From 33436030db81e22fef4b0ece1153222b70b84e1f Mon Sep 17 00:00:00 2001
From: Paul Menzel <pmenzel@molgen.mpg.de>
Date: Mon, 12 Oct 2026 14:17:50 +0200
Subject: [PATCH 1/2] openssh: Remove no-op configure option
 --with-md5-passwords
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

OpenSSH 8.9p1 removed the built-in md5crypt() support with commit
a5ab48823 (remove built-in support for md5crypt()), and with it the
configure option. Since then configure only reports it:

    configure: WARNING: unrecognized options: --with-md5-passwords, …

Assisted-by: claude-opus-5.5 (Claude Code)
---
 openssh.be0 | 1 -
 1 file changed, 1 deletion(-)

diff --git a/openssh.be0 b/openssh.be0
index 550c33b8d..ee7dbbe66 100755
--- a/openssh.be0
+++ b/openssh.be0
@@ -15,7 +15,6 @@ mee_patch() {
 mee_configure() {
     bee_configure \
         --sysconfdir=${SYSCONFDIR} \
-        --with-md5-passwords \
         --with-privsep-path=/var/lib/sshd \
         --with-pam \
         --with-xauth=/usr/bin/xauth \

From 50fefb47b55103fdc2d2f42d93ff94a9c1eecee3 Mon Sep 17 00:00:00 2001
From: Paul Menzel <pmenzel@molgen.mpg.de>
Date: Mon, 12 Oct 2026 14:22:21 +0200
Subject: [PATCH 2/2] openssh: Update version from 9.8p1 to 10.6p1

OpenSSH 9.8p1 is affected by the vulnerabilities in DFN-CERT advisories
2026-5120 and 2026-5521, among them

*   CVE-2026-35386: command execution via shell metacharacters in user
    names (fixed in 10.3p1)
*   CVE-2026-60002: use-after-free in ssh when a server changes its
    host key during re-exchange (fixed in 10.4p1)
*   CVE-2026-73282: use-after-free with concurrent remote forwardings
    (fixed in 10.5p1)

and by the older CVE-2025-26465 (VerifyHostKeyDNS server impersonation)
and CVE-2025-26466 (pre-authentication memory/CPU denial of service),
fixed in 9.9p2. 10.6p1 is the latest release.

OpenSSH 10.0p1 removed DSA support altogether, so drop
`--enable-dsa-keys`, which configure now only warns about:

    configure: WARNING: unrecognized options: --enable-dsa-keys

Deploying this needs care:

1.  The site configuration in mxtools still contains
    `PubkeyAcceptedKeyTypes=+ssh-dss` (sshd_config, ssh_config) and
    `HostKeyAlgorithms=+ssh-dss` (ssh_config). OpenSSH 10.6p1 rejects
    both, so sshd refuses to start and ssh refuses to run:

        sshd_config line 124: Bad key types '+ssh-dss'.
        ssh_config line 58: Bad key types '+ssh-dss'.
        ssh_config line 62: Bad key types '+ssh-dss'.
        ssh_config: terminating, 2 bad configuration options

    Without these lines both files pass `sshd -t` and `ssh -G` with
    9.8p1 as well as 10.6p1, so the mxtools change can go out first.

2.  A running 9.8p1 sshd cannot hand connections to the 10.6p1
    sshd-session installed under it. New logins fail until sshd is
    restarted:

        recv_rexec_state: ssh_msg_recv failed

    (client: `kex_exchange_identification: read: Connection reset by
    peer`). Restart sshd right after installing the package.

3.  sshd 10.0p1 and later no longer offer finite field Diffie-Hellman
    key exchange by default, and the new sshd-auth binary is installed
    to /usr/libexec next to sshd-session.

Built with beesh against a local copy of the upstream tarball; the
signature verifies with the OpenSSH release key 7168B983815A5EEF.

Assisted-by: claude-opus-5.5 (Claude Code)
---
 openssh.be0 | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/openssh.be0 b/openssh.be0
index ee7dbbe66..3153180a1 100755
--- a/openssh.be0
+++ b/openssh.be0
@@ -1,9 +1,9 @@
 #!/bin/env beesh
 
-# BEE_VERSION openssh-9.8_p1-1
+# BEE_VERSION openssh-10.6_p1-0
 
 # SRCURL[0]="https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PKGVERSION}${PKGEXTRAVERSION}.tar.gz"
-SRCURL[0]="https://beehive.molgen.mpg.de/bc04ff77796758c0b37bd0bc9314cd3f/openssh-9.8p1.tar.gz"
+SRCURL[0]="https://beehive.molgen.mpg.de/a4e4ce2cc3b87706a043f8e0dc3e25d8/openssh-10.6p1.tar.gz"
 
 SYSCONFDIR=/etc/ssh
 
@@ -17,8 +17,7 @@ mee_configure() {
         --sysconfdir=${SYSCONFDIR} \
         --with-privsep-path=/var/lib/sshd \
         --with-pam \
-        --with-xauth=/usr/bin/xauth \
-        --enable-dsa-keys
+        --with-xauth=/usr/bin/xauth
 }
 
 mee_install() {