OpenSSH 10.4 released

OpenSSH 10.4 has been released, adding experimental support for a composite post-quantum signature scheme combining ML-DSA 44 and Ed25519. The release also enforces sandbox support on Linux, requiring SECCOMP or NO_NEW_PRIVS to be enabled, or sshd will fail to start.

OpenSSH 10.4 released OpenSSH 10.4 has been released. In addition to a number of security and bug fixes, there are a few notable changes; this release adds experimental support for a composite post-quantum signature scheme combining ML-DSA 44 and Ed25519 as described in this IETF draft https://datatracker.ietf.org/doc/draft-miller-sshm-mldsa44-ed25519-composite-sigs/ . With 10.4, if OpenSSH is compiled with sandbox support it will fail on Linux systems that have not enabled SECCOMP or NO NEW PRIVS ; prior to this release, sshd would log an error but continue operation. See the release notes https://www.openssh.org/txt/release-10.4 for a full list of changes.