97 lines
4.9 KiB
Markdown
97 lines
4.9 KiB
Markdown
# Supported Distributions
|
|
|
|
This role automatically detects your distribution and OpenSSH version, enabling advanced features when supported while maintaining backwards compatibility.
|
|
|
|
## Target Distribution List
|
|
|
|
| Distribution | Required Versions | Current Support Status | OpenSSH Version |
|
|
|--------------|-------------------|-------------------------|-----------------|
|
|
| **Debian** | 11, 12, 13, 14 | 11, 12, 13 (Stable), 14 (Testing) | 8.4p1 - 10.2p1+ |
|
|
| **Ubuntu** | 22.04, 24.04, 25.10 | 22.04 LTS, 24.04 LTS, 25.10 (Interim) | 8.9p1 - 10.0p1 |
|
|
| **Rocky** | 8, 9, 10 | 8, 9, 10 (Current) | 8.0p1 - 9.9p1 |
|
|
| **Fedora** | 43 | 43 (Current) | 9.9p1+ |
|
|
|
|
## Debian Releases
|
|
|
|
| Distribution | Release Date | Support Until | OpenSSH Version | Feature Level |
|
|
|--------------|--------------|---------------|-----------------|---------------|
|
|
| **Stretch (9)** | 2017-06 | 2022-06 (EOL) | 7.4p1 | ⚠️ Legacy - Limited features |
|
|
| **Buster (10)** | 2019-07 | 2024-06 (LTS) | 7.9p1 | ⚠️ Legacy - No FIDO2 |
|
|
| **Bullseye (11)** | 2021-08 | 2026-08 (LTS) | 8.4p1 | ✅ Modern - FIDO2 support |
|
|
| **Bookworm (12)** | 2023-06 | 2028-06 (LTS) | 9.2p1 | ✅ Modern - Full featured |
|
|
| **Trixie (13)** | 2025-08 | 2030-08 | 10.0p1 | ✅ Latest - All features |
|
|
| **Forky (14)** | TBD | Testing | 10.2p1+ | ✅ Latest - Cutting edge |
|
|
|
|
## Ubuntu LTS Releases
|
|
|
|
| Distribution | Release Date | Support Until | OpenSSH Version | Feature Level |
|
|
|--------------|--------------|---------------|-----------------|---------------|
|
|
| **22.04 Jammy** | 2022-04 | 2032-04 (ESM) | 8.9p1 | ✅ Modern - Full featured |
|
|
| **24.04 Noble** | 2024-04 | 2034-04 (ESM) | 9.6p1 | ✅ Latest - Advanced features |
|
|
|
|
## Rocky Linux (RHEL Compatible)
|
|
|
|
| Distribution | Release Date | Support Until | OpenSSH Version | Feature Level |
|
|
|--------------|--------------|---------------|-----------------|---------------|
|
|
| **Rocky Linux 8** | 2021-06 | 2029-05 | 8.0p1 | ⚠️ Legacy - No FIDO2 |
|
|
| **Rocky Linux 9** | 2022-07 | 2032-05 | 8.7p1 | ✅ Modern - FIDO2 + LogVerbose |
|
|
| **Rocky Linux 10** | 2025-06 | 2035-05 | 9.9p1 | ✅ Latest - Post-quantum ready |
|
|
|
|
## Fedora Releases
|
|
|
|
| Distribution | Release Date | Support Until | OpenSSH Version | Feature Level |
|
|
|--------------|--------------|---------------|-----------------|---------------|
|
|
| **Fedora 43** | 2025-10 | 2026-11 | 9.9p1+ | ✅ Latest - Cutting edge |
|
|
|
|
### Point Release Status (Jan 2026)
|
|
- **Debian**: 11.11, 12.12, 13.2
|
|
- **Rocky Linux**: 8.10, 9.7, 10.1
|
|
|
|
## Ubuntu Non-LTS Releases (Current Only)
|
|
|
|
| Distribution | Release Date | Support Until | OpenSSH Version | Feature Level |
|
|
|--------------|--------------|---------------|-----------------|---------------|
|
|
| **25.10 Questing** | 2025-10 | 2026-07 | 10.0p1 | ✅ Latest - Cutting edge |
|
|
|
|
### Non-LTS Support Policy
|
|
|
|
- ✅ We support **current and upcoming** non-LTS releases only
|
|
- ❌ We do **NOT** support EOL non-LTS releases (no security updates)
|
|
- ⏰ Non-LTS releases have a **9-month support window**
|
|
- 📋 For production use, we **strongly recommend Ubuntu LTS releases**
|
|
|
|
## Legend
|
|
|
|
- ✅ **Latest**: OpenSSH 9.6+ with post-quantum crypto readiness
|
|
- ✅ **Modern**: OpenSSH 8.2+ with FIDO2 hardware key support
|
|
- ⚠️ **Legacy**: Older OpenSSH with limited modern features (still supported)
|
|
- **ESM**: Extended Security Maintenance (Ubuntu Pro required for 16.04/18.04)
|
|
|
|
## Version Detection
|
|
|
|
The role automatically detects your OpenSSH version using `ssh -V` and sets capability flags that control which features are enabled. This ensures older distributions don't encounter errors when using directives they don't support.
|
|
|
|
**Note**: The role will display warnings when running on EOL or ESM distributions and automatically disable unsupported features.
|
|
|
|
## Capability Flags
|
|
|
|
The role sets 13 version-specific capability flags:
|
|
|
|
| Flag | Minimum Version | Feature Enabled |
|
|
|------|-----------------|-----------------|
|
|
| `openssh_has_disable_forwarding` | 7.4 | DisableForwarding directive |
|
|
| `openssh_has_ca_signature_algorithms` | 7.9 | CASignatureAlgorithms directive |
|
|
| `openssh_has_fido2` | 8.2 | FIDO2/WebAuthn security keys |
|
|
| `openssh_has_include` | 8.2 | Include directive support |
|
|
| `openssh_has_log_verbose` | 8.5 | LogVerbose directive |
|
|
| `openssh_has_required_rsa_size` | 9.3 | RequiredRSASize directive |
|
|
| `openssh_has_persourcepenalties` | 9.8 | PerSourcePenalties directive |
|
|
| `openssh_has_mlkem` | 9.9 | ML-KEM post-quantum KEX |
|
|
| `openssh_has_rsa_sha2` | 7.2 | RSA-SHA2 signature algorithms |
|
|
| `openssh_has_modern_kex` | 7.4 | Modern key exchange algorithms |
|
|
| `openssh_blocks_dsa_ca` | 7.9 | DSA CA keys blocked |
|
|
| `openssh_removes_dsa` | 9.6 | DSA completely removed |
|
|
| `openssh_dh_disabled_default` | 10.0 | DH disabled by default |
|
|
|
|
These flags are set automatically in [tasks/main.yml](../tasks/main.yml) and used throughout [templates/sshd_config.j2](../templates/sshd_config.j2) to enable features only when supported.
|