GSS-API support split out from main Debian OpenSSH packages

diff --git a/content/openssh-gssapi-split.md b/content/openssh-gssapi-split.md
new file mode 100644 (file)
index 0000000..80a11d0
--- /dev/null
+++ b/content/openssh-gssapi-split.md
@@ -0,0 +1,11 @@
+Title: GSS-API support split out from main Debian OpenSSH packages
+Slug: openssh-gssapi-split
+Date: 2026-08-23 18:16:11 +01:00
+Tags: openssh, planet-debian
+Mastodon-ID: 117145954629826387
+
+In an [option review](https://lists.debian.org/debian-devel/2024/04/msg00044.html) I did in 2024, shortly after the [xz-utils backdoor](https://en.wikipedia.org/wiki/XZ_Utils_backdoor), I explained that having GSS-API authentication and key exchange support in the main OpenSSH packages is problematic.  The key exchange patch is large and intrusive.  Furthermore, even linking to the necessary libraries is not without risk: as the [Ebury malware attack](https://attack.mitre.org/software/S0377/) demonstrated way back in 2009, each extra library linked into security-critical daemons such as `sshd` (or nowadays into its privilege-separated helper programs) can modify the behaviour of the daemon even if you aren't doing anything that would involve calling into that library.  Of course some of that risk remains, but as [Damien Miller wrote](https://lists.debian.org/debian-devel/2024/04/msg00045.html), minimizing the number of libraries that end up in the address space of `sshd` and friends is still valuable.
+
+I just uploaded openssh 1:10.4p1-5 to unstable, completing this split.  As of this version, the OpenSSH client and server are built without GSS-API authentication and key exchange support.  If you need those features, install `openssh-client-gssapi` or `openssh-server-gssapi` instead, as appropriate.  Debian 13 (trixie) already has packages with those names that just depend on the regular `openssh-client` and `openssh-server` so that you can pre-emptively install them, as [documented in the release notes](https://www.debian.org/releases/trixie/release-notes/issues.en.html#deprecated-components-for-releasename).
+
+The new `openssh-*-gssapi` packages have relatively tight dependencies on `openssh-common`, in order for the testing migration system to ensure that we can't forget to keep them up to date.  This will mean a bit more ongoing work for me on each new upstream version, but I think it will be manageable.

diff --git a/posted_on_Mastodon.txt b/posted_on_Mastodon.txt
index d3ade8ff01713d324533f8ca3e73abd8ab05c4be..edf492a5c089de73c928b743157778498f52ce23 100644 (file)
--- a/posted_on_Mastodon.txt
+++ b/posted_on_Mastodon.txt
@@ -77,6 +77,7 @@ ntp-synchronisation-problems.html
 odd-test-failure.html
 openssh-5.5p1-for-lucid.html
 openssh-6.0p1.html
+openssh-gssapi-split.html
 openssh-iutf8.html
 openuk-new-years-honours.html
 parted-2.2-transition.html