SSH Release Notes

Ssh 3.1

Fixed Bugs and Malfunctions

Make sure the clean rule for ssh, ssl, eunit and otp_mibs actually removes generated files.

Own Id: OTP-12200

Improved Property Tests (Thanks to Thomas, John and Tobias at QuviQ)

Own Id: OTP-12256

Correct typo of renegotiate that could cause rekeying to fail

Own Id: OTP-12277 Aux Id: seq12736

The {timeout, Timeout} option passed to ssh_sftp:start_channel was not applied to the early phases of the SSH protocol. This patch passes the Timeout through to ssh:connect. In case the timeout occurs during these phases, {error, timeout} is returned. (Thanks to Simon Cornish)

Own Id: OTP-12306

Improvements and New Features

Added API functions ptty_alloc/3 and ptty_alloc/4, to allocate a pseudo tty.

Own Id: OTP-11542 Aux Id: seq12493, OTP-11631

Supports tar file creation on other media than file systems mounted on the local machine.

The erl_tar api is extended with erl_tar:init/3 that enables usage of user provided media storage routines. A ssh-specific set of such routines is hidden in the new function ssh_sftp:open_tar/3 to simplify creating a tar archive on a remote ssh server.

A chunked file reading option is added to erl_tar:add/3,4 to save memory on e.g small embedded systems. The size of the slices read from a file in that case can be specified.

Own Id: OTP-12180 Aux Id: seq12715

Always send SSH_DISCONNECT protocol messages when peer sends corrupt messages.

Own Id: OTP-12185

Hooks for funs that can change binaries sent to remote sites from erl_tar for renote tar file creation are added. See ssh_sftp:open_tar/3,4 for details. The hooks could also be used to read remote tar files that need transformation before file extraction.

Those hooks are intended for encryption and decryption of tar files. Effort is put into memory, disk and network resource economy.

Own Id: OTP-12312 Aux Id: OTP-12180

Ssh 3.0.6

Fixed Bugs and Malfunctions

Gracefully handle bad data from the client when expecting ssh version exchange.

Own Id: OTP-12157 Aux Id: seq12706

When restarting an ssh daemon, that was stopped with ssh:stop_listner/ [1,2] new options given shall replace old ones.

Own Id: OTP-12168 Aux Id: seq12711

Improvements and New Features

ssh now has a format_status function to avoid printing sensitive information in error loggs.

Own Id: OTP-12030

Known Bugs and Problems

The option parallel_login didn't work with the value true. All logins were serial.

Own Id: OTP-12194

Ssh 3.0.5

Fixed Bugs and Malfunctions

When starting an ssh-daemon giving the option {parallel_login, true}, the timeout for authentication negotiation ({negotiation_timeout, integer()}) was never removed.

This caused the session to always be terminated after the timeout if parallel_login was set.

Own Id: OTP-12057 Aux Id: seq12663

Improvements and New Features

Warning: this is experimental and may disappear or change without previous warning.

Experimental support for running Quickcheck and PropEr tests from common_test suites is added to common_test. See the reference manual for the new module ct_property_testing.

Experimental property tests are added under lib/{inet,ssh}/test/property_test. They can be run directly or from the commont_test suites inet/ftp_property_test_SUITE.erl and ssh/test/ssh_property_test_SUITE.erl.

See the code in the test directories and the man page for details.

(Thanks to Tuncer Ayaz for a patch adding Triq)

Own Id: OTP-12119

Ssh 3.0.3

Fixed Bugs and Malfunctions

Removed mail address from error reports and corrected spelling error (Stacktace -> stacktrace)

Own Id: OTP-11883 Aux Id: seq12586

Decode/encode fixes in SSH_MSG_IGNORE and SSH_MSG_UNIMPLEMENTED.

Own Id: OTP-11983

Improvements and New Features

Accepts that some older OpenSSH clients sends incorrect disconnect messages.

Own Id: OTP-11972

Handle inet and inet6 option correctly

Own Id: OTP-11976

Ssh 3.0.1

Fixed Bugs and Malfunctions

Fixes the problem that ssh_cli in some cases could delay the prompt if a tty was not requested by the client.

Own Id: OTP-10732

The variable NewCol is now correctly calculated allowing for tab-completion of function calls even when preceded with blank space (Thanks to Alexander Demidenko)

Own Id: OTP-11566

Fix incorrect dialyzer spec and types, also enhance documentation.

Thanks to Ayaz Tuncer.

Own Id: OTP-11627

Fixed a bug when ssh:exec executes a linux command on a linux ssh daemon. If the result is sent back from standard error, the length information was not stripped off correctly.

Own Id: OTP-11667

Fixed a bug with the ssh file 'known_hosts' which made the file grow with many equal entries.

Own Id: OTP-11671

Some local implementations of removing the last element from a list are replaced by lists:droplast/1. Note that this requires at least stdlib-2.0, which is the stdlib version delivered in OTP 17.0. (Thanks to Hans Svensson)

Own Id: OTP-11678

Bug fix for ssh:daemon/2,3 so that the failfun is called when it should.

Own Id: OTP-11680

Fixed bug which crashed ssh when SSH_MSG_KEX_DH_GEX_GROUP is received. This could cause a vm-crash for eheap_alloc during garbage collect.

Own Id: OTP-11696 Aux Id: 12547, 12532

Fixes a bug that breaks keyboard-interactive authentication. Thanks to Simon Cornish for reporting and suggesting a fix.

Own Id: OTP-11698

dialyzer specs are now correct for ssh:start/0, ssh:start/1, ssh:stop/0 and ssh_connection_handler:open_channel/5. (Thanks to Johannes Weißl )

Own Id: OTP-11705

Application upgrade (appup) files are corrected for the following applications:

asn1, common_test, compiler, crypto, debugger, dialyzer, edoc, eldap, erl_docgen, et, eunit, gs, hipe, inets, observer, odbc, os_mon, otp_mibs, parsetools, percept, public_key, reltool, runtime_tools, ssh, syntax_tools, test_server, tools, typer, webtool, wx, xmerl

A new test utility for testing appup files is added to test_server. This is now used by most applications in OTP.

(Thanks to Tobias Schlager)

Own Id: OTP-11744

Fixed dialyzer warning for ssh_connection:send.

Own Id: OTP-11821

ssh:daemon/2,3 : Added options negotiation_timeout and parallel_login to tune the authentication behaviour.

Own Id: OTP-11823

Improvements and New Features

Ssh now fully supports unicode filenames, filecontents, shell and cli. Please note that the underlying os and emulator must also give support for unicode. You may want to start the emulator with "erl +fnu" on Linux.

Own Id: OTP-10953

Ssh 3.0

Fixed Bugs and Malfunctions

The ssh cli is now faster at close and before new prompt.

Own Id: OTP-11339 Aux Id: seq12423

Ssh process structure was redesigned to better map to what is truly parallel this has solved a lot of strange timing issues that sometimes would occur, for instance a process leak could happen when a lot of connections where taken up and down in parallel in a short period of time. Also backwards compatible clauses to "original" but never supported features has been removed.

Impact: Increases flow efficiency

*** POTENTIAL INCOMPATIBILITY ***

Own Id: OTP-11363

Fix various typos in erts, kernel and ssh. Thanks to Martin Hässler.

Own Id: OTP-11414

Correct private_key type documentation in ssh_server_key_api. Thanks to Tristan Sloughter.

Own Id: OTP-11449

The functions in ssh_no_io.erl did not mimic the functions in ssh_io.erl correctly, the arity was incorrect for some functions which caused ssh to fail in the wrong way.

Own Id: OTP-11490

Improvements and New Features

Add option to disallow CLI

Own Id: OTP-10976

Add sockname and user to ssh:connection_info/2

Own Id: OTP-11296

Ssh 2.1.7

Fixed Bugs and Malfunctions

ssh:daemon will get feeded with an argument even if it is not a valid expression.

Own Id: OTP-10975

Improvements and New Features

Properly ignore everything in lib/ssh/doc/html/. Thanks to Anthony Ramine.

Own Id: OTP-10983

Integrate elliptic curve contribution from Andreas Schultz

In order to be able to support elliptic curve cipher suites in SSL/TLS, additions to handle elliptic curve infrastructure has been added to public_key and crypto.

This also has resulted in a rewrite of the crypto API to gain consistency and remove unnecessary overhead. All OTP applications using crypto has been updated to use the new API.

Impact: Elliptic curve cryptography (ECC) offers equivalent security with smaller key sizes than other public key algorithms. Smaller key sizes result in savings for power, memory, bandwidth, and computational cost that make ECC especially attractive for constrained environments.

Own Id: OTP-11009

Ssh 2.1.3

Fixed Bugs and Malfunctions

It is now possible to send an empty binary using ssh_connection:send/3, this corner case previously caused ssh_connection:send to hang.

Own Id: OTP-9478 Aux Id: kunagi-226 [137]

Fix typo in keyboard-interactive string. Thanks to Daniel Goertzen

Own Id: OTP-10456

ssh_connectino:send/3 will not return until all data has been sent. Previously it could return too early, resulting in things such premature close of the connection. Also improved error handling of closed SSH channels.

Own Id: OTP-10467

Fixed ssh_cli.erl crashes because #state.buf is yet 'undefined'.

Fixed Client terminateing connections due to channel_request message response is sent to the wrong id.

Affected SSH clients: - all clients based on SSH-2.0-TrileadSSH2Java_213 (problem #1) - SSH Term Pro (problem #2)

Thanks to Stefan Zegenhagen

Own Id: OTP-10475

Fixed various syntax errors in SSH appup file

Own Id: OTP-10657

Improvements and New Features

SSH_FX_FILE_IS_A_DIRECTORY message for sftp implemented

Own Id: OTP-6406 Aux Id: kunagi-218 [129]

SSH Rekeying fixed

Own Id: OTP-7785 Aux Id: kunagi-220 [131]

Added User Guide for the SSH application

Own Id: OTP-7786 Aux Id: kunagi-221 [132]

Documentation regarding failfun, connectfun and disconnectfun provided

Own Id: OTP-7792 Aux Id: kunagi-222 [133]

SSH connection timer implementation

New option, {idle_time, integer()}, sets a timeout on connection when no channels are active, defaults to infinity

Own Id: OTP-10514 Aux Id: seq12020

Some examples overflowing the width of PDF pages have been corrected.

Own Id: OTP-10665

Fixed internal error on when client and server can not agree o which authmethod to use.

Own Id: OTP-10731 Aux Id: seq12237

Ssh 2.1.2

Fixed Bugs and Malfunctions

SSH quiet mode

A new option to ssh:connect/3,4, quiet_mode. If true, the client will not print out anything on authorization.

Own Id: OTP-10429 Aux Id: kunagi-273 [184]

Restrict which key algorithms to use

A new option to ssh:connect/3,4 is introduced, public_key_algs, where you can restrict which key algorithms to use and in which order to try them.

Own Id: OTP-10498 Aux Id: kunagi-289 [200]

Confidentiality of client password

Unsets clients password after authentication.

Own Id: OTP-10511 Aux Id: kunagi-292 [203]

Fixed user interaction for SSH

It's now available to accept hosts and input password

Own Id: OTP-10513 Aux Id: kunagi-293 [204]

Ssh 2.1.1

Fixed Bugs and Malfunctions

Ssh now only sends one channel close message under all circumstances, before it would sometimes incorrectly send two.

Own Id: OTP-10060

The options check mistreated the ip_v6_disable-option, and did not handle some, at the moment, undocumented options correctly.

Own Id: OTP-10061

The channel id in a channel failure message, sent to the peer, is now in all cases the remote channel id

Own Id: OTP-10062

Improved handling of multiple closes to avoid occasional crashes when a channel is closed more than once.

Own Id: OTP-10112

Fix lib/src/test/ssh_basic_SUITE.erl to fix IPv6 option typos

Fixed incorrect option "ipv6_disable" to "ipv6_disabled" as documented in the ssh manual.

Own Id: OTP-10219

SSH: Make "auth_methods" server option re-usable

The 'auth_methods' option is used by the server side of the SSH code to tell a connecting SSH client about the authentication methods that are supported by the server. The code still extracts and handles the 'auth_methods' option from Opts in appropriate places, but the Opts checking code in ssh.erl didn't allow that option to be specified.

Own Id: OTP-10224

Use the correct channel id when adjusting the channel window

Own Id: OTP-10232

Ssh 2.1

Fixed Bugs and Malfunctions

All keys in authorized_keys are considerd, wrongly only the first one was before.

Own Id: OTP-7235

ssh daemon now properly handles ras host keys, in previous versions only dsa host keys sufficed to set up a connection.

Own Id: OTP-7677

ssh:shell/3 and ssh:connect/3 does not hang anymore if connection negotiation fails

Own Id: OTP-8111

Improve check so that we will not try to read ssh packet length indicator if not sure we have enough data.

Own Id: OTP-8380

Do not try to use user interaction when it is disabled.

Own Id: OTP-9466 Aux Id: seq11886

Improved error handling of internal errors i the ssh connection handling process

Own Id: OTP-9905

sftp daemon generates file handles correct

Own Id: OTP-9948

Improvements and New Features

Document supported algorithms

Own Id: OTP-8109

Graceful handling of premature close from an sftp client.

Own Id: OTP-9391 Aux Id: seq11838

Changed ssh implementation to use the public_key application for all public key handling. This is also a first step for enabling a callback API for supplying public keys and handling keys protected with password phrases.

Additionally the test suites where improved so that they do not copy the users keys to test server directories as this is a security liability. Also ipv6 and file access issues found in the process has been fixed.

This change also solves OTP-7677 and OTP-7235

This changes also involves some updates to public_keys ssh-functions.

Own Id: OTP-9911

Added options for the ssh client to support user keys files that are password protected.

Own Id: OTP-10036 Aux Id: OTP-6400, Seq10595

Ssh 2.0.4

Fixed Bugs and Malfunctions

In some cases SSH returned {error, normal} when a channel was terminated unexpectedly. This has now been changed to {error, channel_closed}.

*** POTENTIAL INCOMPATIBILITY ***

Own Id: OTP-8987 Aux Id: seq11748

SSH did not handle the error reason enetunreach when trying to open a IPv6 connection.

Own Id: OTP-9031

Improvements and New Features

It is now possible to use SSH to sign and verify binary data.

Own Id: OTP-8986

SSH now ensures that the .ssh directory exists before trying to access files located in that directory.

Own Id: OTP-9010

Ssh 2.0

Fixed Bugs and Malfunctions

The function ssh:connect/4 was not exported.

Own Id: OTP-8550 Aux Id:

Aligned error message with used version (SSH_FX_FAILURE vs SSH_FX_NOT_A_DIRECTORY, the latter introduced in version 6).

*** POTENTIAL INCOMPATIBILITY ***

Own Id: OTP-8644 Aux Id: seq11574

Resolved race condition when another connection is started before a channel is opened in the first connection.

Own Id: OTP-8645 Aux Id: seq11577

Improvements and New Features

The configuration parameter ip_v6_disabled is now available, which makes it possible for the user to alter the IP version SSH shall use.

*** POTENTIAL INCOMPATIBILITY ***

Own Id: OTP-8535 Aux Id:

The ssh_connection:send operation now accepts infinity as timeout.

Own Id: OTP-8534 Aux Id:

The connection handler now include stack traces when a channel message is not handled correctly.

Own Id: OTP-8524 Aux Id:

Removed deprecated modules (ssh_ssh, ssh_sshd and ssh_cm) and functions (ssh_sftp:connect and ssh_sftp:stop).

*** POTENTIAL INCOMPATIBILITY ***

Own Id: OTP-8596 Aux Id:

Ssh 1.1.7

Fixed Bugs and Malfunctions

Now clear all processes when a connnection is terminated.

Own Id: OTP-8121 Aux Id:

In some rare cases the connection handler could enter an infinite loop.

Own Id: OTP-8277 Aux Id: seq11428

If an SFTP server did not respond with EOF, the function ssh_sftp:list_dir/2/3 would enter an infinite loop.

Own Id: OTP-8278 Aux Id: seq11450

Improvements and New Features

The documentation is now built with open source tools (xsltproc and fop) that exists on most platforms. One visible change is that the frames are removed.

Own Id: OTP-8201 Aux Id:

Ssh 1.1.6

Fixed Bugs and Malfunctions

ssh_sftp:start_channel did not handle all possible return values from ssh_channel:start correctly.

Own Id: OTP-8176 Aux Id:

SFTPD did not handle rename command (version 4) correctly.

Own Id: OTP-8175 Aux Id: seq11373

If a connection manager already had been terminated it could cause a channel to generate a crash report when it was about to stop.

Own Id: OTP-8174 Aux Id: seq11377

Requests could result in badarg or badmatch EXIT messages in the connection manager if the channel no longer existed.

Own Id: OTP-8173 Aux Id: seq11379

ssh_transport:unpack/3 could cause a badarg error.

Own Id: OTP-8162 Aux Id:

Improvements and New Features

The encryption algorithm aes128-cbc is now supported. Requires that crypto-1.6.1 is available.

Own Id: OTP-8110 Aux Id:

Ssh 1.1.2

Fixed Bugs and Malfunctions

Ssh confused local and remote channel id's, which in some cases resulted in that messages were discarded.

Own Id: OTP-7914 Aux Id: seq11234

Ssh could not handle echo values other than 0 and 1.

Own Id: OTP-7917 Aux Id: seq11238

A crash occurred if a non-valid channel reference was received.

Own Id: OTP-7918 Aux Id: seq11238

Sftpd connections was not closed after receiving eof from a client.

Own Id: OTP-7921 Aux Id: seq11222

It was not possible to start a SFTP subsystem on certain platforms, i.e. those who do not support symbolic links.

Own Id: OTP-7930 Aux Id:

In some cases the message {ssh_cm, ssh_connection_ref(), {closed, ssh_channel_id()}} was not passed to the registered callback module.

Own Id: OTP-7957 Aux Id:

Improvements and New Features

By using the sftpd option {max_files, Integer}, the message size for READDIR commands can be reduced.

Own Id: OTP-7919 Aux Id: seq11230

Ssh 1.1.1

Fixed Bugs and Malfunctions

The erlang ssh server has presented itself incorrectly, using the special version ssh-1.99, although it never has supported versions below 2.0. Since ssh-1.1 client versions below 2.0 are correctly rejected instead of letting the server crash later on. Alas the problem with the presentation string was not discovered until after ssh.1.1 was released. Now the server will present itself as ssh-2.0.

Own Id: OTP-7795

An internal function call used an incorrect parameter, which caused problem when the old listen API was used. This was introduced in Ssh-1.1.

Own Id: OTP-7920 Aux Id: seq11211

Improvements and New Features

Ssh timeouts will now behave as expected i.e. defaults to infinity only the user of the ssh application can know of a reasonable timeout value for their application.

*** POTENTIAL INCOMPATIBILITY ***

Own Id: OTP-7807

The implementation of timeouts added as a patch in ssh-1.0.1 was slightly changed and is now documented.

Own Id: OTP-7808

To honor the multiplexing of channels over one ssh connection concept ssh_sftp:connect/ [1,2,3] is deprecated and replaced by ssh_sftp:start_channel/[1,2,3] and ssh_sftp:stop/1 is deprecated and replaced by ssh_sftp:stop_channel/1 and to stop the ssh connection ssh:close/ 1 should be called.

Own Id: OTP-7809

Added the message {ssh_channel_up, ChannelId, ConnectionManager} that shall be handled by the channel callback handle_msg/2. This makes the function handle_msg/2 a mandatory function for ssh channels implementations which it was not in ssh-1.1.

*** POTENTIAL INCOMPATIBILITY ***

Own Id: OTP-7828

Ssh 1.1

Fixed Bugs and Malfunctions

A flaw in the implementation of the supervision tree caused the ssh daemon to close the connections to all currently logged in users if one user logged out. Another problem related to the supervision tree caused the closing down of clients to leak processes i.e. all processes was not shutdown correctly.

Own Id: OTP-7676

Tabs could cause ssh_cli to print things in a surprising way.

Own Id: OTP-7683 Aux Id: seq11102

[sftp, sftpd] - Added patch to make sftp timestamps more correct, in the long run it would be nice to have better support in file to be able to make it always behave correctly now it will be correct 99 % of time instead of almost never correct, at least on unix-based platforms.

Own Id: OTP-7685 Aux Id: seq11082

[sftpd] - Added patch to further improve handling of symbolic links in the sftp-server.

Own Id: OTP-7766 Aux Id: seq11101

Ssh incorrectly sent the local id instead of the remote id of a channel to the peer. For simpler cases these ids often happen to have the same value. One case when they do not is when the client sends an exec command two times in a raw on the same ssh connection (different channels of course as the channel will be closed when the exec command has been evaluated) .

Own Id: OTP-7767

Packet data could be lost under high load due to the fact that buffered data was sometimes wrongly discarded before it had been sent.

Own Id: OTP-7768

Improved ipv6-handling as some assumptions about inet functions where incorrect.

Own Id: OTP-7770

Improvements and New Features

Added new API function ssh:connection_info/2.

Own Id: OTP-7456

Now starts ssh channel processes later avoiding synchronization problems between processes.

Own Id: OTP-7516

Ssh now rejects old versions of the ssh protocol for security reasons. (Even if they where not correctly rejected before the connection would probably have failed anyway due to other reasons.)

Own Id: OTP-7645 Aux Id: seq11094

New API module ssh_channel has been added. This is a behaviour to facilitate the implementation of ssh clients and plug in subsystems to the ssh daemon. Note that this slightly changes the options to the API function ssh:daemon/[1,2,3] deprecating all no longer documented options. Note that the new API enforces the "logical way" of using the old API i.e. making the subsystem process part of the ssh applications supervisor tree, so missuses of the old API are not compatible with the new API.

*** POTENTIAL INCOMPATIBILITY ***

Own Id: OTP-7769

Known Bugs and Problems

Public keys protected by a password are currently not handled by the erlang ssh application.

Own Id: OTP-6400 Aux Id: 10595

Ssh 1.0.1

Fixed Bugs and Malfunctions

[sftp] - When listing a directory with more than 100 files only the first 100 where listed. This has now been fixed.

Own Id: OTP-7318 Aux Id: seq10953

When restarting an ssh-system the expected return value from ssh_system_sup:restart_acceptor/2 was incorrect, this is no longer the case.

Own Id: OTP-7564 Aux Id: seq11055

A few minor bugs where fixed in ssh_userreg.erl and ssh_connection_manager and a a ssh_cli option was added to restore backwards compatibility with the old ssh_cm - API.

Own Id: OTP-7565

Fixed bug in ipv6 support and added option to disable ipv6 as a workaround for badly configured computers.

Own Id: OTP-7566

Improvements and New Features

[sftp] - Option added to set timeout value in sftp.

Own Id: OTP-7305 Aux Id: seq10945

Ssh 1.0

Fixed Bugs and Malfunctions

Removed some special handling of prompts that made ssh behave differently than openssh.

Own Id: OTP-7485 Aux Id: seq11025

Bug in encoding of pty opts has been fixed.

Own Id: OTP-7504

Improvements and New Features

The architecture of the ssh processes has been reconstructed to fit in a supervision tree as to become a real OTP application and benefit from this when starting and stopping.

Own Id: OTP-7356 Aux Id: seq10899

Support for pty option echo off added. Requires kernel from R12B-4.

*** POTENTIAL INCOMPATIBILITY ***

Own Id: OTP-7502 Aux Id: seq10959

The ssh API has been enhanced a lot of old API functions has become deprecated.

Own Id: OTP-7503