--- ./cryptlib.h.orig	2024-10-31 00:50:21.388918000 -0400
+++ ./cryptlib.h	2024-10-31 00:50:22.228018000 -0400
@@ -1262,6 +1262,7 @@
 	CRYPT_SESSINFO_SSH_CHANNEL_ARG2,/* SSH channel argument 2 */
 	CRYPT_SESSINFO_SSH_CHANNEL_ACTIVE,/* SSH channel active */
 	CRYPT_SESSINFO_SSH_PREAUTH,		/* SSH pre-authentication value */
+	CRYPT_SESSINFO_SSH_OPTIONS,		/* SSH protocol options */
 	CRYPT_SESSINFO_TLS_OPTIONS,		/* SSL/TLS protocol options */
 		CRYPT_SESSINFO_SSL_OPTIONS = CRYPT_SESSINFO_TLS_OPTIONS,
 	CRYPT_SESSINFO_TLS_SUBPROTOCOL,	/* SSL/TLS additional sub-protocol */
@@ -1763,6 +1764,14 @@
 #define CRYPT_TLSOPTION_SUITEB_256			0x200	/*  vanish in future releases) */
 #ifdef _CRYPT_DEFINED
 #define CRYPT_TLSOPTION_MAX					0x07F	/* Defines for range checking */
+#endif /* _CRYPT_DEFINED */
+
+/* SSH protocol options. */
+
+#define CRYPT_SSHOPTION_NONE				0x000
+#define CRYPT_SSHOPTION_NONE_AUTH			0x001	/* Try none authentication */
+#ifdef _CRYPT_DEFINED
+#define CRYPT_SSHOPTION_MAX					0x01	/* Defines for range checking */
 #endif /* _CRYPT_DEFINED */
 
 /****************************************************************************
--- ./session/ssh2_authcli.c.orig	2024-10-31 00:50:21.731447000 -0400
+++ ./session/ssh2_authcli.c	2024-10-31 00:50:22.232051000 -0400
@@ -334,13 +334,22 @@
 	assert( isWritePtr( authType, sizeof( SSH_AUTHTYPE_TYPE ) ) );
 	assert( isWritePtr( furtherAuthRequired, sizeof( BOOLEAN ) ) );
 
-	REQUIRES( isShortIntegerRangeNZ( length ) );
 	REQUIRES( isBooleanValue( usedPasswordAuth ) );
 
 	/* Clear return values */
 	*authType = SSH_AUTHTYPE_NONE;
 	*furtherAuthRequired = FALSE;
 
+	if (length == 0 && GET_FLAG( sessionInfoPtr->protocolFlags, SSH_PFLAG_DUMMYUSERAUTH ) && !usedPasswordAuth)
+		{
+		CLEAR_FLAG( sessionInfoPtr->protocolFlags, SSH_PFLAG_DUMMYUSERAUTH );
+		*furtherAuthRequired = TRUE;
+		*authType = SSH_AUTHTYPE_PASSWORD;
+		return( CRYPT_OK );
+		}
+
+	REQUIRES( isShortIntegerRangeNZ( length ) );
+
 	/* Before we can try and interpret the response, we have to check for an
 	   empty response */
 	if( length >= LENGTH_SIZE && \
@@ -671,6 +680,8 @@
 								  SSH_MSG_USERAUTH_REQUEST );
 	if( cryptStatusError( status ) )
 		return( status );
+	if (passwordPtr == NULL && GET_FLAG( sessionInfoPtr->protocolFlags, SSH_PFLAG_DUMMYUSERAUTH ))
+		return( OK_SPECIAL );
 	if( usePasswordAuth )
 		{
 		/*	byte	type = SSH_MSG_USERAUTH_REQUEST
@@ -1255,6 +1266,11 @@
 	   auth required */
 	if( !hasPassword )
 		{
+		if (length == 0)
+			{
+			return( reportAuthFailure( sessionInfoPtr, SSH_AUTHTYPE_PASSWORD, 
+									   requiredAuthType, TRUE ) );
+			}
 		return( reportAuthFailure( sessionInfoPtr, SSH_AUTHTYPE_PUBKEY, 
 								   requiredAuthType, TRUE ) );
 		}
--- ./session/ssh.c.orig	2024-10-07 00:23:28.000000000 -0400
+++ ./session/ssh.c	2024-10-31 00:50:22.236542000 -0400
@@ -540,6 +540,7 @@
 			  type == CRYPT_SESSINFO_SSH_CHANNEL_ARG1 || \
 			  type == CRYPT_SESSINFO_SSH_CHANNEL_ARG2 || \
 			  type == CRYPT_SESSINFO_SSH_CHANNEL_ACTIVE || \
+			  type == CRYPT_SESSINFO_SSH_OPTIONS || \
 			  type == CRYPT_SESSINFO_SSH_PREAUTH );
 #else
 	REQUIRES( type == CRYPT_SESSINFO_SSH_PREAUTH );
@@ -561,6 +562,19 @@
 							   attributeListPtr->valueLength ) );
 		}
 #ifdef USE_SSH_EXTENDED
+	if( type == CRYPT_SESSINFO_SSH_OPTIONS )
+		{
+			int *valuePtr = ( int * ) data;
+
+			*valuePtr = CRYPT_SSHOPTION_NONE;
+			if( TEST_FLAG( sessionInfoPtr->protocolFlags, 
+						   SSH_PFLAG_DUMMYUSERAUTH ) )
+				*valuePtr |= CRYPT_SSHOPTION_NONE_AUTH;
+
+			return( CRYPT_OK );
+		}
+
+
 	if( type == CRYPT_SESSINFO_SSH_CHANNEL || \
 		type == CRYPT_SESSINFO_SSH_CHANNEL_ACTIVE )
 		{
@@ -596,6 +610,7 @@
 			  type == CRYPT_SESSINFO_SSH_CHANNEL_ARG1 || \
 			  type == CRYPT_SESSINFO_SSH_CHANNEL_ARG2 || \
 			  type == CRYPT_SESSINFO_SSH_CHANNEL_ACTIVE || \
+			  type == CRYPT_SESSINFO_SSH_OPTIONS || \
 			  type == CRYPT_SESSINFO_SSH_PREAUTH );
 #else
 	REQUIRES( type == CRYPT_SESSINFO_SSH_PREAUTH );
@@ -613,7 +628,8 @@
 #ifdef USE_SSH_EXTENDED
 	/* Get the data value if it's an integer parameter */
 	if( type == CRYPT_SESSINFO_SSH_CHANNEL || \
-		type == CRYPT_SESSINFO_SSH_CHANNEL_ACTIVE )
+		type == CRYPT_SESSINFO_SSH_CHANNEL_ACTIVE || \
+		type == CRYPT_SESSINFO_SSH_OPTIONS )
 		value = *( ( int * ) data );
 
 	/* If we're selecting a channel and there's unwritten data from a
@@ -647,6 +663,13 @@
 		return( createChannel( sessionInfoPtr ) );
 		}
 
+	if( type == CRYPT_SESSINFO_SSH_OPTIONS )
+		{
+		if (value & CRYPT_SSHOPTION_NONE_AUTH)
+			SET_FLAG( sessionInfoPtr->protocolFlags, SSH_PFLAG_DUMMYUSERAUTH );
+		return( CRYPT_OK );
+		}
+
 	/* If we 're setting the channel-active attribute, this implicitly
 	   activates or deactivates the channel rather than setting any
 	   attribute value */
@@ -778,8 +801,6 @@
 		 SESSION_PROTOCOL_FIXEDSIZECREDENTIALS,	/* Flags */
 		SSH_PORT,					/* SSH port */
 		SESSION_NEEDS_USERID |		/* Client attributes */
-			SESSION_NEEDS_PASSWORD | \
-			SESSION_NEEDS_KEYORPASSWORD | \
 			SESSION_NEEDS_PRIVKEYSIGN,
 				/* The client private key is optional, but if present it has
 				   to be signature-capable */
--- ./kernel/attr_acl.c.orig	2024-10-31 00:50:21.402631000 -0400
+++ ./kernel/attr_acl.c	2024-10-31 00:50:22.241228000 -0400
@@ -3866,6 +3866,12 @@
 		ST_NONE, ST_NONE, ST_SESS_SSH | ST_SESS_SSH_SVR, 
 		MKPERM_SSH( Rxx_RWD ),
 		ROUTE( OBJECT_TYPE_SESSION ), RANGE( 2, CRYPT_MAX_TEXTSIZE ) ),
+	MKACL_N(	/* SSH protocol options */
+		CRYPT_SESSINFO_SSH_OPTIONS,
+		ST_NONE, ST_NONE, ST_SESS_SSH, 
+		MKPERM_SESSIONS( Rxx_RWx ),
+		ROUTE( OBJECT_TYPE_SESSION ),
+		RANGE( CRYPT_SSHOPTION_NONE, CRYPT_SSHOPTION_MAX ) ),
 
 	MKACL_N(	/* TLS protocol options */
 		CRYPT_SESSINFO_TLS_OPTIONS,
@@ -4914,7 +4920,7 @@
 	static_assert( CRYPT_CERTINFO_FIRST_EXTENSION == 2200, "Attribute value" );
 	static_assert( CRYPT_CERTINFO_FIRST_CMS == 2500, "Attribute value" );
 	static_assert( CRYPT_SESSINFO_FIRST_SPECIFIC == 6017, "Attribute value" );
-	static_assert( CRYPT_SESSINFO_LAST_SPECIFIC == 6035, "Attribute value" );
+	static_assert( CRYPT_SESSINFO_LAST_SPECIFIC == 6036, "Attribute value" );
 	static_assert( CRYPT_CERTFORMAT_LAST == 13, "Attribute value" );
 
 	/* Perform a consistency check on the attribute ACLs.  The ACLs are
