support setting keepalives on sockets created for forwarding
connections. Previously this option controlled keepalives on the
connection socket only. TCPKeepAlive "yes" or "transport" enables
keepalives on the connection socket. "TCPKeepAlive all" additionally
enables them for forwarding sockets.
- sshd(8), ssh(1): fix configuration matching on more Turkic languages
which have disjoint dotted and dotless i/I characters, specifically
Azerbaijani and Crimean Tatar.
- ssh(1), sshd(8): don't attempt to set TCP_NODELAY on non-IP/IPv6
sockets. Eliminates some noise in debug logs.
- ssh(1): fix case for ssh -G option output.
- ssh(1), sshd(8): Fix ChannelTimeout specificity; previously a more
specific channel type (e.g. "session:shell") could clobber a
user-specified ChannelTimeout if it was less specific (e.g.
"session"). Also, in some cases, the debug messages were printing 0
instead of the effective timeout.
- sftp(1): avoid NULL dereference crash in some circumstances when a
server fails a stat/lstat operation.
- sshd(8): close a race condition where a SIGTERM/SIGQUIT would be
ignored if it was received by the server while it was processing a
SIGHUP restart request.
- sshd(8), ssh(1): check key and CA signature types during key parsing
against allowlists (PubkeyAcceptedAlgorithms, etc) as early as
possible. This reduces the attack surface presented by disabled
algorithms.
- All: switch the fallback implementation of the ed25519 signature
algorithm used when libcrypto is disabled from SUPERCOP ed25519 to
libsodium. The libsodium implementation includes a number of
strictness checks over the original reference implementation we have
used to this point and a more ergonomic API.
- ssh-add(1), ssh(1), ssh-keygen(1): fix spin on password entry when the
program attempting to read a password was started in a background
process group, with no TTY and with certain signals ignored.
- scp(1): disallow nul byte in received scp -O filename. This was not
reachable in normal operation.
- ssh-keygen(1), ssh(1), sshd(8): implement a maximum number of KDF
rounds that will be accepted when writing an OpenSSH-format private
key or when loading one. This limit is set quite high (1M), but
ensures that a service that is passed a bad key with a ridiculously
high number of rounds will eventually complete parsing it.
- ssh-keygen(1): bump the default number of KDF rounds from 24 to 32
(this is a linear increase, not like bcrypt(3) which is exponential).
- ssh(1): make StreamLocalBindMask properly respect Host/Match blocks
and make it first-match-wins as documented.
- sshd(8): make StreamLocalBindMask properly first-match-wins.
- sshd(8): don't link sshd against libselinux when SELinux support is
enabled (note: this library is still linked for the sshd-auth and
sshd-session helper binaries).
- sshd(8): restrict mremap(2) flags accepted by the seccomp sandbox.
Only MREMAP_MAYMOVE is now accepted as other flags may have some
utility in attack chains.
- sshd(8): allow PAMServiceName in Match (regressed in 10.4). During the
refactor of server option parsing, the ability to set PAMServiceName
in Match blocks was accidentally disabled.
* Generate MLDSA44-ED25519 host key by default (closes: #1142934).
* Skip purging if openssh-{client,server}-gssapi is installed (closes:
#1148624).
Checksums-Sha1:
f6132dd5097c331603be50a504bc944dc0d9e93b 2971 openssh-gssapi_10.6p1-1.dsc
4cc8cbf8157c26da4a438017e76d4b630207ebb9 1653184
openssh-gssapi_10.6p1.orig.tar.xz
5fd7d652c97e5c0966d5f2aaf5e8f41f6e8bc42f 201772
openssh-gssapi_10.6p1-1.debian.tar.xz
1abcaa19c9012510e8a33fbdf5be3628b0a36e7d 5605348
openssh-gssapi_10.6p1-1.git.tar.xz
78790d2adbe498d84c36df4719a4308ef3f578dc 17758
openssh-gssapi_10.6p1-1_source.buildinfo
Checksums-Sha256:
c04b474dac25f9cb141b5f9ad96206376220b9df8e6680e7c8137772ca6c644f 2971
openssh-gssapi_10.6p1-1.dsc
715c8724c17be381d59561f5e26eb487951714f3379a685cd3e8ff6e9d6afc43 1653184
openssh-gssapi_10.6p1.orig.tar.xz
7462e96b9b1d4241371aa33afa911f21886d3a0ad04e30ca1d7681f9c2741623 201772
openssh-gssapi_10.6p1-1.debian.tar.xz
b6b393078689f08a8579bb5e22bac59bf31fe8f9900989dc24c0cbcdfa9ff31b 5605348
openssh-gssapi_10.6p1-1.git.tar.xz
14b3d2856e25fac3355a90f115788a67ef7b20957edef1fa7d33a393ec85e599 17758
openssh-gssapi_10.6p1-1_source.buildinfo
Files:
b312ce29bc05b0b2b6d9b12648f6c54d 2971 net optional openssh-gssapi_10.6p1-1.dsc
4b7182ed1cea1997822718f167bd9962 1653184 net optional
openssh-gssapi_10.6p1.orig.tar.xz
1699c106f4ee3d33bb81d3d9b90b093d 201772 net optional
openssh-gssapi_10.6p1-1.debian.tar.xz
dc03d16f72d16a13044c19b93e6326b4 5605348 net optional
openssh-gssapi_10.6p1-1.git.tar.xz
34274a8d457eb0f441fab3a10027c59d 17758 net optional
openssh-gssapi_10.6p1-1_source.buildinfo
Git-Tag-Info: tag=8b6424dd0c8e91cadf955627b3852993ae3d590f
fp=ac0a4ff12611b6fccf01c111393587d97d86500b
Git-Tag-Tagger: Colin Watson <[email protected]>
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmrFLPcACgkQYG0ITkaD
wHlKHxAApQtbbc8d0e0by3p3A3Y5wRkqQ9gr26LhJ6qMEw/V1Df9UONYhmc/xiKX
Wj1Nwux0VkxU8nc1AKxORCHS/qTl6a9O8J9hFnVQpi+YZ7zHinl1WRenIo1Qn5xZ
zEGNFjbai9BwzVNKtT9d0VMGX/+8XdVDedjIKJCkfoP8lmdgAD2BlS1BuxqRyCK9
CoeuDuPv3/O/ODFBUBDVcoXZGsQAVA8KVbbJc8YkHFPI1M7xEjKijrPvjSVMzy1a
zUtQnU0zHNlsmi/NNtxFL6HPffkX2NY0Dh/gVb4QT/ukOVPRXWarT/F0fBTWLvHl
wNdbIBiK73/KFj8fnUM6gvntyGjnQo5TtiF+KoNQEVNDvjNZQ4q1VS/3iwNrGqOx
uIhGPnpkTKCX8crj0V6Uzeb3tPc578bPLd7bn+zJNrKCvrUX2AR7kHD72a38bmkh
qSDJYOJjT2sHtDjBkKv14pb2EQ15Dv4aFQqk3naunXj0C2G/+kjLs5RmL8NeKTZ0
t11/em/BaTBdiaxLpXatT/0KCOSU6DDFsNKHFO6o/M7zXKOhcHq15SjE6B8RHbah
ANyf1ckVYoo34cubTOapt71zrf1CR+ZozJVztoV5714OjIyZhkVu2cNyFTkTW8ub
PPymAZAYRjGszlufPIJxkMbAO+okxcv0Nbnroe+KLhLIrBoiFcg=
=dc0z
-----END PGP SIGNATURE-----
pgpvYymGEYfTM.pgp
Description: PGP signature
--- End Message ---
