Hey there!
The dedicated team at the OpenBSD project—the folks who develop and maintain OpenSSH—just released version 10.2.
You might be thinking, “Is a point release really that important?”
Well, in this case, yes. While it doesn’t bring flashy new features, it fixes a very annoying bug that might have been slowing you down. Plus, it sets the stage for a more secure future.
Ready to see what’s changed? Let’s dive in.
Table of Contents
That Annoying “Frozen Session” Bug? It’s Gone.
First, let’s talk about a feature called ControlPersist.
If you aren’t familiar with it, here is a quick bit of background. Usually, every time you run an SSH command, your computer has to perform a “handshake” with the server. This takes time. ControlPersist is a fantastic feature that keeps a master connection open in the background. It means subsequent commands run almost instantly because the door is already unlocked.
However, in the previous version (OpenSSH 10.1), this feature had a major hiccup. It was mismanaging how it handled the terminal. The result? You would try to reuse a connection, and your session would just freeze. You couldn’t type, and you couldn’t interact with the remote server. It was incredibly frustrating.
Don’t worry, that headache is officially over.
The headline fix in OpenSSH 10.2 addresses this specific issue. You can now go back to using ControlPersist for lightning-fast connections without fear of your terminal giving you the silent treatment.
See also: Mastering the Linux Command Line — Your Complete Free Training Guide
Tidy-Up Time: Key Management and Compatibility
Beyond that major fix, the developers did some spring cleaning under the hood. Here is what else has been improved.
fixing ssh-keygen
The ssh-keygen tool is what you use to create and manage those cryptographic keys that verify who you are. The team fixed two specific issues here:
- Hardware Tokens: There was a bug preventing keys from being properly downloaded from PKCS#11 tokens (think hardware security modules like a YubiKey). That is now resolved.
- Certificate Authorities: If you store your Certificate Authority (CA) key in
ssh-agentfor convenience, you might have hit errors when trying to sign things. This process is now much smoother.
Playing Nice with Other Systems
OpenSSH runs almost everywhere, and the team wants to keep it that way. This release improves portability for a few specific environments:
- It now works better on systems that don’t support
mmap, such as WebAssembly (WASM) environments like HTerm. - They fixed some missing bits of code for FreeBSD users.
- Support is improved for older macOS versions that lack certain modern clock functions.
- Finally, they fixed a potential hang in the SSH daemon (
sshd) that could happen when dealing with unknown hostnames in certain configurations.
Looking Ahead: Saying Goodbye to SHA-1
Perhaps the most important part of this announcement isn’t about what changed today, but what is changing in the future.
To give you some background, security relies on mathematical algorithms to create digital “fingerprints.” For a long time, an algorithm called SHA-1 was the standard. However, as computers got faster, researchers discovered weaknesses in SHA-1. It is no longer considered securely “collision-resistant.”
Because of this, the OpenSSH team has issued an early warning.
In a future release, they will remove support for SHA-1 based SSHFP records (these are records in the Domain Name System used to verify a host).
It’s a straightforward process to prepare. Future versions of OpenSSH will simply ignore these older, weaker records. Instead, they will rely on SHA-256. This is a much stronger algorithm that OpenSSH has actually supported all the way back since 2012.
This is a gentle nudge to ensure your infrastructure is using modern standards. It’s all part of the continuous push toward a safer internet.
Final Thoughts
OpenSSH 10.2 is available for download now from the official mirrors.
While maintenance releases might not seem exciting, they are vital. This update restores the speed of ControlPersist and takes another step toward retiring outdated cryptography. It’s a great example of the steady, thoughtful work that keeps our digital lives secure.
