CVE and update status of the FreeBSD ports tree3,296 unaddressed CVEs in 671 portsAll times are CET
Port details

security/openssh-portable 10.6.p1,1

The portable version of OpenBSD's OpenSSH

Port info

Maintainer
bdrewery@FreeBSD.org
Packages
latest: openssh-portable 10.6.p1,1, openssh-portable-gssapi 10.6.p1,1, openssh-portable-hpn 10.6.p1,1
Upstream
Higher version available: 18.12.0
Last update
to 10.6.p1,1 · 3ae2665579
Quarterly
2026Q4: openssh-portable 10.6.p1,1, openssh-portable-hpn 10.6.p1,1 · last MFH a6d0a08dd7
Formerly
security/openssh-portable-devel until 2016-02-29, security/hpn-ssh until 2006-03-15
WWW
https://www.openssh.com/portable.html
Links
cgit · VuXML · Report wrong data

Install

Package
# pkg install openssh-portable
# pkg install openssh-portable-gssapi
# pkg install openssh-portable-hpn
installs openssh-portable 10.6.p1,1, openssh-portable-gssapi 10.6.p1,1, openssh-portable-hpn 10.6.p1,1 from latest; from quarterly (2026Q4) openssh-portable 10.6.p1,1, openssh-portable-hpn 10.6.p1,1
Port
# cd /usr/ports/security/openssh-portable && make install clean
# make -C /usr/ports/security/openssh-portable config  # change options first
Size
1.2 MiB download · 8.2 MiB installed
Depends on
devel/libedit 3.1.20260512,1, dns/ldns 1.9.2, security/libfido2 1.17.0
License
OPENSSH
Options
7 of 14 on in the package: BLOCKLISTD DOCS FIDO_U2F LDNS LIBEDIT PAM TCP_WRAPPERS
Show the 7 options that are off
BSM HEIMDAL HEIMDAL_BASE HPN KERB_GSSAPI MIT NONECIPHER
pkg-message
Shown after installing
To enable this port, add openssh_enable="YES" in your rc.conf. To
prevent conflict with openssh in the base system add sshd_enable="NO"
in your rc.conf. Also you can configure openssh at another TCP port (via
sshd_config 'Port' and 'Listen' options or via 'openssh_flags'
variable in rc.conf) and run it in same time with base sshd.

'PermitRootLogin no' is the default for the OpenSSH port.
This now matches the PermitRootLogin configuration of OpenSSH in
the base system.  Please be aware of this when upgrading your
OpenSSH port, and if truly necessary, re-enable remote root login
by readjusting this option in your sshd_config.

Users are encouraged to create single-purpose users with ssh keys, disable
Password authentication by setting 'PasswordAuthentication no' and
'ChallengeResponseAuthentication no', and to define very narrow sudo
privileges instead of using root for automated tasks.
Note
Size, dependencies, options and messages are those of openssh-portable.

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 1610.6.p1,110.6.p1,1–
FreeBSD 1510.6.p1,110.6.p1,1–
FreeBSD 1410.6.p1,110.6.p1,110.6.p1,1

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 1510.6.p1,110.6.p1,1–
FreeBSD 1410.6.p1,110.6.p1,110.6.p1,1

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed and VuXML only (0)

No unaddressed CVE and nothing reported by pkg audit for the packaged version 10.6.p1,1.

Fixed (29)

Show 29 fixed
VuXML entries whose affected range the packaged version has left, plus CVEs from the last 90 days that this version is already past (fixed by update).
CVECVSSPublishedDescription
CVE-2026-1065856.52026-10-06In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.
CVE-2026-1065524.22026-10-06In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation.
CVE-2026-1065823.72026-10-06In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 "Crossing the Streams" findings.
CVE-2026-1065873.62026-10-06In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled.
CVE-2026-1065883.12026-10-06In sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK has the side effect of loss of sandboxing, which is potentially unexpected.
CVE-2026-1065892.92026-10-06In sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO OpenServer 5, sshd-session can unexpectedly have root privileges. This is related to the G…
CVE-2026-1065832.52026-10-07In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection.
CVE-2026-1065842.52026-10-06In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more severe effe…
CVE-2026-1065862.52026-10-06In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than …
CVE-2026-1065532.22026-10-06In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt.
CVE-2026-1065552.22026-10-06In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts.

Problem reports (9) · open in Bugzilla, most recently changed first

PRSummaryStatusChanged
298530maintainer-feedback? security/openssh-portable: new GSSAPIKeyExchange patchNew2026-10-22
297915maintainer-feedback? security/openssh-portable: Catch up with base patchesNew2026-08-25
282222maintainer-feedback? security/openssh-portable: Add option to build without OpenSSLNew2026-08-11
297078maintainer-feedback? security/openssh-portable: pre-key-exchange crashNew2026-07-30
289965maintainer-feedback? security/openssh-portable: doesn't appear to depend on ports opensslNew2026-04-26
Show all 9
PRSummaryStatusChanged
292248maintainer-feedback? security/openssh-portable: sshd-session crash on FreeBSD 15.0-RELEASE on arm64New2026-01-14
276410maintainer-feedback? security/openssh-portable: SSHFP/known_hosts issues when HPN is enabled (9.9.p1_1,1)New2025-01-15
282966maintainer-feedback? security/openssh-portable: Tiny error in sshd_config(5)New2024-11-25
272065maintainer-feedback? security/openssh-portable: Add patch for different interpretation of BADUSERNew2023-11-28

Commits (450)

Bryan Drewery (bdrewery) · 9.3.p1,1
security/openssh-portable: Update to 9.3p1.

Changes: https://www.openssh.com/txt/release-9.3
700625bcd8
Bryan Drewery (bdrewery) · 9.2.p1,1
security/openssh-portable: Upgrade to 9.2p1

Changes: https://www.openssh.com/txt/release-9.2
10491773d8
Bryan Drewery (bdrewery) · 9.1.p1,1
security/openssh-portable: Fix GSSAPI build for 9.1
c56b161c93
Bryan Drewery (bdrewery) · 9.1.p1,1
security/openssh-portable: Fix BLACKLISTD patch

Reported by:	Chad J. Milios
810702f666
Bryan Drewery (bdrewery) · 9.1.p1,1
security/openssh-portable: Update to 9.1p1

Changes: https://www.openssh.com/txt/release-9.1
162c735b34
Stefan Eßer (se) · 9.0.p1,1
Remove WWW entries moved into port Makefiles

Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.

This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.

Approved by:		portmgr (tcberner)
fb16dfecae
Stefan Eßer (se) · 9.0.p1,1
Add WWW entries to port Makefiles

It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.

Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.

There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.

This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.

There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.

The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.

Approved by:		portmgr (tcberner)
b7f05445c0
Tobias C. Berner (tcberner) · 9.0.p1,1
security: remove 'Created by' lines

A big Thank You to the original contributors of these ports:

  *  <ports@c0decafe.net>
  *  Aaron Dalton <aaron@FreeBSD.org>
  *  Adam Weinberger <adamw@FreeBSD.org>
  *  Ade Lovett <ade@FreeBSD.org>
  *  Aldis Berjoza <aldis@bsdroot.lv>
  *  Alex Dupre <ale@FreeBSD.org>
  *  Alex Kapranoff <kappa@rambler-co.ru>
  *  Alex Samorukov <samm@freebsd.org>
  *  Alexander Botero-Lowry <alex@foxybanana.com>
  *  Alexander Kriventsov <avk@vl.ru>
  *  Alexander Leidinger <netchild@FreeBSD.org>
  *  Alexander Logvinov <ports@logvinov.com>
  *  Alexander Y. Grigoryev <alexander.4mail@gmail.com>
  *  Alexey Dokuchaev <danfe@FreeBSD.org>
  *  Alfred Perlstein
  *  Alfred Perlstein <alfred@FreeBSD.org>
  *  Anders Nordby <anders@FreeBSD.org>
  *  Anders Nordby <anders@fix.no>
  *  Andreas Klemm <andreas@klemm.gtn.com>
  *  Andrew Lewis <freeghb@gmail.com>
  *  Andrew Pantyukhin <infofarmer@FreeBSD.org>
  *  Andrew St. Jean <andrew@arda.homeunix.net>
  *  Anes Mukhametov <anes@anes.su>
  *  Antoine Brodin <antoine@FreeBSD.org>
  *  Anton Berezin <tobez@FreeBSD.org>
  *  Antonio Carlos Venancio Junior (<antonio@inf.ufsc.br>)
  *  Antonio Carlos Venancio Junior <antonio@inf.ufsc.br>
  *  Ashish SHUKLA <ashish@FreeBSD.org>
  *  Attila Nagy <bra@fsn.hu>
  *  Autrijus Tang <autrijus@autrijus.org>
  *  Axel Rau <axel.rau@chaos1.de>
  *  Babak Farrokhi <farrokhi@FreeBSD.org>
  *  Ben Woods <woodsb02@FreeBSD.org>
  *  Bernard Spil <brnrd@FreeBSD.org>
  *  Bernard Spil <brnrd@freebsd.org>
  *  Blaz Zupan <blaz@si.FreeBSD.org>
  *  Bob Hockney <zeus@ix.netcom.com>
  *  Boris Kochergin <spawk@acm.poly.edu>
  *  Brendan Molloy <brendan+freebsd@bbqsrc.net>
  *  Bruce M Simpson
  *  Bruce M Simpson <bms@FreeBSD.org>
  *  Bruce M. Simpson <bms@FreeBSD.org>
  *  Carlo Strub
  *  Carlo Strub <cs@FreeBSD.org>
  *  Carlos J Puga Medina <cpm@FreeBSD.org>
  *  Carlos J Puga Medina <cpm@fbsd.es>
  *  Charlie Root <se@FreeBSD.org>
  *  Cheng-Lung Sung <clsung@FreeBSD.org>
  *  Cheng-Lung Sung <clsung@dragon2.net>
  *  Chie Taguchi <taguchi.ch@gmail.com>
  *  Chris Cowart <ccowart@rescomp.berkeley.edu>
  *  Chris D. Faulhaber <jedgar@FreeBSD.org>
  *  Christer Edwards <christer.edwards@gmail.com>
  *  Christian Lackas
  *  Christopher Hall <hsw@bitmark.com>
  *  Clement Laforet <sheepkiller@cultdeadsheep.org>
  *  Clive Lin <clive@CirX.ORG>
  *  Colin Percival
  *  Cory McIntire (loon@noncensored.com)
  *  Craig Leres <leres@FreeBSD.org>
  *  Cristiano Deana <cris@gufi.org>
  *  Cy Schubert (Cy.Schubert@uumail.gov.bc.ca)
  *  Cy Schubert <Cy.Schubert@uumail.gov.bc.ca>
  *  Cy Schubert <cy@FreeBSD.org>
  *  Damian Gerow <dgerow@afflictions.org>
  *  Damien Bobillot
  *  Dan Langille
  *  Dan Langille <dan@freebsddiary.org>
  *  Dan Langille <dvl@FreeBSD.org>
  *  Dan Langille <dvl@freebsd.org>
  *  Dan Langille <dvl@sourcefire.com>
  *  Daniel Kahn Gillmor <dkg@fifthhorseman.net>
  *  Daniel Roethlisberger <daniel@roe.ch>
  *  Danilo Egea Gondolfo <danilo@FreeBSD.org>
  *  Danton Dorati <urisso@bsd.com.br>
  *  Dave McKay <dave@mu.org>
  *  David E. Thiel <lx@FreeBSD.org>
  *  David O'Brien (obrien@NUXI.com)
  *  David O'Brien <obrien@FreeBSD.org>
  *  David Thiel <lx@redundancy.redundancy.org>
  *  Dean Hollister <dean@odyssey.apana.org.au>
  *  Denis Shaposhnikov <dsh@vlink.ru>
  *  Dereckson <dereckson@gmail.com>
  *  Dirk Froemberg <dirk@FreeBSD.org>
  *  Ditesh Shashikant Gathani <ditesh@gathani.org>
  *  Dom Mitchell <dom@happygiraffe.net>
  *  Dominic Marks <dominic.marks@btinternet.com>
  *  Don Croyle <croyle@gelemna.org>
  *  Douglas Thrift <douglas@douglasthrift.net>
  *  Edson Brandi <ebrandi@fugspbr.org>
  *  Edwin Groothuis <edwin@mavetju.org>
  *  Ekkehard 'Ekki' Gehm <gehm@physik.tu-berlin.de>
  *  Emanuel Haupt <ehaupt@FreeBSD.org>
  *  Emanuel Haupt <ehaupt@critical.ch>
  *  Eric Crist <ecrist@secure-computing.net>
  *  Erwin Lansing <erwin@FreeBSD.org>
  *  Eugene Grosbein <eugen@FreeBSD.org>
  *  Fabian Keil <fk@fabiankeil.de>
  *  Felix Palmen <felix@palmen-it.de>
  *  Florent Thoumie <flz@xbsd.org>
  *  Foxfair Hu <foxfair@FreeBSD.org>
  *  Frank Laszlo <laszlof@vonostingroup.com>
  *  Frank Wall <fw@moov.de>
  *  Franz Bettag <franz@bett.ag>
  *  Gabor Kovesdan
  *  Gabor Kovesdan <gabor@FreeBSD.org>
  *  Gabriel M. Dutra <0xdutra@gmail.com>
  *  Gary Hayers <Gary@Hayers.net>
  *  Gasol Wu <gasol.wu@gmail.com>
  *  Gea-Suan Lin <gslin@gslin.org>
  *  George Reid <greid@ukug.uk.freebsd.org>
  *  George Reid <services@nevernet.net>
  *  Greg Larkin <glarkin@FreeBSD.org>
  *  Greg V <greg@unrelenting.technology>
  *  Gregory Neil Shapiro <gshapiro@FreeBSD.org>
  *  Grzegorz Blach <gblach@FreeBSD.org>
  *  Guangyuan Yang <ygy@FreeBSD.org>
  *  Hakisho Nukama <nukama@gmail.com>
  *  Hammurabi Mendes <hmendes@brturbo.com>
  *  Henk van Oers <hvo.pm@xs4all.nl>
  *  Horia Racoviceanu <horia@racoviceanu.com>
  *  Hung-Yi Chen <gaod@hychen.org>
  *  Jaap Akkerhuis <jaap@NLnetLabs.nl>
  *  Jaap Boender <jaapb@kerguelen.org>
  *  Jacek Serwatynski <tutus@trynet.eu.org>
  *  James FitzGibbon <jfitz@FreeBSD.org>
  *  James Thomason <james@divide.org>
  *  Jan-Peter Koopmann <Jan-Peter.Koopmann@seceidos.de>
  *  Janky Jay <ek@purplehat.org>
  *  Janos Mohacsi
  *  Janos Mohacsi <janos.mohacsi@bsd.hu>
  *  Jean-Yves Lefort <jylefort@brutele.be>
  *  Jim Geovedi <jim@corebsd.or.id>
  *  Jim Ohlstein <jim@ohlste.in>
  *  Joe Clarke <marcus@marcuscom.com>
  *  Joe Marcus Clarke <marcus@FreeBSD.org>
  *  Johann Visagie <johann@egenetics.com>
  *  Johann Visagie <wjv@FreeBSD.org>
  *  John Ferrell <jdferrell3@yahoo.com>
  *  John Hixson <jhixson@gmail.com>
  *  John Polstra <jdp@polstra.com>
  *  John W. O'Brien <john@saltant.com>
  *  John-Mark Gurney <jmg@FreeBSD.org>
  *  Jose Alonso Cardenas Marquez <acardenas@bsd.org.pe>
  *  Joseph Benden <joe@thrallingpenguin.com>
  *  Joshua D. Abraham <jabra@ccs.neu.edu>
  *  Jov <amutu@amutu.com>
  *  Jui-Nan Lin <jnlin@freebsd.cs.nctu.edu.tw>
  *  Ka Ho Ng <khng300@gmail.com>
  *  Kay Lehmann <kay_lehmann@web.de>
  *  Keith J. Jones <kjones@antihackertoolkit.com>
  *  Kevin Zheng <kevinz5000@gmail.com>
  *  Kimura Fuyuki <fuyuki@hadaly.org>
  *  Kimura Fuyuki <fuyuki@mj.0038.net>
  *  Klayton Monroe <klm@uidzero.org>
  *  Konstantin Menshikov <kostjnspb@yandex.ru>
  *  Koop Mast <kwm@FreeBSD.org>
  *  Kris Kennaway <kris@FreeBSD.org>
  *  Kubilay Kocak <koobs@FreeBSD.org>
  *  Kurt Jaeger <fbsd-ports@opsec.eu>
  *  LEVAI Daniel <leva@ecentrum.hu>
  *  Lars Engels <lme@FreeBSD.org>
  *  Lars Thegler <lth@FreeBSD.org>
  *  Laurent LEVIER <llevier@argosnet.com>
  *  Luiz Eduardo R. Cordeiro
  *  Lukas Slebodnik <lukas.slebodnik@intrak.sk>
  *  Lukasz Komsta
  *  Mageirias Anastasios <anastmag@gmail.com>
  *  Marcel Prisi <marcel.prisi@virtua.ch>
  *  Marcello Coutinho
  *  Mario Sergio Fujikawa Ferreira <lioux@FreeBSD.org>
  *  Mark Felder <feld@FreeBSD.org>
  *  Mark Hannon <markhannon@optusnet.com.au>
  *  Mark Murray <markm@FreeBSD.org>
  *  Mark Pulford <mark@kyne.com.au>
  *  Marko Njezic <sf@maxempire.com>
  *  Martin Matuska <martin@tradex.sk>
  *  Martin Matuska <mm@FreeBSD.org>
  *  Martin Mersberger
  *  Martin Wilke <miwi@FreeBSD.org>
  *  Martti Kuparinen <martti.kuparinen@ericsson.com>
  *  Mateusz Piotrowski <0mp@FreeBSD.org>
  *  Matt <matt@xtaz.net>
  *  Matt Behrens <matt@zigg.com>
  *  Matthias Andree <mandree@FreeBSD.org>
  *  Matthias Fechner <mfechner@FreeBSD.org>
  *  Matthieu BOUTHORS <matthieu@labs.fr>
  *  Maxim Sobolev <sobomax@FreeBSD.org>
  *  Meno Abels <meno.abels@adviser.com>
  *  Michael Haro <mharo@FreeBSD.org>
  *  Michael Johnson <ahze@FreeBSD.org>
  *  Michael Nottebrock <lofi@FreeBSD.org>
  *  Michael Reifenberger <mr@FreeBSD.org>
  *  Michael Schout <mschout@gkg.net>
  *  Michal Bielicki <m.bielicki@llizardfs.com>
  *  Michiel van Baak <michiel@vanbaak.eu
  *  Mij <mij@bitchx.it>
  *  Mike Heffner <mheffner@vt.edu>
  *  Mikhail T. <m.tsatsenko@gmail.com>
  *  Mikhail Teterin <mi@aldan.algebra.com>
  *  Milan Obuch
  *  Mosconi <mosconi.rmg@gmail.com>
  *  Muhammad Moinur Rahman <5u623l20@gmail.com>
  *  Mustafa Arif <ma499@doc.ic.ac.uk>
  *  Neil Booth
  *  Neil Booth <kyuupichan@gmail.com>
  *  Nick Barkas <snb@threerings.net>
  *  Nicola Vitale <nivit@FreeBSD.org>
  *  Niels Heinen
  *  Nikola Kolev <koue@chaosophia.net>
  *  Nobutaka Mantani <nobutaka@FreeBSD.org>
  *  Oliver Lehmann
  *  Oliver Lehmann <oliver@FreeBSD.org>
  *  Olivier Duchateau
  *  Olivier Duchateau <duchateau.olivier@gmail.com>
  *  Olli Hauer
  *  Patrick Li <pat@databits.net>
  *  Paul Chvostek <paul@it.ca>
  *  Paul Schmehl <pauls@utdallas.edu>
  *  Pavel I Volkov <pavelivolkov@googlemail.com>
  *  Pete Fritchman <petef@databits.net>
  *  Peter Ankerstal <peter@pean.org>
  *  Peter Haight <peterh@sapros.com>
  *  Peter Johnson <johnson.peter@gmail.com>
  *  Peter Pentchev <roam@FreeBSD.org>
  *  Petr Rehor <rx@rx.cz>
  *  Philippe Audeoud <jadawin@tuxaco.net>
  *  Philippe Rocques <phil@teaser.fr>
  *  Piotr Kubaj <pkubaj@FreeBSD.org>
  *  Piotr Kubaj <pkubaj@anongoth.pl>
  *  Po-Chuan Hsieh <sunpoet@FreeBSD.org>
  *  RaRa Rasputin <rasputin@submonkey.net>
  *  Radim Kolar
  *  Ralf Meister
  *  Remington Lang <MrL0Lz@gmail.com>
  *  Renaud Chaput <renchap@cocoa-x.com>
  *  Roderick van Domburg <r.s.a.vandomburg@student.utwente.nl>
  *  Roland van Laar <roland@micite.net>
  *  Romain Tartiere <romain@blogreen.org>
  *  Roman Bogorodskiy
  *  Roman Bogorodskiy <novel@FreeBSD.org>
  *  Roman Shterenzon <roman@xpert.com>
  *  Rong-En Fan <rafan@FreeBSD.org>
  *  Ryan Steinmetz <zi@FreeBSD.org>
  *  Sahil Tandon <sahil@tandon.net>
  *  Sascha Holzleiter <sascha@root-login.org>
  *  SeaD
  *  Seamus Venasse <svenasse@polaris.ca>
  *  Sean Greven <sean.greven@gmail.com>
  *  Sebastian Schuetz <sschuetz@fhm.edu>
  *  Sergei Kolobov <sergei@FreeBSD.org>
  *  Sergei Kolobov <sergei@kolobov.com>
  *  Sergei Vyshenski
  *  Sergei Vyshenski <svysh.fbsd@gmail.com>
  *  Sergey Skvortsov <skv@protey.ru>
  *  Seth Kingsley <sethk@meowfishies.com>
  *  Shaun Amott <shaun@inerd.com>
  *  Simeon Simeonov <sgs@pichove.org>
  *  Simon Dick <simond@irrelevant.org>
  *  Sofian Brabez <sbrabez@gmail.com>
  *  Stanislav Sedov <ssedov@mbsd.msk.ru>
  *  Stefan Esser <se@FreeBSD.org>
  *  Stefan Grundmann
  *  Stefan Walter <sw@gegenunendlich.de>
  *  Stephon Chen <stephon@gmail.com>
  *  Steve Wills <steve@mouf.net>
  *  Steve Wills <swills@FreeBSD.org>
  *  Steven Kreuzer
  *  Steven Kreuzer <skreuzer@exit2shell.com>
  *  Sunpoet Po-Chuan Hsieh <sunpoet@FreeBSD.org>
  *  TAKAHASHI Kaoru <kaoru@kaisei.org>
  *  TAKATSU Tomonari <tota@FreeBSD.org>
  *  Tatsuki Makino <tatsuki_makino@hotmail.com>
  *  Thibault Payet <monwarez@mailoo.org>
  *  Thierry Thomas (<thierry@pompo.net>)
  *  Thierry Thomas <thierry@pompo.net>
  *  Thomas Hurst <tom@hur.st>
  *  Thomas Quinot <thomas@cuivre.fr.eu.org>
  *  Thomas Zander <riggs@FreeBSD.org>
  *  Thomas von Dein <freebsd@daemon.de>
  *  Tilman Linneweh <arved@FreeBSD.org>
  *  Tim Bishop <tim@bishnet.net>
  *  Tom Judge <tom@tomjudge.com>
  *  Tomoyuki Sakurai <cherry@trombik.org>
  *  Toni Viemerö <toni.viemero@iki.fi>
  *  Tony Maher
  *  Torsten Zuhlsdorff <ports@toco-domains.de>
  *  Travis Campbell <hcoyote@ghostar.org>
  *  Tsung-Han Yeh <snowfly@yuntech.edu.tw>
  *  Ulf Lilleengen
  *  Vaida Bogdan <vaida.bogdan@gmail.com>
  *  Valentin Zahariev <curly@e-card.bg>
  *  Valerio Daelli <valerio.daelli@gmail.com>
  *  Veniamin Gvozdikov <vg@FreeBSD.org>
  *  Victor Popov
  *  Victor Popov <v.a.popov@gmail.com>
  *  Vsevolod Stakhov
  *  Vsevolod Stakhov <vsevolod@FreeBSD.org>
  *  Wen Heping <wen@FreeBSD.org>
  *  Wen Heping <wenheping@gmail.com>
  *  Yarodin <yarodin@gmail.com>
  *  Yen-Ming Lee <leeym@FreeBSD.org>
  *  Yen-Ming Lee <leeym@cae.ce.ntu.edu.tw>
  *  Yen-Ming Lee <leeym@leeym.com>
  *  Ying-Chieh Liao <ijliao@FreeBSD.org>
  *  Yonatan <Yonatan@Xpert.com>
  *  Yonatan <onatan@gmail.com>
  *  Yoshisato YANAGISAWA
  *  Yuri Victorovich
  *  Yuri Victorovich <yuri@rawbw.com>
  *  Zach Thompson <hideo@lastamericanempire.com>
  *  Zane C. Bowers <vvelox@vvelox.net>
  *  Zeus Panchenko <zeus@gnu.org.ua>
  *  ache
  *  adamw
  *  ajk@iu.edu
  *  alex@FreeBSD.org
  *  allan@saddi.com
  *  alm
  *  andrej@ebert.su
  *  andrew@scoop.co.nz
  *  andy@fud.org.nz
  *  antoine@FreeBSD.org
  *  arved
  *  barner
  *  brix@FreeBSD.org
  *  buganini@gmail.com
  *  chinsan
  *  chris@still.whet.org
  *  clement
  *  clsung
  *  crow
  *  cy@FreeBSD.org
  *  dominik karczmarski <dominik@karczmarski.com>
  *  dwcjr@inethouston.net
  *  eivind
  *  erich@rrnet.com
  *  erwin@FreeBSD.org
  *  girgen@FreeBSD.org
  *  glen.j.barber@gmail.com
  *  hbo@egbok.com
  *  ijliao
  *  jesper
  *  jfitz
  *  johans
  *  joris
  *  kftseng@iyard.org
  *  kris@FreeBSD.org
  *  lx
  *  markm
  *  mharo@FreeBSD.org
  *  michaelnottebrock@gmx.net
  *  mnag@FreeBSD.org
  *  mp39590@gmail.com
  *  nbm
  *  nectar@FreeBSD.org
  *  nork@FreeBSD.org
  *  nork@cityfujisawa.ne.jp
  *  nsayer@FreeBSD.org
  *  nsayer@quack.kfu.com
  *  ntarmos@cs.uoi.gr
  *  oly
  *  onatan@gmail.com
  *  pandzilla
  *  patrick@mindstep.com
  *  pauls
  *  perl@FreeBSD.org
  *  petef@FreeBSD.org
  *  peter.thoenen@yahoo.com
  *  ports@c0decafe.net
  *  ports@rbt.ca
  *  roam@FreeBSD.org
  *  rokaz
  *  sada@FreeBSD.org
  *  scrappy
  *  se
  *  shane@freebsdhackers.net aka modsix@gmail.com
  *  snb@threerings.net
  *  sumikawa
  *  sviat
  *  teramoto@comm.eng.osaka-u.ac.jp
  *  thierry@pompo.net
  *  tobez@FreeBSD.org
  *  torstenb@FreeBSD.org
  *  trasz <trasz@pin.if.uz.zgora.pl>
  *  trevor
  *  truckman
  *  vanhu
  *  vanilla@
  *  wen@FreeBSD.org
  *  will

With hat:	portmgr
857c05f867
Bryan Drewery (bdrewery) · 9.0.p1,1
security/openssh-portable: Update to 9.0p1

Changes:        https://www.openssh.com/txt/release-9.0
PR:		264211
ca9ce6929f
Bryan Drewery (bdrewery) · 8.9.p1_4,1
security/openssh-portable: Fix some capsicum issues

- Brings in latest changes from base. See patches for details.
- Version 9.0 is being worked on but I wanted to fix this issue
  before proceeding with bigger changes.

PR:		263753
272dd07a30
Bryan Drewery (bdrewery) · 8.9.p1_3,1
security/openssh-portable: Add comment in openssh.in about host keys

Commit ae66cffc19f added some rc vars to allow disabling host keys.
The naming caused some confusion. Attempt to address that with a
comment since these are not documented anywhere else.

PR:	        202169
21cedc6ee5
Bryan Drewery (bdrewery) · 8.9.p1_2,1
security/openssh-portable: Again fix procctl(2) usage

The 8.9p1 update was supposed to have a fix for incorrect
use of procctl(2) but was left out for some reason. A wrong
assumption missed keeping it in ae66cffc19f357cbd5.

PR:          262352
a12058fae3
Bryan Drewery (bdrewery) · 8.9.p1_1,1
security/openssh-portable: Fix fetching gssapi patch

- Mirror it
- Update to latest Debian location
df3a937145
Bryan Drewery (bdrewery) · 8.9.p1_1,1
security/openssh-portable: fix docs when built without PAM support

The defaults documented in sshd_config and sshd_config.5 are incorrect
if OpenSSH was built without PAM support and can be misleading to the
user whether or not password authentication is enabled.

- Moved PAM specific changes out of patch-sshd_config and into
  extra-patch-pam-sshd_config
- sshd_config.5 PasswordAuthentication: added a new line before the note
  to make it easier to read.
- sshd_config.5 UsePAM: noted the default value depends on whether
  sshd was built with or without PAM support.

PR:		261342
418bb1fbd2
Bryan Drewery (bdrewery) · 8.9.p1,1
security/openssh-portable: Tweak new rc var names

Commit ae66cffc19f357cbd5 added new rc vars to control generating of
host keys [1].  Rename these to more closely match the base version
before it becomes widely adopted.

PR:	        202169 [1]
PR:	        209948 [FYI]
1249b096fa
Bryan Drewery (bdrewery) · 8.9.p1,1
security/openssh-portable: Update to 8.9p1

- Unbreak GSSAPI [1]
- rc.d/openssh: Allow modifying host key generation [2]

Changes: https://www.openssh.com/txt/release-8.9
PR:     	259909 [1]
PR:		202169 [2]
Submitted by:	Rick Miller [1]
Submitted by:	Chad Jacob Milios [2]
ae66cffc19
Bryan Drewery (bdrewery) · 8.8.p1_2,1
security/openssh-portable: Fix subtle rc script problem.

Invoking 'run_rc_command' taints '$rc_var' with 'keygen' which blocks further
processing for something like openssh_oomprotect.  Note that openssh_oomprotect
is broken in rc.subr until it learns to read a pidfile.
ad60ad3528
Stefan Eßer (se) · 8.8.p1_1,1
*/*: Remove redundant '-*' from CONFLICTS definitions

The conflict checks compare the patterns first against the package
names without version (as reported by "pkg query "%n"), then - if
there was no match - agsinst the full package names including the
version (as reported by "pkg query "%n-%v").

Approved by: portmgr (blanket)
04b9da4140
Bryan Drewery (bdrewery) · 8.8.p1_1,1
security/openssh-portable: libfido fix went in 505373243
02dbfbc676
Bryan Drewery (bdrewery) · 8.8.p1_1,1
security/openssh-portable: Fix sftp crash

This fixes an error trying to disabling process tracing.

It has been sent upstream.

PR:		259174
Submitted by:	mike at sentex dot net
f4a5ae5fd8
Bryan Drewery (bdrewery) · 8.8.p1,1
security/openssh-portable: Fix build without LIBEDIT

This removes a patch that is no longer needed with 8.8p1.

Reported by:	leres
8d40d32ae3
Bryan Drewery (bdrewery) · 8.8.p1,1
security/openssh-portable: Update to 8.8p1

Changelog:	https://www.openssh.com/txt/release-8.8
Security:	CVE-2021-41617
3849667982
Bryan Drewery (bdrewery) · 8.7.p1_1,1
security/openssh-portable: Fix default ssh-askpass path

Reported by:	Piotr Smyrak
fd74bc8eb2
Bernhard Froehlich (decke) · 8.7.p1,1
security/openssh-portable: Add CPE information

Approved by:	portmgr (blanket)
44052bec2c
Bryan Drewery (bdrewery) · 8.7.p1,1
security/openssh-portable: Various build fixes

- Fix build with WITH_BLACKLISTD [1]
- Fix build with WITHOUT_LIBEDIT due to upstream bug [2]

Reported by:	emaste [1]
Reported by:	Ivan Rozhuk [2]
PR:		258402 [2]
d27003d564
Bryan Drewery (bdrewery) · 8.7.p1,1
security/openssh-portable: Update to 8.7p1.

Changes: https://www.openssh.com/txt/release-8.7
a981593ecc
Bryan Drewery (bdrewery) · 8.6.p1,1
security/openssh-portable: Update to 8.6p1

- gssapi is disabled for now.

Changes:
 - https://www.openssh.com/txt/release-8.5
 - https://www.openssh.com/txt/release-8.6

Submitted by:	Yasuhiro Kimura [earlier version][1]
PR:		254389 [1]
de9fffcec8
Mathieu Arnold (mat) · 8.4.p1_4,1
all: Remove all other $FreeBSD keywords.
135fdeebb9
Mathieu Arnold (mat) · 8.4.p1_4,1
Remove # $FreeBSD$ from Makefiles.
305f148f48
Bryan Drewery (bdrewery) · 8.4.p1_4,1
Add limited patch for CVE-2021-28041 from upstream.
655d7a8ba0
Piotr Kubaj (pkubaj) · 8.4.p1_3,1
security/openssh-portable@gssapi: fix build on GCC architectures

gss-genr.c: In function 'ssh_gssapi_kex_mechs':
gss-genr.c:175:9: error: 'strncpy' specified bound depends on the length of the source argument [-Werror=stringop-overflow=]
  175 |    cp = strncpy(s, kex, strlen(kex));
      |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
abcb0e7a59
Piotr Kubaj (pkubaj) · 8.4.p1_3,1
security/openssh-portable: fix build on GCC architectures

loginrec.c:763:2: error: 'strncpy' output may be truncated copying 32 bytes from a string of length 511 [-Werror=stringop-truncation]
strncpy(utx->ut_user, li->username,
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
MIN_SIZEOF(utx->ut_user, li->username));
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
loginrec.c: In function 'record_failed_login':
loginrec.c:1687:2: error: 'strncpy' specified bound 32 equals destination size [-Werror=stringop-truncation]
strncpy(ut.ut_user, username, sizeof(ut.ut_user));
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
loginrec.c:1696:2: error: 'strncpy' specified bound 256 equals destination size [-Werror=stringop-truncation]
strncpy(ut.ut_host, hostname, sizeof(ut.ut_host));
ccdc8ee045
Bryan Drewery (bdrewery) · 8.4.p1_3,1
- Fix KERB_GSSAPI build; missing prototypes for DH openssl-compat.

PR:		212151 (maybe)
7562494439
Bryan Drewery (bdrewery) · 8.4.p1_2,1
- Add pkg-config dependency which avoids some maintainer testing errors   and also removes a few unneeded library links such as -lcurses. - libfido2 package is broken with pkg-config and base ssl. Workaround this   by not using pkg-config for that library for now. - Add USES=localbase to simplify some options - Make crypt(3) MD5 password support optional but still on-by-default.  The   default in
4bc67aef47
Bryan Drewery (bdrewery) · 8.4.p1_1,1
- Add blacklistd(8) support.   This differs slightly from base as it uses the current NetBSD   hook points.   This is off-by-default as it needs testing and has issues that may cause   crashes.  One such issue is the use of private bl_create() symbol from   libblacklist.  It is also unclear if the hook points are sufficient   or proper after the libssh refactoring in 8.x.

PR:		223628 (patch rewritten as it no longer applied)
4cff3f057d
Bryan Drewery (bdrewery) · 8.4.p1_1,1
- Add and enable FIDO/U2F support for security keys by default.   This feature came in 8.2, is enabled by default on OpenBSD,   and suggested to be enabled by default for packages.
7a31807051
Bryan Drewery (bdrewery) · 8.4.p1,1
- Slightly reduce diff with base - No functional changes.

PR:		223010
Submitted by:	brnrd (earlier patch)
c1eea6f3b3
Bryan Drewery (bdrewery) · 8.4.p1,1
- bindresvport support hasn't been used since 7.8
f1a66569e8
Bryan Drewery (bdrewery) · 8.4.p1,1
- Remove sctp patch missed in r466577
121e399cae
Bryan Drewery (bdrewery) · 8.4.p1,1
- Update to 8.4p1 (skipped 8.3)

- https://www.openssh.com/txt/release-8.3
 - https://www.openssh.com/txt/release-8.4

PR:		239807, 250319
Sponsored by:	Dell EMC
b773b7cade
Mateusz Piotrowski (0mp) · 8.2.p1_2,1
security/openssh-portable: Set LICENSE

In the past, the ports framework did not support handling situations
where a port contained a multitude of licenses. In case of OpenSSH
the list is/was: BSD2, BSD3, MIT, public domain, BSD-Style, BEER-WARE,
"any purpose with notice intact", and ISC-Style.

Instead of having to keep track of all the involved licenses which all
are very similar, let's use LICENSE_PERMS.

I am not bumping PORTREVISION as it is not a vital change from the
perspective of package users.

Approved by:	bdrewery (maintainer)
Differential Revision:	https://reviews.freebsd.org/D27133
72f28ff3aa
Mateusz Piotrowski (0mp) · 8.2.p1_2,1
Install the moduli file as a @sample

PR:		250559
Submitted by:	Michał "rysiek" Woźniak <rysiek % isnic.is>
Approved by:	maintainer timeout
a031e3218e
Mateusz Piotrowski (0mp) · 8.2.p1_1,1
Fix a typo

Approved by:	portmgr blanket
feec3d68bf
Sunpoet Po-Chuan Hsieh (sunpoet) · 8.2.p1_1,1
Update WWW

Approved by:	portmgr (blanket)
836e80987a
Bryan Drewery (bdrewery) · 8.2.p1_1,1
- Simplify and refactor login.conf environment handling.
b3f7e10993
Bryan Drewery (bdrewery) · 8.2.p1,1
Fix build without PAM option
f5f81bcbb6
Bryan Drewery (bdrewery) · 8.2.p1,1
Remove long broken X509 patch.

Approved by:	portmgr (implicit)
a7eb97a6a3
Bryan Drewery (bdrewery) · 8.2.p1,1
Fix plist for 8.2p1
c5cc3212e8
Bryan Drewery (bdrewery) · 8.2.p1,1
- Update to 8.2p1

Release notes: https://www.openssh.com/txt/release-8.2
115e2b360f
Bryan Drewery (bdrewery) · 8.1.p1,1
Update to 8.1p1

Changes: https://www.openssh.com/txt/release-8.1

Sponsored by:	Dell EMC
e7d48eba9d