OpenSSH is one of those tools every company depends on and almost nobody thinks about. Version 10.6, released this week, makes a handful of changes that will not affect most people on day one but can break the odd script, pipeline or old habit. The New Stack covered the release on 7 October.
None of this is an emergency. It is the kind of change that turns up three months later, when a new base image rolls out and a nightly job starts failing for no obvious reason.
What changed
- Compression is weaker. SSH compression used a method that was shared across channels on the same connection, and that sharing could leak information. OpenSSH has switched that part off. Compression still works, but it saves less. The project suggests compressing data in the application instead.
- Some usernames are refused. Usernames that contain a dollar sign or a backslash are now rejected when passed on the command line, because a shell could interpret them in certain settings. Usernames set in config files with the User setting are not affected.
- A post-quantum key type was renamed. The hybrid ssh-mldsa44-ed25519 algorithm lost its old name suffix. Keys made with the earlier version need to be regenerated or removed.
- Remote-to-remote scp is on its way out. Using scp -R to copy between two remote hosts still works but now prints a warning. It will eventually be ignored.
- More frequent security fixes. The project plans to ship security fixes more often than its usual schedule.
Where this bites
The changes are small, which is exactly why they slip through. Three places deserve a look.
Automation that builds usernames on the fly. CI jobs, deployment tools and agents sometimes pass usernames that came from a variable or a directory service. If any of those contain a backslash, which is common with Windows-style domain accounts, the connection will now fail.
Large transfers over slow links. Teams that switched on SSH compression years ago to move backups or logs across a thin connection may see those jobs slow down. Nothing errors. It just takes longer, and someone notices when a backup window overruns.
Early adopters of post-quantum keys. If a security team experimented with the new hybrid keys, those keys now need replacing. This is a good reminder that anything labelled experimental will change.
Why leaders should care
SSH sits underneath deployment, backup, break-glass access and a long tail of scripts written by people who have since moved on. Most organisations cannot say how many places depend on it or which version each server runs. That is fine until a security fix needs to go out quickly, and the OpenSSH team has just said that will happen more often.
The real question is not about version 10.6. It is whether your organisation can roll out an urgent SSH update across every host in days, and know it worked.
What to do this quarter
- Search your automation for scp -R and for usernames passed with a dollar sign or backslash. Move scp jobs to rsync or sftp.
- Check where compression is on. Look in SSH config files and scripts for the Compression setting and test the jobs that use it on the new version.
- Find any hybrid post-quantum keys created during testing and replace them.
- Know your versions. Make sure your inventory can report the OpenSSH version on every host and base image. If it cannot, fix that first.
- Test new base images in CI before they reach production, so the slow failures above show up in a pipeline rather than a backup report.
Small releases like this are a useful health check. If you can answer every point above in an afternoon, your fleet is in good shape. If it takes a week of asking around, that is the finding.
