Bitvise SSH Client 9.67 download

- Security updates:
- This version fixes security issues in SSH protocol and key handling. Some issues can affect a connection before the server's host key is trusted. We recommend upgrading.
- Installation and compatibility:
- The SSH Client now requires at least Windows Vista, Windows Server 2008, or newer. Windows XP and Windows Server 2003 are no longer supported.
- Improved preservation of .tlp and .bscp file associations across updates.
- Fixed updates resumed after a Windows restart which could ignore the choices to omit WinFsp or the desktop icon. Also corrected removal of WinFsp when it is deselected during an update.
- The SSH Client now includes WRC 9.67, required for remote administration of Bitvise SSH Server 9.67.
- SSH cryptography:
- Bitvise software now supports hybrid post-quantum and classical signatures using MLDSA44_Ed25519 (ssh-mldsa44-ed25519). This combines ML-DSA-44 and Ed25519 for server and client authentication. The algorithm is only available when FIPS 140 cryptography mode is not enabled in Windows.
In new SSH Client profiles, MLDSA44_Ed25519 is now preferred in host-key algorithm settings. Existing profiles retain their preference order, with the new algorithm appended.
- The SSH tab now has separate Host keys and Client keys algorithm settings. Client authentication algorithms can also be configured using -ckeyAlgs and -ckeyMod, independently of host-key selection.
New default profiles and command lines that do not load a profile exclude RSA/SHA-1 and DSA from client authentication. RSA keys remain usable with RSA/SHA-2. Profiles from earlier versions retain their previous client-authentication behavior, including saved default profiles.
Command-line client connections to a server requiring RSA/SHA-1 client authentication may need this algorithm explicitly enabled, for example using -ckeyMod=ssh-rsa.
- SSH compression is now disabled by default in new SSH Client profiles. Existing profiles retain their configured compression algorithms.
The concern with zlib is that it uses a shared compression dictionary for all connection channels. If channels contain data from different users, for example when using port forwarding, a user of one channel may be able to leverage compression characteristics to discover data sent on other channels in the same SSH connection.
Per-channel compression could avoid this issue, but needs a specification. Bitvise would consider this if another SSH implementation has interest.
- Host key fingerprints can now include the key type. This information is checked during host-key verification and helps select an appropriate host-key algorithm during SSH key exchange. The -hostKeyFp parameter and jump-host fingerprint lists also support key types.
Profiles containing fingerprints with a specified key type cannot be loaded by earlier SSH Client versions. Profiles using fingerprints without a key type retain their existing compatibility.
- Corrected algorithm-list editing and command-line modifiers which could leave an algorithm enabled after it was removed, or change which algorithms were enabled when reordering them. The graphical client now also accepts the algorithm modifier parameters -kexMod, -hkeyMod, -ckeyMod, -encrMod, -macMod and -cmprMod.
- New Remote Desktop:
- One SSH Client profile can now configure multiple Remote Desktop destinations. Configure these using Destinations on the RDP tab. When more than one destination is configured, opening Remote Desktop presents a destination chooser. Destinations can also be supplied using the -rdpDest command-line parameter.
- Each destination can use the default RDP credentials, the SSH login credentials, or separately configured credentials. This allows access to several computers through one SSH connection without changing credentials for other destinations.
- Added Multi-monitor and WebAuthn overrides for the RDP profile. These are also configurable using -rdpMultimon and -rdpWebAuthn. Each option can be enabled, disabled, or left as specified by the RDP profile.
- The Remote Desktop window title and full-screen connection bar can now use custom text in place of the SSH server address. This is also configurable using -rdpTitle.
- Added Do not hide language bar, also configurable using -rdpNoHideLangBar. This can prevent Remote Desktop from hiding and restoring the Windows language indicator. When switching focus from a Remote Desktop window, this rearranges icons in the system notification area, so that the icons shift when the user attempts to click them.
- Graphical SFTP:
- Added Edit Link for symbolic links in both the local and remote file panes.
- Drag and drop can now be configured separately for the local and remote panes. It can be enabled, disabled, or disabled only within the same pane. The last option helps prevent accidental moves while retaining transfers between panes and drag and drop from Windows Explorer.
- Fixed drag and drop of files with long paths, which could previously be truncated.
- Fixed crashes and incorrect suggestions related to path auto-completion. Also fixed crashes associated with monitoring changes in the local directory.
- Fixed incorrect handling of cached remote directory listings, which could prevent the displayed contents from refreshing correctly.
- SFTP:
- The graphical SFTP client and sftpc now preserve repeated slashes for servers that distinguish paths such as //DIRECTORY and /DIRECTORY.
- Corrected newline conversion in text-mode transfers. Also fixed text-file auto-detection when transferring an empty file.
- Corrected request alignment in resumed uploads and downloads. This could cause failures where file operations require alignment, or reduce transfer efficiency.
- SFTP drive:
- The SSH Client now includes WinFsp version 2.2.26286. This includes recent WinFsp security fixes.
- Improved performance of large writes, particularly over connections with higher latency.
- Improved handling of renamed and replaced files, including files accessed through multiple open handles. Corrected error handling when replacing an existing destination during a rename.
- Graphical terminal:
- Corrected mouse-wheel and mouse-motion reporting for applications using SGR mouse mode, including tmux.
- Fixed rendering and stalls involving combining and wide characters at line boundaries.
- Double-click word selection now distinguishes automatically wrapped lines from explicit line breaks.
- Port forwarding and command-line clients:
- The graphical client and stnlc now display server-configured client-to-server forwarding rules separately from client-configured rules.
- sexec -git2 now correctly requests Git protocol version 2. Previously, the environment variable it sent was not effective to enable version 2.
- General:
- Fixed a regression introduced in 9.63 which could cause an internal error during SSH channel cleanup. Improved handling of channels that are starting or closing when a connection ends.
- Improved acquisition and recovery of the system tray icon.
- The installation now includes GenCountries.exe, which can generate an updated Countries.bin using either IPLocate.io or MaxMind data. The included country database now uses IPLocate.io data.