# OpenSSH 10.6 for post-quantum SSH keys

CH-J Tools can add the post-quantum key type `ssh-mldsa44-ed25519` to a server only when that server runs **OpenSSH 10.6 or newer**. OpenSSH 10.6 (6 October 2026) is the first release with the standardized form of this key type. Older releases reject it. Some of them, such as 10.2p1 in Ubuntu 26.04, know only an experimental `…@openssh.com` variant that CH-J Tools does not use.

At the time of writing, Ubuntu and Debian do not ship 10.6 through `apt`. This guide installs the official **OpenSSH 10.6p2** (5 November 2026, fixes a password-authentication bypass on Linux builds without PAM) next to the distribution package and points the `ssh` service at it.

Tested on a clean Ubuntu 26.04.1 LTS: installation, login with an `ssh-mldsa44-ed25519` key, reboot and rollback.

## Before you start

- **You maintain this build yourself.** `apt upgrade` will not deliver security fixes for it. Watch the [OpenSSH release notes](https://www.openssh.com/releasenotes.html) and repeat the procedure with a newer release, or roll back.
- Keep a **second SSH session open** for the whole procedure. Better still, have console access (hypervisor, IPMI, cloud console).
- Try it on a test machine first.
- You need root, systemd, about 1 GiB free in `/var/tmp` and internet access for `apt` and the OpenSSH download.

## What the script does

1. It installs build dependencies with `apt`.
2. It downloads `openssh-10.6p2.tar.gz`. It checks the pinned SHA-256 and the OpenPGP signature from the OpenSSH release key `7168 B983 815A 5EEF 59A4 ADFD 2A3F 414E 7360 60BA`.
3. It builds into `/opt/openssh-10.6p2`. Your configuration in `/etc/ssh` (host keys, `sshd_config`) and the PAM configuration stay unchanged.
4. It checks the current `sshd_config` with the new version. It then starts a test instance on `127.0.0.1:2226` and switches nothing unless both checks pass.
5. It adds the systemd drop-in `/etc/systemd/system/ssh.service.d/chj-openssh.conf` and disables `ssh.socket`, because upstream sshd has no socket activation. Then it restarts `ssh.service`.
6. It checks that the running process is `/opt/openssh-10.6p2/sbin/sshd` and that the banner reads `SSH-2.0-OpenSSH_10.6`. If either check fails, it rolls back on its own.

## Install

```bash
curl -fsSLO https://tools.ch-j.de/files/tools/chj-openssh-10.6.sh
echo "cdf3031a0b64db3e3bf3c83d31bd746aee5505757b1af5e137750326ed8d7a01  chj-openssh-10.6.sh" | sha256sum -c -
less chj-openssh-10.6.sh          # read it before running it as root
sudo bash chj-openssh-10.6.sh install
```

Then open a **new** SSH connection. Close the old session only after the new login works.

## Check and roll back

```bash
sudo bash chj-openssh-10.6.sh status     # running binary, ssh.socket, banner
sudo bash chj-openssh-10.6.sh rollback   # back to the distribution sshd
```

Rollback removes the drop-in, re-enables `ssh.socket` if it was enabled before, and restarts the distribution `sshd`. The build in `/opt/openssh-10.6p2` stays on disk until you delete it. After a rollback, `ssh-mldsa44-ed25519` keys no longer work on that server.

## Then in CH-J Tools

Connect to the server again. In **Users**, you can now add an `ssh-mldsa44-ed25519` key from the Keychain. If the server still reports an older version, CH-J Tools says "OpenSSH 10.6 or newer is required" and does not add the key.