Pimp My IDE / garage dispatch
Back to the garage
October 6, 2026 | OpenSSH / upgrade control

SSH upgrades touch more than the daemon.

OpenSSH 10.6 changes compression behavior, rejects two characters in command-line usernames, warns on remote-to-remote scp -R, and adds new post-quantum and server controls.

Inventory the route before replacing the package.
TRANSPORT COUPLER / 10.5 TO 10.6
10.6
CLIENTusernames / scp / keysSERVERwarnings / sockets / policyTRAFFICcompression / forwardingPROOFconfig / transfer / logs

The compatibility list is the upgrade plan.

OpenSSH 10.6 was released on October 6. The release notes call out three potentially incompatible changes. Compression is less effective after the LZ77 dictionary coder was disabled. Command-line destination usernames now reject $ and backslash. A small group of old platforms lose gateway and stream-local forwarding because their post-authentication process retains root privilege.[1]

The same release starts deprecating scp -R. That mode runs scp on a remote host and requires credentials there. OpenSSH says the option is fragile and can meet different shell quoting rules on the remote machine. It now prints a warning and will be ignored in a future release. The default remote-to-remote path transfers through the local host.[1][2]

A successful login does not clear the transfer route, forwarding path, or warning log.

Compression is now a trust-boundary question.

OpenSSH disabled the LZ77 dictionary coder to address a chosen-plaintext attack against trusted and untrusted channels that share one compression context. The client and server manuals already warn against compression when an open forward carries untrusted traffic beside trusted session data.[1][3]

Do not benchmark the upgrade with one shell prompt. Test the workloads that depended on compression. If they now move fewer useful bytes per second, move compression into the application where each data stream owns its own context.

New controls need separate decisions.

The release enables the hybrid ssh-mldsa44-ed25519 signature algorithm. Keys made with the earlier experimental vendor-suffixed form must be regenerated or removed. Servers also gain WarnWeakCrypto, enabled by default, so they can log connections without post-quantum key exchange. New AgentSocketPath and ssh-agent -A options let administrators choose user-specific or shared socket directories.[1][4]

Those are independent changes. Enabling a new signature does not prove every client negotiates it. Moving an agent socket does not prove file ownership or forwarding policy. Read the effective configuration, exercise the connection, and inspect the server log.

Run four checks before fleet rollout.

  1. Search scripts for scp -R, untrusted username interpolation, explicit compression, and experimental ML-DSA key names.
  2. Print effective client and server configuration on a canary host. Save package versions and the exact host stanza.
  3. Exercise login, remote-to-remote copy, every required forward, and the largest compressible transfer.
  4. Inspect weak-crypto warnings and compare negotiated algorithms before approving wider rollout.
Interactive makeover / upgrade transfer table

OpenSSH cutover bay

Traditional purpose replaced: upgrade the package and try one login. Better version: connect command, traffic, key, and server checks to one cutover card. The controls select required work. They do not run it.

Select checks for the canary

A selected circuit adds fields to the canary plan. Approval still needs a host, package build, outputs, and a named reviewer.

10.5 to 10.6 transfer1 of 4 checks selected

The command path is in the plan. Traffic, key, and server checks remain open.

1 of 4 cutover checks is selected.

Sources read

Source log and evidence boundary
  1. OpenSSH 10.6 release notes, October 6, 2026. Security fixes, incompatible changes, scp -R deprecation, new signature support, weak-crypto warnings, agent socket controls, checksums, and the maintainers' note on AI-assisted security reports.
  2. OpenBSD manual, scp(1), read October 6, 2026. It documents local mediation as the default for remote-to-remote copies and the separate -R route.
  3. OpenBSD manual, ssh_config(5), read October 6, 2026. It documents client compression scope, the mixed-trust warning, and weak-crypto warning behavior.
  4. OpenBSD manual, sshd_config(5), read October 6, 2026. It documents server compression scope, WarnWeakCrypto, and AgentSocketPath.

Evidence boundary. We read the upstream release notes and current OpenBSD manuals. We did not install 10.6 on a production host or measure a real workload. The cutover bay writes a canary plan. It does not inspect SSH configuration, negotiate an algorithm, move a key, or approve rollout.