A fost lansată versiunea 4.4 a lui OpenSSH. Din changelog aflăm ce e nou:

* Implemented conditional configuration in sshd_config(5) using the
“Match” directive. This allows some configuration options to be
selectively overridden if specific criteria (based on user, group,
hostname and/or address) are met. So far a useful subset of post-
authentication options are supported and more are expected to be
added in future releases.

* Add support for Diffie-Hellman group exchange key agreement with a
final hash of SHA256.

* Added a “ForceCommand” directive to sshd_config(5). Similar to the
command=”…” option accepted in ~/.ssh/authorized_keys, this forces
the execution of the specified command regardless of what the user
requested. This is very useful in conjunction with the new “Match”

* Add a “PermitOpen” directive to sshd_config(5). This mirrors the
permitopen=”…” authorized_keys option, allowing fine-grained
control over the port-forwardings that a user is allowed to

* Add optional logging of transactions to sftp-server(8).

* ssh(1) will now record port numbers for hosts stored in
~/.ssh/authorized_keys when a non-standard port has been requested.

* Add an “ExitOnForwardFailure” option to cause ssh(1) to exit (with
a non-zero exit code) when requested port forwardings could not be

* Extend sshd_config(5) “SubSystem” declarations to allow the
specification of command-line arguments.

* Replacement of all integer overflow susceptible invocations of
malloc(3) and realloc(3) with overflow-checking equivalents.

* Many manpage fixes and improvements

* New portable OpenSSH-specific features:

– Add optional support for SELinux, controlled using the
–with-selinux configure option (experimental)

– Add optional support for Solaris process contracts, enabled
using the –with-solaris-contracts configure option (experimental)
This option will also include SMF metadata in Solaris packages
built using the “make package” target

– Add optional support for OpenSSL hardware accelerators (engines),
enabled using the –with-ssl-engine configure option.