From c32475ebd9e3f85a3ec29c4abc93ee78ffa9420f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavol=20=C5=BD=C3=A1=C4=8Dik?= Date: Wed, 10 Dec 2025 12:47:55 +0100 Subject: [PATCH] Do not fail sshd-auth with gssapi-keyex and no hostkeys With GSSAPI key exchange enabled, sshd must support the "null" host key algorithm. This update make sure that the server does not abort the connection if no host key is provided. --- 0012-openssh-9.6p1-gssapi-keyex.patch | 17 +++++++++++++---- openssh.spec | 5 ++++- 2 files changed, 17 insertions(+), 5 deletions(-) diff --git a/0012-openssh-9.6p1-gssapi-keyex.patch b/0012-openssh-9.6p1-gssapi-keyex.patch index f5f54f7..95a4325 100644 --- a/0012-openssh-9.6p1-gssapi-keyex.patch +++ b/0012-openssh-9.6p1-gssapi-keyex.patch @@ -1,4 +1,4 @@ -From 754b023b92aa68742258c55243a6ae8f30ed5a17 Mon Sep 17 00:00:00 2001 +From f19e9dcf94b5d38c701626886cb4c71314fd026d Mon Sep 17 00:00:00 2001 From: Dmitry Belyavskiy Date: Thu, 15 May 2025 13:43:28 +0200 Subject: [PATCH 12/50] openssh-9.6p1-gssapi-keyex @@ -38,14 +38,14 @@ Subject: [PATCH 12/50] openssh-9.6p1-gssapi-keyex ssh_config | 2 + ssh_config.5 | 58 ++++ sshconnect2.c | 154 ++++++++++- - sshd-auth.c | 53 ++++ + sshd-auth.c | 55 +++- sshd-session.c | 9 +- sshd.c | 3 +- sshd_config | 2 + sshd_config.5 | 31 +++ sshkey.c | 72 ++++- sshkey.h | 1 + - 41 files changed, 2984 insertions(+), 76 deletions(-) + 41 files changed, 2985 insertions(+), 77 deletions(-) create mode 100644 kexgssc.c create mode 100644 kexgsss.c @@ -4023,9 +4023,18 @@ index 1ee6000a..0af15bcc 100644 static int diff --git a/sshd-auth.c b/sshd-auth.c -index f957dc22..d51e4636 100644 +index f957dc22..e6f14dd0 100644 --- a/sshd-auth.c +++ b/sshd-auth.c +@@ -722,7 +722,7 @@ main(int ac, char **av) + break; + } + } +- if (!have_key) ++ if (!have_key && !options.gss_keyex) + fatal("internal error: received no hostkeys"); + + /* Ensure that umask disallows at least group and world write */ @@ -844,6 +844,48 @@ do_ssh2_kex(struct ssh *ssh) free(hkalgs); diff --git a/openssh.spec b/openssh.spec index 4f98f19..1cc0674 100644 --- a/openssh.spec +++ b/openssh.spec @@ -43,7 +43,7 @@ Summary: An open source implementation of SSH protocol version 2 Name: openssh Version: %{openssh_ver} -Release: 5%{?dist} +Release: 6%{?dist} URL: http://www.openssh.com/portable.html Source0: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz Source1: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz.asc @@ -586,6 +586,9 @@ test -f %{sysconfig_anaconda} && \ %attr(0755,root,root) %{_libdir}/sshtest/sk-dummy.so %changelog +* Wed Dec 10 2025 Pavol Žáčik - 10.0p1-6 +- Update gssapi-keyex patch to not abort KEX without hostkey + * Thu Jul 24 2025 Fedora Release Engineering - 10.0p1-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild