OpenSSH version 6.1 is primarily a bugfix release.

Features:

• sshd(8): This release turns on pre-auth sandboxing sshd by default for new installs, by setting UsePrivilegeSeparation=sandbox in sshd_config.
• ssh-keygen(1): Add options to specify starting line number and number of lines to process when screening moduli candidates, allowing processing of different parts of a candidate moduli file in parallel
• sshd(8): The Match directive now supports matching on the local (listen) address and port upon which the incoming connection was received via LocalAddress and LocalPort clauses.
• sshd(8): Extend sshd_config Match directive to allow setting AcceptEnv and {Allow,Deny}{Users,Groups}
• Add support for RFC6594 SSHFP DNS records for ECDSA key types. bz#1978
• ssh-keygen(1): Allow conversion of RSA1 keys to public PEM and PKCS8
• sshd(8): Allow the sshd_config PermitOpen directive to accept "none" as an argument to refuse all port-forwarding requests.
• sshd(8): Support "none" as an argument for AuthorizedPrincipalsFile
• ssh-keyscan(1): Look for ECDSA keys by default. bz#1971
• sshd(8): Add "VersionAddendum" to sshd_config to allow server operators to append some arbitrary text to the server SSH protocol banner.

Bugfixes:

• ssh(1)/sshd(8): Don't spin in accept() in situations of file descriptor exhaustion. Instead back off for a while.
• ssh(1)/sshd(8): Remove hmac-sha2-256-96 and hmac-sha2-512-96 MACs as they were removed from the specification. bz#2023,
• sshd(8): Handle long comments in config files better. bz#2025
• ssh(1): Delay setting tty_flag so RequestTTY options are correctly picked up. bz#1995
• sshd(8): Fix handling of /etc/nologin incorrectly being applied to root on platforms that use login_cap.

Portable OpenSSH:

• sshd(8): Allow sshd pre-auth sandboxing to fall-back to the rlimit sandbox from the Linux SECCOMP filter sandbox when the latter is not available in the kernel.
• ssh(1): Fix NULL dereference when built with LDNS and using DNSSEC to retrieve a CNAME SSHFP record.
• Fix cross-compilation problems related to pkg-config. bz#1996

Existing customers can download the latest version from their customer page at www.itefix.net