[{"data":1,"prerenderedAt":258},["ShallowReactive",2],{"seo-verification":3,"blog-openssh-10-6-security-update-sshd-en":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"key":7,"data":8},"blog-openssh-10-6-security-update-sshd-en",{"id":9,"slug":10,"slugs":11,"title":15,"excerpt":16,"readTime":17,"views":18,"isPinned":19,"publishedAt":20,"updatedAt":21,"category":22,"categories":28,"featuredImage":30,"bgImage":31,"posterImage":32,"relatedSolution":30,"intro":33,"sections":34,"ctaTitle":203,"ctaBody":204,"ctaButton":205,"ctaUrl":206,"relatedPosts":207},494,"openssh-10-6-security-update-sshd",{"fr":12,"en":10,"ar":13,"es":14},"openssh-10-6-mise-a-jour-securite-sshd","تحديث-openssh-10-6-أمان-sshd","openssh-10-6-actualizacion-seguridad-sshd","OpenSSH 10.6: update sshd without losing access","OpenSSH 10.6 security update: check the version actually running, what may break (ProxyCommand, Compression) and reload sshd safely.",12,0,false,"2026-10-22T00:00:00+00:00","2026-10-23T13:27:02+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},8,"Security & Monitoring","securite-monitoring","bg-rose-500\u002F10 text-rose-400","security",[29],{"id":23,"name":24,"slug":25,"color":26,"icon":27},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fopenssh-10-6-mise-a-jour-securite-sshd-poster.svg","OpenSSH 10.6 brings eight security fixes without naming a single one with a CVE, and your distribution most likely shows a completely different version number. For an agency that manages dozens of client servers, the question is not \"should we move to 10.6?\" but \"do my servers carry these fixes, and what will applying them break?\". This guide shows how to read the version that is actually running, spot the two changes that affect your scripts, and reload `sshd` without losing access to a single server.",[35,39,51,54,90,112,115,154,157,184,188,191,200],{"type":36,"title":37,"body":38},"h2","What OpenSSH 10.6 publishes, and what it does not say","OpenSSH 10.6, and its portable release 10.6p1 used by Linux distributions, was released on October 6, 2026. The release notes announce \"a number of security fixes\", several new features and some small bugfixes. They list no CVE identifier and mention no exploitation in the wild: this guide sticks strictly to what they say.\n\nThe OpenSSH team adds a remark that matters to anyone running a fleet. It receives a large number of reports produced with AI tools, has seen several bugs discovered independently by different researchers, and concludes that attackers can find them too. It therefore announces more frequent releases, to ship fixes sooner instead of batching them.\n\nFor an agency, the consequence is concrete: updating OpenSSH is no longer a yearly event. You need a procedure that repeats safely, server after server, and that tells you each time what actually changed.",{"type":40,"title":41,"items":42},"ul","The security fixes in 10.6, as listed",[43,44,45,46,47,48,49,50],"**sftp** — the client validates paths returned by the server more strictly, so a server cannot make a recursive copy write outside its target directory.","**GSSAPI** — `sshd` only stores GSSAPI credentials after a successful authentication, and resets GSSAPI state before each attempt.","**Compression** — the LZ77 dictionary coder is disabled to close a side channel: text injected into one channel could help guess secrets flowing through another channel of the same session.","**Usernames** — `ssh` refuses the `$` and `\\` characters in a username entered on the command line, to prevent shell injection through `ProxyCommand` or `Match exec`.","**Certificates** — `ssh-keygen` now handles Daylight Saving Time correctly when converting dates; the error could shift a certificate's expiry by one hour.","**Compressed packets** — a compressed payload can no longer inflate past the maximum packet length.","**authorized_keys** — the `restrict` keyword now also applies to tunnel forwarding (`PermitTunnel`, disabled by default).","**none values** — some options that accept `none`, including `AuthorizedPrincipalsFile`, were read as a file name when a `Match` block overrode them.",{"type":36,"title":52,"body":53},"The version number does not tell you if you are patched","The objection comes fast: no CVE in the notes, no stable distribution ships 10.6, and a failed `sshd` restart can lock you out. Why deal with it now?\n\nBecause distributions do not follow upstream numbers. They keep the OpenSSH version they released with and backport fixes into it. Ubuntu did exactly that: the security packages published on October 14, 2026 for releases 22.04, 24.04 and 26.04 carry the eight fixes listed above, including the refusal of `$` and `\\`, while staying on 8.9p1, 9.6p1 and 10.2p1. Conversely, as of October 22, 2026, the Debian security tracker still marks the same issues as unfixed on Debian 12 and Debian 13, with no security advisory published; only the development branches forky and sid ship 10.6p1.\n\nAn up-to-date Ubuntu server on 9.6p1 is therefore better covered, on these specific points, than a Debian server on 10.0p1. What you check is the installed package and its changelog. The check-and-reload procedure, for its part, will be the same for every future update.",{"type":55,"title":56,"headers":57,"rows":61},"comparison","What distributions ship as of October 22, 2026",[58,59,60],"Distribution","OpenSSH package","10.6 fixes",[62,66,69,73,77,80,83,87],[63,64,65],"Debian 12 (bookworm)","1:9.2p1-2+deb12u10","Not backported according to the Debian tracker",[67,68,65],"Debian 13 (trixie)","1:10.0p1-7+deb13u4",[70,71,72],"Debian forky and sid","1:10.6p1-1","Included (upstream 10.6p1)",[74,75,76],"Ubuntu 22.04 LTS","1:8.9p1-3ubuntu0.18","Backported by the security update",[78,79,76],"Ubuntu 24.04 LTS","1:9.6p1-3ubuntu13.20",[81,82,76],"Ubuntu 26.04 LTS","1:10.2p1-2ubuntu3.8",[84,85,86],"AlmaLinux 8","8.0p1","Check Red Hat and AlmaLinux advisories",[88,89,86],"AlmaLinux 9 and 10","9.9p1",{"type":91,"title":92,"steps":93},"steps","Inventory the version actually running",[94,97,100,103,106,109],{"title":95,"body":96},"Read the client version","`ssh -V` prints the version of the OpenSSH client and of its cryptographic library, on standard error. The client is what enforces the username check: on an admin workstation or a bastion, this is the version that counts.",{"title":98,"body":99},"Read the server version","`sudo \u002Fusr\u002Fsbin\u002Fsshd -V` prints the daemon version. The option exists since OpenSSH 9.2: on an older server, such as AlmaLinux 8 on 8.0p1, it is not recognised, and you go through the package manager instead.",{"title":101,"body":102},"Read the installed package","On Debian and Ubuntu: `dpkg -s openssh-server | grep ^Version`. On AlmaLinux and Rocky Linux: `rpm -q openssh-server`. Note the full number, distribution suffix included: that is what you compare with the table above.",{"title":104,"body":105},"Look for the fixes in the package changelog","On Debian and Ubuntu: `apt changelog openssh-server | head -60`. On AlmaLinux: `rpm -q --changelog openssh-server | head -60`. On Ubuntu, the `SECURITY UPDATE` entries mention for example \"invalid chars in command-line username\" or \"incorrect use of LZ77 dictionary coder\".",{"title":107,"body":108},"Check that the service restarted","An updated package protects nothing if the old daemon is still running. Compare `systemctl show -p ActiveEnterTimestamp ssh` (the service is called `sshd` on AlmaLinux) with the package installation date.",{"title":110,"body":111},"Sweep the fleet in one command","List your servers in `servers.txt`, one per line, then run: `while read -r h; do printf '%s : ' \"$h\"; ssh -n -o BatchMode=yes \"$h\" 'dpkg -s openssh-server 2>\u002Fdev\u002Fnull | grep ^Version || rpm -q openssh-server'; done \u003C servers.txt`. The output is one line per server, to sort by operating system family.",{"type":36,"title":113,"body":114},"What can break across a managed fleet","The notes list three items as potentially incompatible changes; only one really affects your scripts.\n\nThe first is the refusal of `$` and `\\` in a username entered on the command line, with `user@host` as well as with `-l`. `ssh` then stops with `remote username contains invalid characters`. Real-world cases: a domain account in the form `DOMAIN\\user`, or a script that builds the `ssh` command from external data. A name written literally in the `User` directive of a `Host` block is not subject to the check; the source code shows, however, that a `User` built with `%` tokens is. In a `ProxyJump`, an invalid name on a jump host is refused with `invalid username`.\n\nThe second is compression: `Compression yes` is still accepted, but compresses less well without the LZ77 dictionary. Nothing breaks; a transfer over a slow link may simply take longer. The OpenSSH team recommends compressing at the application level rather than inside SSH.\n\nThe third, disabling `GatewayPorts` and `StreamLocalForwarding`, only concerns old platforms such as QNX 6 or SCO OpenServer 5, not your Linux servers. Two visible side effects come on top: `scp -R` prints a deprecation warning, and `sshd` logs by default, through the new `WarnWeakCrypto` option, clients that negotiate a key exchange that is not resistant to quantum computers.",{"type":55,"title":116,"headers":117,"rows":121},"Change, impact, action: the reference table",[118,119,120],"Change in 10.6","Impact on a fleet","Action",[122,126,130,134,138,142,146,150],[123,124,125],"`$` and `\\` refused in a command-line username","Scripts and `DOMAIN\\user` accounts fail","Write the name literally in `User` within a `Host` block",[127,128,129],"LZ77 dictionary disabled","`Compression yes` less effective","Compress before the transfer (`tar`, `rsync -z`)",[131,132,133],"GSSAPI credentials stored only after success","None outside Kerberos authentication","Test a Kerberos login after the update",[135,136,137],"`restrict` applied to tunnels","A `restrict` key no longer opens a tunnel","List service keys that rely on `PermitTunnel`",[139,140,141],"`none` values read correctly in `Match`","An `AuthorizedPrincipalsFile none` finally disables the option","Review `Match` blocks with `sshd -T -C`",[143,144,145],"`scp -R` deprecated","Warning on standard error","Drop `-R`: the copy goes through the machine running `scp`",[147,148,149],"`WarnWeakCrypto` enabled on the server","New lines in `sshd` logs","Spot old clients that need updating",[151,152,153],"Daylight Saving Time fixed in `ssh-keygen`","Certificate expiries previously off by one hour","Check certificates issued near a clock change",{"type":36,"title":155,"body":156},"Check the configuration before reloading sshd","`sshd -t` checks the validity of the configuration file and of the keys, without starting anything. The manual page recommends it precisely for updating `sshd` reliably, since configuration options may change from one version to the next. No output and an exit code of 0: the file is readable.\n\n`sshd -T` goes further: it prints the effective configuration, defaults included. This is your before-and-after snapshot. To check a `Match` block, simulate a connection with `-C`, for example `sudo sshd -T -C user=deploy,host=bastion.your-domain.com,addr=203.0.113.10`. The accepted keywords are `user`, `host`, `addr`, `laddr`, `lport` and `rdomain`.\n\nThe reload command depends on the family: the service is called `ssh` on Debian and Ubuntu, `sshd` on AlmaLinux and Rocky Linux. Sessions already open survive a reload. On recent Ubuntu, `ssh.socket` listens instead of the daemon: changing `Port` requires `systemctl daemon-reload`, then restarting `ssh.socket`.",{"type":91,"title":158,"steps":159},"Roll out the update without locking yourself out",[160,163,166,169,172,175,178,181],{"title":161,"body":162},"Keep a rescue session open","Open an SSH session on the server, become root with `sudo -i`, and close it only at the very end. If the new configuration refuses connections, this is the session you fix it from.",{"title":164,"body":165},"Snapshot the effective configuration","`sudo sshd -T > \u002Froot\u002Fsshd-T-before.txt`. This file will tell you what the update changed, value by value.",{"title":167,"body":168},"Update the packages","Debian and Ubuntu: `sudo apt update && sudo apt install --only-upgrade openssh-server openssh-client`. AlmaLinux and Rocky Linux: `sudo dnf upgrade 'openssh*'`.",{"title":170,"body":171},"Test the configuration","`sudo sshd -t && echo OK`. If a line is refused, fix it before anything else: a daemon that cannot read its configuration will not start at the next server reboot either.",{"title":173,"body":174},"Reload the service","`sudo systemctl reload ssh` on Debian and Ubuntu, `sudo systemctl reload sshd` on AlmaLinux. The package has often restarted the service already: reloading costs nothing and guarantees that the configuration in use is the right one.",{"title":176,"body":177},"Open a new connection from another terminal","`ssh -v admin@server1.your-domain.com`. Actually log in, with your usual key and user. Until this connection succeeds, the rescue session stays open.",{"title":179,"body":180},"Compare before and after","`sudo sshd -T | diff \u002Froot\u002Fsshd-T-before.txt -`. An unexpected line gets fixed now, not on the day a client calls.",{"title":182,"body":183},"Extend to the fleet in waves, through the bastion","One pilot server per operating system family first, the rest afterwards. If your access goes through a bastion, update it last, after checking your `ProxyJump` entries: the setup is described in \u003Ca href=\"\u002Fblog\u002Fheberger-bastion-host-vps\">our guide to an SSH bastion on a VPS\u003C\u002Fa>.",{"type":185,"title":186,"body":187},"tip","Hardening: a procedure, not another checklist","This guide does not repeat `sshd_config` hardening: `PasswordAuthentication no`, `PermitRootLogin`, `AllowUsers` or `AllowGroups` and `MaxAuthTries` are covered in \u003Ca href=\"\u002Fblog\u002Flinux-hardening-vps-checklist\">the hardening checklist for agencies\u003C\u002Fa> and in \u003Ca href=\"\u002Fblog\u002Fdurcissement-serveur-linux-initial\">initial hardening of a Linux server\u003C\u002Fa>. One point does change with an upstream 10.6 `sshd`: the new `PubkeyOptions max-pk-ok` option lets a client test up to six public keys by default without those probes counting against `MaxAuthTries`. A low `MaxAuthTries` therefore stops rejecting the administrator who keeps many keys in their agent.",{"type":36,"title":189,"body":190},"Troubleshooting: the messages you may run into","The messages below come from the OpenSSH 10.6p1 source code. They appear in the terminal for the client, and in the service log for the server (`journalctl -u ssh` or `journalctl -u sshd`). Always read the full message before acting: most of them point to the faulty line.",{"type":40,"title":192,"items":193},"Error messages and fixes",[194,195,196,197,198,199],"**`remote username contains invalid characters`** — the name passed on the command line contains `$`, `\\` or another refused character; write the account literally in `User` within a `Host` block.","**`Bad configuration option: AgentSocketPath`** — an option introduced in 10.6 was copied to a server that does not know it; the message names the file and line, and `sshd` stops with `terminating, 1 bad configuration options`.","**`Missing privilege separation directory: \u002Frun\u002Fsshd`** — `sshd -t` was run while the service is stopped, on Debian or Ubuntu; create the directory with `sudo mkdir -p \u002Frun\u002Fsshd`, then run the test again.","**`warning: remote\u002Fremote -R copy mode is deprecated and will soon be removed`** — remove `-R` from your `scp` scripts before a future release ignores it.","**`invalid username`** — a `ProxyJump` jump host carries a refused name; move the name into a `Host` block dedicated to the bastion.","**Changed port ignored on Ubuntu** — `ssh.socket` still listens on the old port; run `sudo systemctl daemon-reload`, then `sudo systemctl restart ssh.socket`.",{"type":36,"title":201,"body":202},"A consistent fleet updates with a single procedure","What makes an OpenSSH update risky is not the version: it is a fleet where every server has its own history. Three distributions, four ways of naming the service, scripts that pass usernames on the command line: every difference becomes an exception to handle by hand, often on an evening when a client is waiting.\n\nAn agency running ten or fifty servers has every reason to reduce these differences. One operating system family, one check procedure (`sshd -t`, `sshd -T` before and after, a rescue session), and an inventory that tells you in one command which package runs where. On ServOrbit.com, the agency space gathers your clients' portfolio — domain names, hosting accounts, VPS — and their renewal dates on a single platform. The update procedure itself stays yours: this guide describes it as is, so you can run it on every server.","Your clients' fleet in one place","An agency space to follow your clients' portfolio, from a domain's expiry date to a VPS's root access. You keep the client relationship, we run the infrastructure.","Explore the agency offer","\u002Fsolutions\u002Fagences",[208,225,240],{"id":209,"slug":210,"slugs":211,"title":215,"excerpt":216,"readTime":217,"views":218,"isPinned":19,"publishedAt":219,"updatedAt":220,"category":221,"categories":222,"featuredImage":30,"bgImage":31,"posterImage":224,"relatedSolution":30},317,"linux-vps-hardening-checklist-for-agencies",{"fr":212,"en":210,"ar":213,"es":214},"linux-hardening-vps-checklist","قائمة-تصليب-خادم-لينكس-للوكالات-بعد-التسليم","hardening-linux-vps-checklist-para-agencias-tras-la-entrega","Linux VPS Hardening Checklist for Agencies","Reproducible Linux hardening checklist for agencies: auditd, sudo user, SSH key auth, UFW, fail2ban and root lockout — with per-client traceability.",11,1,"2026-08-30T00:00:00+00:00","2026-09-07T11:26:10+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},[223],{"id":23,"name":24,"slug":25,"color":26,"icon":27},"\u002Fblog\u002Fcovers\u002Flinux-hardening-vps-checklist-poster.svg",{"id":226,"slug":227,"slugs":228,"title":232,"excerpt":233,"readTime":23,"views":18,"isPinned":19,"publishedAt":234,"updatedAt":235,"category":236,"categories":237,"featuredImage":30,"bgImage":31,"posterImage":239,"relatedSolution":30},228,"initial-linux-server-hardening",{"fr":229,"en":227,"ar":230,"es":231},"durcissement-serveur-linux-initial","تصليب-الخادم-linux-الأولي","hardening-inicial-servidor-linux","Initial Linux Server Hardening","Create a sudo user, configure SSH with keys, enable UFW and fail2ban on Ubuntu or Debian in under an hour.","2026-08-06T00:00:00+00:00","2026-10-20T23:18:07+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},[238],{"id":23,"name":24,"slug":25,"color":26,"icon":27},"\u002Fblog\u002Fcovers\u002Fdurcissement-serveur-linux-initial-poster.svg",{"id":241,"slug":242,"slugs":243,"title":247,"excerpt":248,"readTime":249,"views":250,"isPinned":19,"publishedAt":251,"updatedAt":220,"category":252,"categories":253,"featuredImage":30,"bgImage":31,"posterImage":255,"relatedSolution":256},158,"bastion-host-on-vps-securing-your-ssh-access",{"fr":244,"en":242,"ar":245,"es":246},"heberger-bastion-host-vps","مضيف-bastion-على-خادم-vps-تأمين-وصولك-عبر-ssh","bastion-host-en-vps-accesos-ssh","Bastion Host on VPS: securing your SSH access","Deploy a Bastion Host on a ServOrbit VPS: a hardened SSH entry point, centralized access, logs and security rules.",3,2,"2026-07-05T00:00:00+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},[254],{"id":23,"name":24,"slug":25,"color":26,"icon":27},"\u002Fblog\u002Fcovers\u002Fheberger-bastion-host-vps-poster.svg",{"categorySlug":27,"appSlug":257},"bastion-host",1792763218905]