\u305d\u306e\u4ed6\u306b\u3082\u3001FIDO\u8a8d\u8a3c\u60c5\u5831\u306e\u691c\u8a3c\u30c4\u30fc\u30eb\u304c\u8a66\u9a13\u7684\u306b\u8ffd\u52a0\u3055\u308c\u307e\u3057\u305f\u3002<\/p>\n
\u4e3b\u306a\u5909\u66f4\u70b9\u306f\u4ee5\u4e0b\u306e\u901a\u308a\u3067\u3059\u3002<\/p>\n
\n * This release removes support for the weak DSA signature
\n algorithm, completing the deprecation process that began in
\n 2015 (when DSA was disabled by default) and repeatedly warned
\n over the last 12 months.<\/p>\n
* scp(1), sftp(1): pass \"ControlMaster no\" to ssh when invoked by
\n scp & sftp. This disables implicit session creation by these
\n tools when ControlMaster was set to yes\/auto by configuration,
\n which some users found surprising. This change will not prevent
\n scp\/sftp from using an existing multiplexing session if one had
\n already been created. GHPR557<\/p>\n
* This release has the version number 10.0 and announces itself
\n as \"SSH-2.0-OpenSSH_10.0\". Software that naively matches
\n versions using patterns like \"OpenSSH_1*\" may be confused by
\n this.<\/p>\n
* sshd(8): this release removes the code responsible for the
\n user authentication phase of the protocol from the per-
\n connection sshd-session binary to a new sshd-auth binary.
\n Splitting this code into a separate binary ensures that the
\n crucial pre-authentication attack surface has an entirely
\n disjoint address space from the code used for the rest of the
\n connection. It also yields a small runtime memory saving as the
\n authentication code will be unloaded after the authentication
\n phase completes. This change should be largely invisible to
\n users, though some log messages may now come from \"sshd-auth\"
\n instead of \"sshd-session\". Downstream distributors of OpenSSH
\n will need to package the sshd-auth binary.<\/p>\n
* sshd(8): this release disables finite field (a.k.a modp)
\n Diffie-Hellman key exchange in sshd by default. Specifically,
\n this removes the \"diffie-hellman-group*\" and
\n \"diffie-hellman-group-exchange-*\" methods from the default
\n KEXAlgorithms list. The client is unchanged and continues to
\n support these methods by default. Finite field Diffie Hellman
\n is slow and computationally expensive for the same security
\n level as Elliptic Curve DH or PQ key agreement while offering
\n no redeeming advantages. ECDH has been specified for the SSH
\n protocol for 15 years and some form of ECDH has been the default
\n key exchange in OpenSSH for the last 14 years.<\/p>\n
* sshd(8): this release removes the implicit fallback to compiled-
\n in groups for Diffie-Hellman Group Exchange KEX when the moduli
\n file exists but does not contain moduli within the client-
\n requested range. The fallback behaviour remains for the case
\n where the moduli file does not exist at all. This allows
\n administrators more explicit control over which DH groups will
\n be selected, but can lead to connection failures if the moduli
\n file is edited incorrectly. bz#2793<\/p>\n<\/blockquote>\n
\u5c06\u6765\u767b\u5834\u3059\u308b\u91cf\u5b50\u30b3\u30f3\u30d4\u30e5\u30fc\u30bf\u306f\u3001\u73fe\u5728\u306e\u4e00\u822c\u7684\u306a\u6697\u53f7\u30a2\u30eb\u30b4\u30ea\u30ba\u30e0(\u4f8b\u3048\u3070RSA\u3084ECDSA)\u306e\u5b89\u5168\u6027\u3092\u8105\u304b\u3059\u3068\u4e88\u6e2c\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u5f93\u6765\u306e\u30b3\u30f3\u30d4\u30e5\u30fc\u30bf\u3067\u306f\u6570\u5343\u5e74\u304b\u304b\u308b\u3088\u3046\u306a\u8a08\u7b97\u3092\u6975\u7aef\u306b\u77ed\u7e2e\u3067\u304d\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u3001\u516c\u958b\u9375\u6697\u53f7\u306e\u5b89\u5168\u6027\u304c\u5d29\u308c\u308b\u6050\u308c\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n
\u3053\u308c\u306b\u5bfe\u6297\u3059\u308b\u305f\u3081\u306b\u3001OpenSSH 10.0\u3067\u306f\u300cmlkem768x25519-sha256\u300d\u3068\u3044\u3046\u30cf\u30a4\u30d6\u30ea\u30c3\u30c9\u578b\u306e\u30dd\u30b9\u30c8\u91cf\u5b50\u6697\u53f7\u30a2\u30eb\u30b4\u30ea\u30ba\u30e0\u304c\u30c7\u30d5\u30a9\u30eb\u30c8\u3067\u63a1\u7528\u3055\u308c\u307e\u3057\u305f\u3002\u3053\u308c\u306f\u3001\u91cf\u5b50\u30b3\u30f3\u30d4\u30e5\u30fc\u30bf\u306b\u3088\u308b\u653b\u6483\u306b\u5bfe\u3057\u3066\u8010\u6027\u3092\u6301\u3061\u3064\u3064\u3001\u5f93\u6765\u306e\u6697\u53f7\u6280\u8853\u3068\u3082\u4e92\u63db\u6027\u306e\u3042\u308b\u65b9\u5f0f\u3068\u3057\u3066\u77e5\u3089\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n
OpenSSH\u958b\u767a\u30d7\u30ed\u30b8\u30a7\u30af\u30c8\u306f\u3001\u91cf\u5b50\u30b3\u30f3\u30d4\u30e5\u30fc\u30bf\u6642\u4ee3\u306b\u5099\u3048\u305f\u6697\u53f7\u6280\u8853\u3092\u5c0e\u5165\u3059\u308b\u3053\u3068\u3067\u3001\u5c06\u6765\u7684\u306a\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30ea\u30b9\u30af\u3092\u8efd\u6e1b\u3057\u3088\u3046\u3068\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"
OpenSSH\u958b\u767a\u30d7\u30ed\u30b8\u30a7\u30af\u30c8\u306f4\u67089\u65e5(\u73fe\u5730\u6642\u9593)\u3001SSH\u30b5\u30fc\u30d0\u30fc\u30fb\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u30bd\u30d5\u30c8\u30a6\u30a7\u30a2\u300cOpenSSH\u300d\u306e\u6700\u65b0\u7248\u300cOpenSSH 10.0\/10.0p2\u300d\u3092\u30ea\u30ea\u30fc\u30b9\u3057\u307e\u3057\u305f(\u30ea\u30ea\u30fc\u30b9\u30ce\u30fc\u30c8)\u3002 \u6700\u65b0\u7248\u3067\u306f\u53e4\u304f\u306a\u3063 […]<\/p>\n","protected":false},"author":2,"featured_media":128435,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"swell_btn_cv_data":"","footnotes":""},"categories":[75],"tags":[3398,1439],"class_list":["post-128434","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-software","tag-openssh","tag-ssh"],"_links":{"self":[{"href":"https:\/\/softantenna.com\/blog\/wp-json\/wp\/v2\/posts\/128434","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/softantenna.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/softantenna.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/softantenna.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/softantenna.com\/blog\/wp-json\/wp\/v2\/comments?post=128434"}],"version-history":[{"count":0,"href":"https:\/\/softantenna.com\/blog\/wp-json\/wp\/v2\/posts\/128434\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/softantenna.com\/blog\/wp-json\/wp\/v2\/media\/128435"}],"wp:attachment":[{"href":"https:\/\/softantenna.com\/blog\/wp-json\/wp\/v2\/media?parent=128434"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/softantenna.com\/blog\/wp-json\/wp\/v2\/categories?post=128434"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/softantenna.com\/blog\/wp-json\/wp\/v2\/tags?post=128434"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"\"](\"https:\/\/softantenna.com\/blog\/wp-content\/uploads\/2025\/04\/s_20250410_104239.jpg\")
<\/p>\n