This is the fifth milestone pre-release on the way to a new major version Apache MINA SSHD 3.0.0.

Like regular releases it is available in Maven Central and in the Apache repositories; the Apache source release is also at the usual location.

See the change notes for what has changed with respect to version 2.

This fifth milestone just merges 2.19.0 into 3.0, bringing in the improvements done in the 2.x main stream.

Version 3 of Apache MINA SSHD is not API compatible with version 2. API comparison reports and a (very high-level and tentative) roadmap are available on the 3.0.0 development website.

This pre-release has passed all our quality and regression tests, just like any other release. We encourage interested parties to try this pre-release. Be aware that APIs might change in future milestone pre-releases.

Full Changelog since 3.0.0-M4: https://github.com/apache/mina-sshd/compare/sshd-3.0.0-M4...sshd-3.0.0-M5

• GH-899 Fix ProcessShellFactory on Linux
• GH-902 Fix client-side handling of sk-* public key signatures (also in the agent interfaces)
• Limit size of decompressed SSH packets
• Improve checking SSH user certificates in public-key authentication
• Improve handling of repository paths in sshd-git on Windows
• Validate file names in SCP
• Escape newlines in filenames in the SCP protocol
• Restrict JGit commands accessible via GitPgmCommandFactory in sshd-git

Bundle sshd-git contains a GitPgmCommandFactory that can be configured for an Apache MINA SSHD server. It enables remote execution of git commands via JGit.

However, running arbitrary git commands remotely is an exotic use case, and some commands (like git archive --format zip --output somefile.zip or also git clone or git checkout) could even create files on the server. This should be only allowed in an OS-level chrooted environment, which Apache MINA SSHD does not and cannot provide.

We have therefore limited the available commands to a small set of whitelisted git commands that might be useful as maintenance commands for authorized power users on a git server implemented based on sshd-git. The command are: archive, blame, branch, describe, diff, gc, log, reflog, show, and status. All these commands can be executed from an client via git --git-dir <repo> <command> <args>, where <repo> is the server-side name of the git repository (its local path on the server relative to the configured root), <command> is the command name (e.g., archive) and <args> are the command arguments. Results are sent back via the command output streams (output or error streams) and are thus sent back to the client. For the archivecommand, the --output (or -o) argument is ignored; the archive is always returned via the command's output stream and this is also sent to the client.

Applications that might have relied on the ability to run other JGit command remotely may no longer work. Either implement your own dedicated command factory to enable accesss to certain commands, or set the property GitModuleProperties.RESTRICT_COMMANDS to false on the server-side SshServer (for all sessions) or on particular ServerSessions (for particular individual sessions) to re-enable access to all commands supported by JGit.

This is the fourth milestone pre-release on the way to a new major version Apache MINA SSHD 3.0.0.

Like regular releases it is available in Maven Central and in the Apache repositories; the Apache source release is also at the usual location.

See the change notes for what has changed with respect to version 2.

This fourth milestone just merges 2.18.0 into 3.0, bringing in the improvements done in the 2.x main stream.

Version 3 of Apache MINA SSHD is not API compatible with version 2. API comparison reports and a (very high-level and tentative) roadmap are available on the 3.0.0 development website.

This pre-release has passed all our quality and regression tests, just like any other release. We encourage interested parties to try this pre-release. Be aware that APIs might change in future milestone pre-releases.

Full Changelog since 3.0.0-M3: https://github.com/apache/mina-sshd/compare/sshd-3.0.0-M3...sshd-3.0.0-M4

• GH-743 Ensure the Java ServiceLoader use a singleton SftpFileSystemProvider
• GH-879 Close SSH channel gracefully on exception in port forwarding
• Improve handling of repository paths in sshd-git.

• GH-892 Align handling certificates without principals with OpenSSH 10.3

Wildcard principals in host certificates are handled now.

• Putty keys with non-ASCII passphrases

The passphrase needs to be converted to a byte sequence to compute a decryption key for an encrypted private key. This conversion depends on the character encoding. Putty on Windows uses the ANSI codepage set when the key was generated. Apache MINA SSHD now tries multiple encodings in sequence: UTF-8, then the OS encoding, and finally ISO-8859-1 as a last-chance fallback.

• GH-892 Align handling certificates without principals with OpenSSH 10.3

OpenSSH 10.3 changed the way such certificates are handled; see the OpenSSH 10.3 release notes. In Apache MINA SSHD, there is a new flag CoreModuleProperties.ALLOW_EMPTY_CERTIFICATE_PRINCIPALS (by default false) that can be set on an SshClient or SshServer or also on a Session directly. If the value is false, certificates without principals are rejected as in OpenSSH 10.3; if it is true, such certificates are considered to match any user or host name as in OpenSSH < 10.3.

Set the flag on an SshClient or ClientSession to determine the handling of host certificates. Set it on an SshServer or ServerSession to govern the handling of user certificates.

This is the third milestone pre-release on the way to a new major version Apache MINA SSHD 3.0.0.

Like regular releases it is available in Maven Central and in the Apache repositories; the Apache source release is also at the usual location.

See the change notes for what has changed with respect to version 2.

This third milestone fixes two bugs in 3.0.0-M2 and brings the improvements done in the current main 2.x version into 3.0.

Version 3 of Apache MINA SSHD is not API compatible with version 2. API comparison reports and a (very high-level and tentative) roadmap are available on the 3.0.0 development website.

This pre-release has passed all our quality and regression tests, just like any other release. We encourage interested parties to try this pre-release. Be aware that APIs might change in future milestone pre-releases.

Full Changelog since 3.0.0-M2: https://github.com/apache/mina-sshd/compare/sshd-3.0.0-M2...sshd-3.0.0-M3

This patch release fixes the broken Maven deployment of 2.17.0. (The root pom was missing).

There were no code changes, only a pom update to work around a tooling bug that caused the problem with 2.17.0:

• GH-875 Use Apache Parent POM 36

For the real changes since version 2.16.0 see the 2.17.0 change notes.

See the change log.

• @JannuMies made their first contribution in https://github.com/apache/mina-sshd/pull/832
• @bemoty made their first contribution in https://github.com/apache/mina-sshd/pull/843
• @chrjohn made their first contribution in https://github.com/apache/mina-sshd/pull/849
• @denyshorman made their first contribution in https://github.com/apache/mina-sshd/pull/870

Full Changelog: https://github.com/apache/mina-sshd/compare/sshd-2.16.0...sshd-2.17.0

This is the second milestone pre-release on the way to a new major version Apache MINA SSHD 3.0.0.

Like regular releases it is available in Maven Central and in the Apache repositories; the Apache source release is also at the usual location.

See the change notes for what has changed with respect to version 2.

The focus in this milestone was on the use of cryptography. Bundles sshd-common and sshd-osgi have become multi-release JARs. Apache MINA SSHD 3.0.0-M2 now supports

• On Java11+: using Java's built-in ChaCha20 cipher for the chacha20-poly1305@openssh.com SSH cipher, which bring a hug speed-up.
• On Java15+: using Java's built-in ed25519 private/public key implementation instead on Bouncy Castle or net.i2p.crypto:eddsa.
• On Java24+: using Java's built-in ML-KEM post-quantum key exchange method instead of Bouncy Castle.

Version 3 of Apache MINA SSHD is not API compatible with version 2. API comparison reports and a (very high-level and tentative) roadmap are available on the 3.0.0 development website.

This pre-release has passed all our quality and regression tests, just like any other release. We encourage interested parties to try this pre-release. Be aware that APIs might change in future milestone pre-releases.

Full Changelog since 3.0.0-M1: https://github.com/apache/mina-sshd/compare/sshd-3.0.0-M1...sshd-3.0.0-M2

This is a first milestone pre-release on the way to a new major version Apache MINA SSHD 3.0.0.

Like regular releases it is available in Maven Central and in the Apache repositories; the Apache source release is also at the usual location.

See the change notes for what has changed with respect to version 2. In short, we have refactored the implementation of the SSH transport layer, which then enabled providing support for client-side proxies. In doing so we've technically broken a lot of APIs, but the impact on existing code bases using the library should be small in practice. API comparison reports and a (very high-level and tentative) roadmap are available on the 3.0.0 development website.

This pre-release has passed all our quality and regression tests, just like any other release. We encourage interested early adopters to try this pre-release. Be aware that APIs might change in future milestone pre-releases.

Full Changelog: https://github.com/apache/mina-sshd/compare/sshd-2.16.0...sshd-3.0.0-M1

• bugfix: fix cert auth failed bug by @liuziyu1226 in https://github.com/apache/mina-sshd/pull/660
• GH-664: Skip MAC negotiation if an AEAD cipher was negotiated by @tomaswolf in https://github.com/apache/mina-sshd/pull/666
• GH-663: Fix a race in IoSession creation by @tomaswolf in https://github.com/apache/mina-sshd/pull/667
• Also test sshd-mina using mina-core 2.2.4 by @tomaswolf in https://github.com/apache/mina-sshd/pull/681
• ScpShell fixes; SFTP append mode for buggy servers by @tomaswolf in https://github.com/apache/mina-sshd/pull/696
• fix sources.jar Reproducible Builds issue by @hboutemy in https://github.com/apache/mina-sshd/pull/695
• GH-700: Fix race in AbstractCloseable.doCloseImmediately() by @tomaswolf in https://github.com/apache/mina-sshd/pull/702
• GH-705: Make ChannelToPortHandler accessible to user code by @tomaswolf in https://github.com/apache/mina-sshd/pull/707
• GH-709: Handle keep-alive channel messages sent by an old OpenSSH server by @tomaswolf in https://github.com/apache/mina-sshd/pull/710
• GH-727: supply default port for proxyJump if no HostConfigEntry by @tomaswolf in https://github.com/apache/mina-sshd/pull/730
• GH-733: Fix SftpRemotePathChannel.transferTo by @tomaswolf in https://github.com/apache/mina-sshd/pull/734
• [GH-725] Added commandTimeoutMillis in executeRemoteCommand by @raajeive in https://github.com/apache/mina-sshd/pull/726
• GH-774: Fix WritePendingException by @tomaswolf in https://github.com/apache/mina-sshd/pull/775
• #771 Avoid NoClassDefFoundError: net/i2p/crypto/eddsa/EdDSAPublicKey by @rde-infologic in https://github.com/apache/mina-sshd/pull/773
• [GH-516] Fix filesystem-id parsing in getFileSystem(URI) by @ago1024 in https://github.com/apache/mina-sshd/pull/766
• GH-754: Don't close DefaultForwarder on bind error by @tomaswolf in https://github.com/apache/mina-sshd/pull/776
• Close repository after usage in GitPackCommand by @kwin in https://github.com/apache/mina-sshd/pull/794
• Trigger ClientChannelEvent.Timeout and ClientSessionEvent.TIMEOUT independently to host's program cycle times by @fersaru in https://github.com/apache/mina-sshd/pull/790

• @liuziyu1226 made their first contribution in https://github.com/apache/mina-sshd/pull/660
• @raajeive made their first contribution in https://github.com/apache/mina-sshd/pull/726
• @rde-infologic made their first contribution in https://github.com/apache/mina-sshd/pull/773
• @ago1024 made their first contribution in https://github.com/apache/mina-sshd/pull/766
• @kwin made their first contribution in https://github.com/apache/mina-sshd/pull/794
• @fersaru made their first contribution in https://github.com/apache/mina-sshd/pull/790

Full Changelog: https://github.com/apache/mina-sshd/compare/sshd-2.15.0...sshd-2.16.0