OpenSSH 10.6 for post-quantum SSH keys

CH-J Tools can add the post-quantum key type ssh-mldsa44-ed25519 to a server only when that server runs OpenSSH 10.6 or newer. OpenSSH 10.6 (6 October 2026) is the first release with the standardized form of this key type. Older releases reject it. Some of them, such as 10.2p1 in Ubuntu 26.04, know only an experimental …@openssh.com variant that CH-J Tools does not use.

At the time of writing, Ubuntu and Debian do not ship 10.6 through apt. This guide installs the official OpenSSH 10.6p2 (5 November 2026, fixes a password-authentication bypass on Linux builds without PAM) next to the distribution package and points the ssh service at it.

Tested on a clean Ubuntu 26.04.1 LTS: installation, login with an ssh-mldsa44-ed25519 key, reboot and rollback.

Before you start

• You maintain this build yourself. apt upgrade will not deliver security fixes for it. Watch the OpenSSH release notes and repeat the procedure with a newer release, or roll back.
• Keep a second SSH session open for the whole procedure. Better still, have console access (hypervisor, IPMI, cloud console).
• Try it on a test machine first.
• You need root, systemd, about 1 GiB free in /var/tmp and internet access for apt and the OpenSSH download.

What the script does

1. It installs build dependencies with apt.
2. It downloads openssh-10.6p2.tar.gz. It checks the pinned SHA-256 and the OpenPGP signature from the OpenSSH release key 7168 B983 815A 5EEF 59A4 ADFD 2A3F 414E 7360 60BA.
3. It builds into /opt/openssh-10.6p2. Your configuration in /etc/ssh (host keys, sshd_config) and the PAM configuration stay unchanged.
4. It checks the current sshd_config with the new version. It then starts a test instance on 127.0.0.1:2226 and switches nothing unless both checks pass.
5. It adds the systemd drop-in /etc/systemd/system/ssh.service.d/chj-openssh.conf and disables ssh.socket, because upstream sshd has no socket activation. Then it restarts ssh.service.
6. It checks that the running process is /opt/openssh-10.6p2/sbin/sshd and that the banner reads SSH-2.0-OpenSSH_10.6. If either check fails, it rolls back on its own.

Install

curl -fsSLO https://tools.ch-j.de/files/tools/chj-openssh-10.6.sh
echo "cdf3031a0b64db3e3bf3c83d31bd746aee5505757b1af5e137750326ed8d7a01  chj-openssh-10.6.sh" | sha256sum -c -
less chj-openssh-10.6.sh          # read it before running it as root
sudo bash chj-openssh-10.6.sh install

Then open a new SSH connection. Close the old session only after the new login works.

Check and roll back

sudo bash chj-openssh-10.6.sh status     # running binary, ssh.socket, banner
sudo bash chj-openssh-10.6.sh rollback   # back to the distribution sshd

Rollback removes the drop-in, re-enables ssh.socket if it was enabled before, and restarts the distribution sshd. The build in /opt/openssh-10.6p2 stays on disk until you delete it. After a rollback, ssh-mldsa44-ed25519 keys no longer work on that server.

Then in CH-J Tools

Connect to the server again. In Users, you can now add an ssh-mldsa44-ed25519 key from the Keychain. If the server still reports an older version, CH-J Tools says "OpenSSH 10.6 or newer is required" and does not add the key.