diff --git a/sdk_container/src/third_party/coreos-overlay/metadata/md5-cache/net-misc/openssh-7.7_p1-r9 b/sdk_container/src/third_party/coreos-overlay/metadata/md5-cache/net-misc/openssh-7.7_p1-r9
deleted file mode 100644
index f68e2db410..0000000000
--- a/sdk_container/src/third_party/coreos-overlay/metadata/md5-cache/net-misc/openssh-7.7_p1-r9
+++ /dev/null
@@ -1,15 +0,0 @@
-DEFINED_PHASES=configure install postinst preinst prepare pretend test
-DEPEND=!static? ( audit? ( sys-process/audit ) ldns? ( net-libs/ldns[ecdsa,ssl(+),static-libs(+)] ) libedit? ( dev-libs/libedit:= ) sctp? ( net-misc/lksctp-tools ) selinux? ( >=sys-libs/libselinux-1.28 ) skey? ( >=sys-auth/skey-1.1.5-r1 ) ssl? ( !libressl? ( >=dev-libs/openssl-1.0.1:0=[-bindist(-)] dev-libs/openssl:0= ) libressl? ( dev-libs/libressl:0= ) ) >=sys-libs/zlib-1.2.3:= ) pam? ( virtual/pam ) kerberos? ( virtual/krb5 ) static? ( audit? ( sys-process/audit[static-libs(+)] ) ldns? ( net-libs/ldns[ecdsa,ssl(+),static-libs(+)] ) libedit? ( dev-libs/libedit:=[static-libs(+)] ) sctp? ( net-misc/lksctp-tools[static-libs(+)] ) selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] ) skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] ) ssl? ( !libressl? ( >=dev-libs/openssl-1.0.1:0=[-bindist(-)] dev-libs/openssl:0=[static-libs(+)] ) libressl? ( dev-libs/libressl:0=[static-libs(+)] ) ) >=sys-libs/zlib-1.2.3:=[static-libs(+)] ) virtual/pkgconfig virtual/os-headers sys-devel/autoconf >=app-portage/elt-patches-20170815 !<sys-devel/gettext-0.18.1.1-r3 || ( >=sys-devel/automake-1.16.1:1.16 >=sys-devel/automake-1.15.1:1.15 ) >=sys-devel/autoconf-2.69 >=sys-devel/libtool-2.4 virtual/pkgconfig
-DESCRIPTION=Port of OpenBSD's free SSH release
-EAPI=6
-HOMEPAGE=https://www.openssh.com/
-IUSE=abi_mips_n32 audit debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux skey +ssl static test X X509
-KEYWORDS=alpha amd64 arm arm64 hppa ia64 m68k ~mips ppc ppc64 s390 sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris
-LICENSE=BSD GPL-2
-RDEPEND=!static? ( audit? ( sys-process/audit ) ldns? ( net-libs/ldns[ecdsa,ssl(+),static-libs(+)] ) libedit? ( dev-libs/libedit:= ) sctp? ( net-misc/lksctp-tools ) selinux? ( >=sys-libs/libselinux-1.28 ) skey? ( >=sys-auth/skey-1.1.5-r1 ) ssl? ( !libressl? ( >=dev-libs/openssl-1.0.1:0=[-bindist(-)] dev-libs/openssl:0= ) libressl? ( dev-libs/libressl:0= ) ) >=sys-libs/zlib-1.2.3:= ) pam? ( virtual/pam ) kerberos? ( virtual/krb5 ) pam? ( >=sys-auth/pambase-20081028 ) userland_GNU? ( virtual/shadow ) X? ( x11-apps/xauth )
-REQUIRED_USE=ldns? ( ssl ) pie? ( !static ) static? ( !kerberos !pam ) X509? ( !sctp ssl ) test? ( ssl )
-RESTRICT=!test? ( test )
-SLOT=0
-SRC_URI=mirror://openbsd/OpenSSH/portable/openssh-7.7p1.tar.gz https://dev.gentoo.org/~whissi/dist/openssh/openssh-7.7p1-patches-1.2.tar.xz sctp? ( https://dev.gentoo.org/~whissi/dist/openssh/openssh-7.7p1-sctp-1.1.patch.xz ) hpn? ( https://dev.gentoo.org/~whissi/dist/openssh/openssh-7.7p1-hpnssh14v15-gentoo2.patch.xz ) X509? ( https://dev.gentoo.org/~whissi/dist/openssh/openssh-7.7p1-x509-11.3.1.patch.xz )
-_eclasses_=autotools	1bf086cdd7356f5c9a4acd9727bd2065	desktop	b1d22ac8bdd4679ab79c71aca235009d	epatch	a1bf4756dba418a7238f3be0cb010c54	estack	43ddf5aaffa7a8d0482df54d25a66a1f	eutils	6e6c2737b59a4b982de6fb3ecefd87f8	flag-o-matic	55aaa148741116aa54ad0d80e361818e	libtool	f143db5a74ccd9ca28c1234deffede96	ltprune	08f9e1d9ee0af8f5d9a7854efbcd8c0e	multilib	b2f01ad412baf81650c23fcf0975fa33	pam	3e788d86170dfcd5b06824d898315e18	preserve-libs	ef207dc62baddfddfd39a164d9797648	systemd	71fd8d2065d102753fb9e4d20eaf3e9f	toolchain-funcs	f164325a2cdb5b3ea39311d483988861	user	8bc2845510e2109af75e3eeac607ec81	vcs-clean	2a0f74a496fa2b1552c4f3398258b7bf
-_md5_=08499a610fc3ccb2d6e5ca779fbae997
diff --git a/sdk_container/src/third_party/coreos-overlay/metadata/md5-cache/net-misc/openssh-7.9_p1-r4 b/sdk_container/src/third_party/coreos-overlay/metadata/md5-cache/net-misc/openssh-7.9_p1-r4
new file mode 100644
index 0000000000..1820ccd75e
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/metadata/md5-cache/net-misc/openssh-7.9_p1-r4
@@ -0,0 +1,15 @@
+DEFINED_PHASES=configure install postinst preinst prepare pretend test
+DEPEND=!static? ( audit? ( sys-process/audit ) ldns? ( net-libs/ldns !bindist? ( net-libs/ldns[ecdsa,ssl(+)] ) bindist? ( net-libs/ldns[-ecdsa,ssl(+)] ) ) libedit? ( dev-libs/libedit:= ) sctp? ( net-misc/lksctp-tools ) selinux? ( >=sys-libs/libselinux-1.28 ) ssl? ( !libressl? ( || ( ( >=dev-libs/openssl-1.0.1:0[bindist=] <dev-libs/openssl-1.1.0:0[bindist=] ) >=dev-libs/openssl-1.1.0g:0[bindist=] ) dev-libs/openssl:0= ) libressl? ( dev-libs/libressl:0= ) ) >=sys-libs/zlib-1.2.3:= ) pam? ( virtual/pam ) kerberos? ( virtual/krb5 ) static? ( audit? ( sys-process/audit[static-libs(+)] ) ldns? ( net-libs/ldns[static-libs(+)] !bindist? ( net-libs/ldns[ecdsa,ssl(+)] ) bindist? ( net-libs/ldns[-ecdsa,ssl(+)] ) ) libedit? ( dev-libs/libedit:=[static-libs(+)] ) sctp? ( net-misc/lksctp-tools[static-libs(+)] ) selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] ) ssl? ( !libressl? ( || ( ( >=dev-libs/openssl-1.0.1:0[bindist=] <dev-libs/openssl-1.1.0:0[bindist=] ) >=dev-libs/openssl-1.1.0g:0[bindist=] ) dev-libs/openssl:0=[static-libs(+)] ) libressl? ( dev-libs/libressl:0=[static-libs(+)] ) ) >=sys-libs/zlib-1.2.3:=[static-libs(+)] ) virtual/pkgconfig virtual/os-headers sys-devel/autoconf >=app-portage/elt-patches-20170815 !<sys-devel/gettext-0.18.1.1-r3 || ( >=sys-devel/automake-1.16.1:1.16 >=sys-devel/automake-1.15.1:1.15 ) >=sys-devel/autoconf-2.69 >=sys-devel/libtool-2.4 virtual/pkgconfig
+DESCRIPTION=Port of OpenBSD's free SSH release
+EAPI=6
+HOMEPAGE=https://www.openssh.com/
+IUSE=abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux +ssl static test X X509
+KEYWORDS=alpha amd64 arm arm64 hppa ia64 ~m68k ~mips ppc ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris
+LICENSE=BSD GPL-2
+RDEPEND=!static? ( audit? ( sys-process/audit ) ldns? ( net-libs/ldns !bindist? ( net-libs/ldns[ecdsa,ssl(+)] ) bindist? ( net-libs/ldns[-ecdsa,ssl(+)] ) ) libedit? ( dev-libs/libedit:= ) sctp? ( net-misc/lksctp-tools ) selinux? ( >=sys-libs/libselinux-1.28 ) ssl? ( !libressl? ( || ( ( >=dev-libs/openssl-1.0.1:0[bindist=] <dev-libs/openssl-1.1.0:0[bindist=] ) >=dev-libs/openssl-1.1.0g:0[bindist=] ) dev-libs/openssl:0= ) libressl? ( dev-libs/libressl:0= ) ) >=sys-libs/zlib-1.2.3:= ) pam? ( virtual/pam ) kerberos? ( virtual/krb5 ) pam? ( >=sys-auth/pambase-20081028 ) userland_GNU? ( virtual/shadow ) X? ( x11-apps/xauth )
+REQUIRED_USE=ldns? ( ssl ) pie? ( !static ) static? ( !kerberos !pam ) X509? ( !sctp ssl ) test? ( ssl )
+RESTRICT=!test? ( test )
+SLOT=0
+SRC_URI=mirror://openbsd/OpenSSH/portable/openssh-7.9p1.tar.gz https://dev.gentoo.org/~whissi/dist/openssh/openssh-7.9p1-patches-1.0.tar.xz sctp? ( https://dev.gentoo.org/~whissi/dist/openssh/openssh-7.9p1-sctp-1.2.patch.xz ) hpn? ( mirror://sourceforge/hpnssh/HPN-SSH%2014v16%207.8P1/openssh-7_8_P1-hpn-DynWinNoneSwitch-14.16.diff mirror://sourceforge/hpnssh/HPN-SSH%2014v16%207.8P1/openssh-7_8_P1-hpn-AES-CTR-14.16.diff ) X509? ( https://roumenpetrov.info/openssh/x509-11.6/openssh-7.9p1+x509-11.6.diff.gz )
+_eclasses_=autotools	1bf086cdd7356f5c9a4acd9727bd2065	desktop	b1d22ac8bdd4679ab79c71aca235009d	epatch	a1bf4756dba418a7238f3be0cb010c54	estack	43ddf5aaffa7a8d0482df54d25a66a1f	eutils	6e6c2737b59a4b982de6fb3ecefd87f8	flag-o-matic	55aaa148741116aa54ad0d80e361818e	libtool	f143db5a74ccd9ca28c1234deffede96	ltprune	08f9e1d9ee0af8f5d9a7854efbcd8c0e	multilib	b2f01ad412baf81650c23fcf0975fa33	pam	3e788d86170dfcd5b06824d898315e18	preserve-libs	ef207dc62baddfddfd39a164d9797648	systemd	71fd8d2065d102753fb9e4d20eaf3e9f	toolchain-funcs	f164325a2cdb5b3ea39311d483988861	user	8bc2845510e2109af75e3eeac607ec81	vcs-clean	2a0f74a496fa2b1552c4f3398258b7bf
+_md5_=cbb4ffd75ca44b6fac937055c57cabb0
diff --git a/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/Manifest b/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/Manifest
index 549f6b4557..46351c43fc 100644
--- a/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/Manifest
+++ b/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/Manifest
@@ -1,5 +1,6 @@
-DIST openssh-7.7p1-hpnssh14v15-gentoo2.patch.xz 22060 BLAKE2B 9ee654f689d4b90bd0fe4f71d57b4a8d9d957012be3a23ff2baa6c45ae99e2f1e4daf5de24479a6a3eb761ee6847deb3c6c3021d4cbabc9089f605d8d7270efc SHA512 856d28ac89c14d01c40c7d7e93cfaebd74b091188b5b469550eb62aa5445177aec1a5f47c1e2f7173013712e98e5f9f5e46bbb3dbd4ec7c5ee8256ef45cda0f8
-DIST openssh-7.7p1-patches-1.2.tar.xz 17584 BLAKE2B 192ec01906c911197abec4606cdf136cf26ac4ab4c405267cd98bafaea409d9d596b2b985eaeda6a1425d587d63b6f403b988f280aff989357586bf232d27712 SHA512 e646ec3674b5ef38abe823406d33c8a47c5f63fa962c41386709a7ad7115d968b70fbcf7a8f3efc67a3e80e0194e8e22a01c2342c830f99970fe02532cdee51b
-DIST openssh-7.7p1-sctp-1.1.patch.xz 7548 BLAKE2B 3b960c2377351955007005de560c2a3e8d0d059a0435e5beda14c63e444dad8b4357edaccd1cfe446c6268514f152b2bcfa7fa3612f1ae1324a31fecb0e85ac5 SHA512 093605865262a2b972db8c92990a49ed6178ed4567fb2626518c826c8472553d9be99a9e6052a6f5e545d81867b4118e9fd8a2c0c26a2739f1720b0f13282cba
-DIST openssh-7.7p1-x509-11.3.1.patch.xz 362672 BLAKE2B 55b8b0ef00dc4d962a0db1115406b7b1e84110870c74198e9e4cb081b2ffde8daca67cb281c69d73b4c5cbffde361429d62634be194b57e888a0b434a0f42a37 SHA512 f84744f6d2e5a15017bce37bfa65ebb47dbafeac07ea9aab46bdc780b4062ff70687512d9d512cab81e3b9c701adb6ce17c5474f35cb4b49f57db2e2d45ac9ac
-DIST openssh-7.7p1.tar.gz 1536900 BLAKE2B 7aee360f2cea5bfa3f8426fcbd66fde2568f05f9c8e623326b60f03b7c5f8abf223e178aa1d5958015b51627565bf5b1ace35b57f309638c908f5a7bf5500d21 SHA512 597252cb48209a0cb98ca1928a67e8d63e4275252f25bc37269204c108f034baade6ba0634e32ae63422fddd280f73096a6b31ad2f2e7a848dde75ca30e14261
+DIST openssh-7.9p1+x509-11.6.diff.gz 655819 BLAKE2B f442bb993f89782b74b0cd28906c91edfcf5b1d42a4c8135a5ccf5045e7eb000eb7aa301685b748f707506ba20e3b842d684db436872ed82b6d9b9c086879515 SHA512 0ff6ed2822aaa43cf352134b90975fb663662c5ea3d73b690601f24342ea207aecda8cdb9c1bdc3e3656fb059d842dfb3bf22646b626c303240808286103d8bc
+DIST openssh-7.9p1-patches-1.0.tar.xz 9080 BLAKE2B c14106a875b6ea0672a03f6cb292386daba96da23fed4ebd04a75f712e252bc88a25116b0b3b27446421aadf112451cb3b8a96d2f7d437e6728fe782190bc69e SHA512 7903cdb4ce5be0f1b1b741788fb372e68b0c9c1d6da0d854d8bc62e4743ad7cd13101b867b541828d3786b0857783377457e5e87ba9b63bfd9afcdbfd93ac103
+DIST openssh-7.9p1-sctp-1.2.patch.xz 7360 BLAKE2B 60e209371ecac24d0b60e48459d4d4044c0f364a2eea748cc4edd1501faec69a3c5b9e0b7db336968399ec684b6c8aceeac9196ba1ecf563ae3d660682cbc9a0 SHA512 d4d37a49cd43a3b9b7b173b0935267b84133b9b0954b7f71714ba781a6129c6d424f8b7a528dd7d4f287784c5517d57b1d6d7c6df8b5d738e34eb6dc7eae7191
+DIST openssh-7.9p1.tar.gz 1565384 BLAKE2B de15795e03d33d4f9fe4792f6b14500123230b6c00c1e5bd7207bb6d6bf6df0b2e057c1b1de0fee709f58dd159203fdd69fe1473118a6baedebaa0c1c4c55b59 SHA512 0412c9c429c9287f0794023951469c8e6ec833cdb55821bfa0300dd90d0879ff60484f620cffd93372641ab69bf0b032c2d700ccc680950892725fb631b7708e
+DIST openssh-7_8_P1-hpn-AES-CTR-14.16.diff 29231 BLAKE2B e25877c5e22f674e6db5a0bc107e5daa2509fe762fb14ce7bb2ce9a115e8177a93340c1d19247b6c2c854b7e1f9ae9af9fd932e5fa9c0a6b2ba438cd11a42991 SHA512 1867fb94c29a51294a71a3ec6a299757565a7cda5696118b0b346ed9c78f2c81bb1b888cff5e3418776b2fa277a8f070c5eb9327bb005453e2ffd72d35cdafa7
+DIST openssh-7_8_P1-hpn-DynWinNoneSwitch-14.16.diff 43356 BLAKE2B 776fa140d64a16c339b46a7c773258d2f4fe44e48b16abccad1a8757a51cb6362722fc5f42c39159af12849f5c88cf574de64815085c97157e16653f18d4909b SHA512 53f2752b7aa02719c8dfe0fe0ef16e874101ba2ba87924aa1122cd445ece218ca09c22abaa3377307f25d459579bc28d3854e2402c71b794db65d58cdd1ebc08
diff --git a/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/openssh-7.7_p1-GSSAPI-dns.patch b/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/openssh-7.8_p1-GSSAPI-dns.patch
similarity index 90%
rename from sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/openssh-7.7_p1-GSSAPI-dns.patch
rename to sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/openssh-7.8_p1-GSSAPI-dns.patch
index 2840652a9b..989dc6cee6 100644
--- a/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/openssh-7.7_p1-GSSAPI-dns.patch
+++ b/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/openssh-7.8_p1-GSSAPI-dns.patch
@@ -1,9 +1,8 @@
-https://bugs.gentoo.org/165444
-https://bugzilla.mindrot.org/show_bug.cgi?id=1008
-
+diff --git a/auth.c b/auth.c
+index 9a3bc96f..fc2c3620 100644
 --- a/auth.c
 +++ b/auth.c
-@@ -728,120 +728,6 @@ fakepw(void)
+@@ -733,120 +733,6 @@ fakepw(void)
  	return (&fake);
  }
  
@@ -122,8 +121,10 @@ https://bugzilla.mindrot.org/show_bug.cgi?id=1008
 -}
 -
  /*
-  * Runs command in a subprocess wuth a minimal environment.
+  * Runs command in a subprocess with a minimal environment.
   * Returns pid on success, 0 on failure.
+diff --git a/canohost.c b/canohost.c
+index f71a0856..3e162d8c 100644
 --- a/canohost.c
 +++ b/canohost.c
 @@ -202,3 +202,117 @@ get_local_port(int sock)
@@ -244,17 +245,19 @@ https://bugzilla.mindrot.org/show_bug.cgi?id=1008
 +		return dnsname;
 +	}
 +}
+diff --git a/readconf.c b/readconf.c
+index db5f2d54..67feffa5 100644
 --- a/readconf.c
 +++ b/readconf.c
-@@ -160,6 +160,7 @@ typedef enum {
+@@ -161,6 +161,7 @@ typedef enum {
  	oClearAllForwardings, oNoHostAuthenticationForLocalhost,
  	oEnableSSHKeysign, oRekeyLimit, oVerifyHostKeyDNS, oConnectTimeout,
  	oAddressFamily, oGssAuthentication, oGssDelegateCreds,
 +	oGssTrustDns,
  	oServerAliveInterval, oServerAliveCountMax, oIdentitiesOnly,
- 	oSendEnv, oControlPath, oControlMaster, oControlPersist,
+ 	oSendEnv, oSetEnv, oControlPath, oControlMaster, oControlPersist,
  	oHashKnownHosts,
-@@ -200,9 +201,11 @@ static struct {
+@@ -202,9 +203,11 @@ static struct {
  #if defined(GSSAPI)
  	{ "gssapiauthentication", oGssAuthentication },
  	{ "gssapidelegatecredentials", oGssDelegateCreds },
@@ -266,7 +269,7 @@ https://bugzilla.mindrot.org/show_bug.cgi?id=1008
  #endif
  #ifdef ENABLE_PKCS11
  	{ "smartcarddevice", oPKCS11Provider },
-@@ -954,6 +957,10 @@ parse_time:
+@@ -977,6 +980,10 @@ parse_time:
  		intptr = &options->gss_deleg_creds;
  		goto parse_flag;
  
@@ -277,7 +280,7 @@ https://bugzilla.mindrot.org/show_bug.cgi?id=1008
  	case oBatchMode:
  		intptr = &options->batch_mode;
  		goto parse_flag;
-@@ -1766,6 +1773,7 @@ initialize_options(Options * options)
+@@ -1818,6 +1825,7 @@ initialize_options(Options * options)
  	options->challenge_response_authentication = -1;
  	options->gss_authentication = -1;
  	options->gss_deleg_creds = -1;
@@ -285,7 +288,7 @@ https://bugzilla.mindrot.org/show_bug.cgi?id=1008
  	options->password_authentication = -1;
  	options->kbd_interactive_authentication = -1;
  	options->kbd_interactive_devices = NULL;
-@@ -1908,6 +1916,8 @@ fill_default_options(Options * options)
+@@ -1964,6 +1972,8 @@ fill_default_options(Options * options)
  		options->gss_authentication = 0;
  	if (options->gss_deleg_creds == -1)
  		options->gss_deleg_creds = 0;
@@ -294,9 +297,11 @@ https://bugzilla.mindrot.org/show_bug.cgi?id=1008
  	if (options->password_authentication == -1)
  		options->password_authentication = 1;
  	if (options->kbd_interactive_authentication == -1)
+diff --git a/readconf.h b/readconf.h
+index c5688781..af809cc8 100644
 --- a/readconf.h
 +++ b/readconf.h
-@@ -43,6 +43,7 @@ typedef struct {
+@@ -41,6 +41,7 @@ typedef struct {
  					/* Try S/Key or TIS, authentication. */
  	int     gss_authentication;	/* Try GSS authentication */
  	int     gss_deleg_creds;	/* Delegate GSS credentials */
@@ -304,9 +309,11 @@ https://bugzilla.mindrot.org/show_bug.cgi?id=1008
  	int     password_authentication;	/* Try password
  						 * authentication. */
  	int     kbd_interactive_authentication; /* Try keyboard-interactive auth. */
+diff --git a/ssh_config.5 b/ssh_config.5
+index f499396a..be758544 100644
 --- a/ssh_config.5
 +++ b/ssh_config.5
-@@ -731,6 +731,16 @@ The default is
+@@ -722,6 +722,16 @@ The default is
  Forward (delegate) credentials to the server.
  The default is
  .Cm no .
@@ -323,12 +330,14 @@ https://bugzilla.mindrot.org/show_bug.cgi?id=1008
  .It Cm HashKnownHosts
  Indicates that
  .Xr ssh 1
+diff --git a/sshconnect2.c b/sshconnect2.c
+index 10e4f0a0..4f7d49e3 100644
 --- a/sshconnect2.c
 +++ b/sshconnect2.c
-@@ -643,6 +643,13 @@ userauth_gssapi(Authctxt *authctxt)
+@@ -657,6 +657,13 @@ userauth_gssapi(Authctxt *authctxt)
  	static u_int mech = 0;
  	OM_uint32 min;
- 	int ok = 0;
+ 	int r, ok = 0;
 +	const char *gss_host;
 +
 +	if (options.gss_trust_dns) {
@@ -339,13 +348,12 @@ https://bugzilla.mindrot.org/show_bug.cgi?id=1008
  
  	/* Try one GSSAPI method at a time, rather than sending them all at
  	 * once. */
-@@ -655,7 +662,7 @@ userauth_gssapi(Authctxt *authctxt)
+@@ -669,7 +676,7 @@ userauth_gssapi(Authctxt *authctxt)
  		/* My DER encoding requires length<128 */
  		if (gss_supported->elements[mech].length < 128 &&
- 		    ssh_gssapi_check_mechanism(&gssctxt, 
+ 		    ssh_gssapi_check_mechanism(&gssctxt,
 -		    &gss_supported->elements[mech], authctxt->host)) {
 +		    &gss_supported->elements[mech], gss_host)) {
  			ok = 1; /* Mechanism works */
  		} else {
  			mech++;
--- 
diff --git a/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/openssh-7.9_p1-CVE-2018-20685.patch b/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/openssh-7.9_p1-CVE-2018-20685.patch
new file mode 100644
index 0000000000..3fa3e318af
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/openssh-7.9_p1-CVE-2018-20685.patch
@@ -0,0 +1,16 @@
+CVE-2018-20685
+
+https://github.com/openssh/openssh-portable/commit/6010c0303a422a9c5fa8860c061bf7105eb7f8b2
+
+--- a/scp.c
++++ b/scp.c
+@@ -1106,7 +1106,8 @@ sink(int argc, char **argv)
+ 			SCREWUP("size out of range");
+ 		size = (off_t)ull;
+ 
+-		if ((strchr(cp, '/') != NULL) || (strcmp(cp, "..") == 0)) {
++		if (*cp == '\0' || strchr(cp, '/') != NULL ||
++		    strcmp(cp, ".") == 0 || strcmp(cp, "..") == 0) {
+ 			run_err("error: unexpected filename: %s", cp);
+ 			exit(1);
+ 		}
diff --git a/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/openssh-7.9_p1-X509-11.6-tests.patch b/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/openssh-7.9_p1-X509-11.6-tests.patch
new file mode 100644
index 0000000000..9766b1594e
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/openssh-7.9_p1-X509-11.6-tests.patch
@@ -0,0 +1,12 @@
+diff -ur openssh-7.9p1.orig/openbsd-compat/regress/Makefile.in openssh-7.9p1/openbsd-compat/regress/Makefile.in
+--- openssh-7.9p1.orig/openbsd-compat/regress/Makefile.in	2018-10-16 17:01:20.000000000 -0700
++++ openssh-7.9p1/openbsd-compat/regress/Makefile.in	2018-12-19 11:03:14.421028691 -0800
+@@ -7,7 +7,7 @@
+ CC=@CC@
+ LD=@LD@
+ CFLAGS=@CFLAGS@
+-CPPFLAGS=-I. -I.. -I$(srcdir) -I$(srcdir)/.. @CPPFLAGS@ @DEFS@
++CPPFLAGS=-I. -I.. -I$(srcdir) -I../.. @CPPFLAGS@ @DEFS@
+ EXEEXT=@EXEEXT@
+ LIBCOMPAT=../libopenbsd-compat.a
+ LIBS=@LIBS@
diff --git a/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/openssh-7.9_p1-X509-dont-make-piddir-11.6.patch b/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/openssh-7.9_p1-X509-dont-make-piddir-11.6.patch
new file mode 100644
index 0000000000..487b239639
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/openssh-7.9_p1-X509-dont-make-piddir-11.6.patch
@@ -0,0 +1,16 @@
+--- a/openssh-7.9p1+x509-11.6.diff	2018-12-07 17:24:03.211328918 -0800
++++ b/openssh-7.9p1+x509-11.6.diff	2018-12-07 17:24:13.399262277 -0800
+@@ -40681,12 +40681,11 @@
+
+  install: $(CONFIGFILES) $(MANPAGES) $(TARGETS) install-files install-sysconf host-key check-config
+  install-nokeys: $(CONFIGFILES) $(MANPAGES) $(TARGETS) install-files install-sysconf
+-@@ -333,6 +351,8 @@
++@@ -333,6 +351,7 @@
+  	$(MKDIR_P) $(DESTDIR)$(mandir)/$(mansubdir)5
+  	$(MKDIR_P) $(DESTDIR)$(mandir)/$(mansubdir)8
+  	$(MKDIR_P) $(DESTDIR)$(libexecdir)
+ +	$(MKDIR_P) $(DESTDIR)$(sshcadir)
+-+	$(MKDIR_P) $(DESTDIR)$(piddir)
+  	$(MKDIR_P) -m 0755 $(DESTDIR)$(PRIVSEP_PATH)
+  	$(INSTALL) -m 0755 $(STRIP_OPT) ssh$(EXEEXT) $(DESTDIR)$(bindir)/ssh$(EXEEXT)
+  	$(INSTALL) -m 0755 $(STRIP_OPT) scp$(EXEEXT) $(DESTDIR)$(bindir)/scp$(EXEEXT)
diff --git a/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/openssh-7.9_p1-X509-glue-11.6.patch b/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/openssh-7.9_p1-X509-glue-11.6.patch
new file mode 100644
index 0000000000..b807ac45f7
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/openssh-7.9_p1-X509-glue-11.6.patch
@@ -0,0 +1,28 @@
+--- a/openssh-7.9p1+x509-11.6.diff	2018-12-19 10:42:01.241775036 -0800
++++ b/openssh-7.9p1+x509-11.6.diff	2018-12-19 10:43:33.383140818 -0800
+@@ -45862,7 +45862,7 @@
+  	ENGINE_register_all_complete();
+ +#endif
+  
+--#if OPENSSL_VERSION_NUMBER < 0x10001000L
++-#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
+ +	/* OPENSSL_config will load buildin engines and engines
+ +	 * specified in configuration file, i.e. method call
+ +	 * ENGINE_load_builtin_engines. Latter is only for
+@@ -81123,16 +81123,6 @@
+  		    setlocale(LC_CTYPE, "POSIX.UTF-8") != NULL))
+  			return;
+  		setlocale(LC_CTYPE, "C");
+-diff -ruN openssh-7.9p1/version.h openssh-7.9p1+x509-11.6/version.h
+---- openssh-7.9p1/version.h	2018-10-17 03:01:20.000000000 +0300
+-+++ openssh-7.9p1+x509-11.6/version.h	2018-12-18 20:07:00.000000000 +0200
+-@@ -2,5 +2,4 @@
+- 
+- #define SSH_VERSION	"OpenSSH_7.9"
+- 
+--#define SSH_PORTABLE	"p1"
+--#define SSH_RELEASE	SSH_VERSION SSH_PORTABLE
+-+#define SSH_RELEASE	PACKAGE_STRING ", " SSH_VERSION "p1"
+ diff -ruN openssh-7.9p1/version.m4 openssh-7.9p1+x509-11.6/version.m4
+ --- openssh-7.9p1/version.m4	1970-01-01 02:00:00.000000000 +0200
+ +++ openssh-7.9p1+x509-11.6/version.m4	2018-12-18 20:07:00.000000000 +0200
diff --git a/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/openssh-7.9_p1-hpn-X509-glue.patch b/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/openssh-7.9_p1-hpn-X509-glue.patch
new file mode 100644
index 0000000000..c76d454c92
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/openssh-7.9_p1-hpn-X509-glue.patch
@@ -0,0 +1,79 @@
+--- temp/openssh-7_8_P1-hpn-AES-CTR-14.16.diff.orig	2018-09-12 15:58:57.377986085 -0700
++++ temp/openssh-7_8_P1-hpn-AES-CTR-14.16.diff	2018-09-12 16:07:15.376711327 -0700
+@@ -4,8 +4,8 @@
+ +++ b/Makefile.in
+ @@ -42,7 +42,7 @@ CC=@CC@
+  LD=@LD@
+- CFLAGS=@CFLAGS@
+- CPPFLAGS=-I. -I$(srcdir) @CPPFLAGS@ $(PATHS) @DEFS@
++ CFLAGS=@CFLAGS@ $(CFLAGS_EXTRA)
++ CPPFLAGS=-I. -I$(srcdir) @CPPFLAGS@ @LDAP_CPPFLAGS@ $(PATHS) @DEFS@
+ -LIBS=@LIBS@
+ +LIBS=@LIBS@ -lpthread
+  K5LIBS=@K5LIBS@
+@@ -788,8 +788,8 @@
+  ssh_packet_set_connection(struct ssh *ssh, int fd_in, int fd_out)
+  {
+  	struct session_state *state;
+--	const struct sshcipher *none = cipher_by_name("none");
+-+	struct sshcipher *none = cipher_by_name("none");
++-	const struct sshcipher *none = cipher_none();
+++	struct sshcipher *none = cipher_none();
+  	int r;
+
+  	if (none == NULL) {
+@@ -933,9 +933,9 @@
+  	/* Portable-specific options */
+  	sUsePAM,
+ +	sDisableMTAES,
+- 	/* Standard Options */
+- 	sPort, sHostKeyFile, sLoginGraceTime,
+- 	sPermitRootLogin, sLogFacility, sLogLevel,
++ 	/* X.509 Standard Options */
++ 	sHostbasedAlgorithms,
++ 	sPubkeyAlgorithms,
+ @@ -626,6 +630,7 @@ static struct {
+  	{ "trustedusercakeys", sTrustedUserCAKeys, SSHCFG_ALL },
+  	{ "authorizedprincipalsfile", sAuthorizedPrincipalsFile, SSHCFG_ALL },
+--- temp/openssh-7_8_P1-hpn-DynWinNoneSwitch-14.16.diff.orig	2018-09-12 16:38:16.947447218 -0700
++++ temp/openssh-7_8_P1-hpn-DynWinNoneSwitch-14.16.diff	2018-09-12 16:32:35.479700864 -0700
+@@ -382,7 +382,7 @@
+ @@ -822,6 +822,10 @@ kex_choose_conf(struct ssh *ssh)
+  	int nenc, nmac, ncomp;
+  	u_int mode, ctos, need, dh_need, authlen;
+- 	int r, first_kex_follows;
++ 	int r, first_kex_follows = 0;
+ +	int auth_flag;
+ +
+ +	auth_flag = packet_authentication_state(ssh);
+@@ -1125,15 +1125,6 @@
+ index a738c3a..b32dbe0 100644
+ --- a/sshd.c
+ +++ b/sshd.c
+-@@ -373,7 +373,7 @@ sshd_exchange_identification(struct ssh *ssh, int sock_in, int sock_out)
+- 	char remote_version[256];	/* Must be at least as big as buf. */
+- 
+- 	xasprintf(&server_version_string, "SSH-%d.%d-%.100s%s%s\r\n",
+--	    PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION,
+-+	    PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE,
+- 	    *options.version_addendum == '\0' ? "" : " ",
+- 	    options.version_addendum);
+- 
+ @@ -1037,6 +1037,8 @@ listen_on_addrs(struct listenaddr *la)
+  	int ret, listen_sock;
+  	struct addrinfo *ai;
+@@ -1213,14 +1204,3 @@
+  # Example of overriding settings on a per-user basis
+  #Match User anoncvs
+  #	X11Forwarding no
+-diff --git a/version.h b/version.h
+-index f1bbf00..21a70c2 100644
+---- a/version.h
+-+++ b/version.h
+-@@ -3,4 +3,5 @@
+- #define SSH_VERSION	"OpenSSH_7.8"
+- 
+- #define SSH_PORTABLE	"p1"
+--#define SSH_RELEASE	SSH_VERSION SSH_PORTABLE
+-+#define SSH_RELEASE	SSH_VERSION SSH_PORTABLE SSH_HPN
+-+ 
diff --git a/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/openssh-7.9_p1-hpn-glue.patch b/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/openssh-7.9_p1-hpn-glue.patch
new file mode 100644
index 0000000000..0561e38140
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/openssh-7.9_p1-hpn-glue.patch
@@ -0,0 +1,112 @@
+--- temp/openssh-7_8_P1-hpn-DynWinNoneSwitch-14.16.diff.orig	2018-09-11 17:19:19.968420409 -0700
++++ temp/openssh-7_8_P1-hpn-DynWinNoneSwitch-14.16.diff	2018-09-11 17:39:19.977535398 -0700
+@@ -409,18 +409,10 @@
+ index dcf35e6..da4ced0 100644
+ --- a/packet.c
+ +++ b/packet.c
+-@@ -920,6 +920,24 @@ ssh_set_newkeys(struct ssh *ssh, int mode)
++@@ -920,6 +920,16 @@ ssh_set_newkeys(struct ssh *ssh, int mode)
+  	return 0;
+  }
+  
+-+/* this supports the forced rekeying required for the NONE cipher */
+-+int rekey_requested = 0;
+-+void
+-+packet_request_rekeying(void)
+-+{
+-+	rekey_requested = 1;
+-+}
+-+
+ +/* used to determine if pre or post auth when rekeying for aes-ctr
+ + * and none cipher switch */
+ +int
+@@ -434,20 +426,6 @@
+  #define MAX_PACKETS	(1U<<31)
+  static int
+  ssh_packet_need_rekeying(struct ssh *ssh, u_int outbound_packet_len)
+-@@ -946,6 +964,13 @@ ssh_packet_need_rekeying(struct ssh *ssh, u_int outbound_packet_len)
+- 	if (state->p_send.packets == 0 && state->p_read.packets == 0)
+- 		return 0;
+- 
+-+	/* used to force rekeying when called for by the none
+-+         * cipher switch methods -cjr */
+-+        if (rekey_requested == 1) {
+-+                rekey_requested = 0;
+-+                return 1;
+-+        }
+-+
+- 	/* Time-based rekeying */
+- 	if (state->rekey_interval != 0 &&
+- 	    (int64_t)state->rekey_time + state->rekey_interval <= monotime())
+ diff --git a/packet.h b/packet.h
+ index 170203c..f4d9df2 100644
+ --- a/packet.h
+@@ -476,9 +454,9 @@
+  /* Format of the configuration file:
+  
+ @@ -166,6 +167,8 @@ typedef enum {
+- 	oHashKnownHosts,
+  	oTunnel, oTunnelDevice,
+  	oLocalCommand, oPermitLocalCommand, oRemoteCommand,
++ 	oDisableMTAES,
+ +	oTcpRcvBufPoll, oTcpRcvBuf, oHPNDisabled, oHPNBufferSize,
+ +	oNoneEnabled, oNoneSwitch,
+  	oVisualHostKey,
+@@ -615,9 +593,9 @@
+  	int	ip_qos_bulk;		/* IP ToS/DSCP/class for bulk traffic */
+  	SyslogFacility log_facility;	/* Facility for system logging. */
+ @@ -111,7 +115,10 @@ typedef struct {
+- 
+  	int	enable_ssh_keysign;
+  	int64_t rekey_limit;
++ 	int     disable_multithreaded; /*disable multithreaded aes-ctr*/
+ +	int     none_switch;    /* Use none cipher */
+ +	int     none_enabled;   /* Allow none to be used */
+  	int	rekey_interval;
+@@ -673,9 +651,9 @@
+  	/* Portable-specific options */
+  	if (options->use_pam == -1)
+ @@ -391,6 +400,43 @@ fill_default_server_options(ServerOptions *options)
+- 	}
+- 	if (options->permit_tun == -1)
+  		options->permit_tun = SSH_TUNMODE_NO;
++ 	if (options->disable_multithreaded == -1)
++ 		options->disable_multithreaded = 0;
+ +	if (options->none_enabled == -1)
+ +		options->none_enabled = 0;
+ +	if (options->hpn_disabled == -1)
+@@ -1092,7 +1070,7 @@
+  	xxx_host = host;
+  	xxx_hostaddr = hostaddr;
+  
+-@@ -412,6 +423,28 @@ ssh_userauth2(const char *local_user, const char *server_user, char *host,
++@@ -412,6 +423,27 @@ ssh_userauth2(const char *local_user, const char *server_user, char *host,
+  
+  	if (!authctxt.success)
+  		fatal("Authentication failed.");
+@@ -1117,10 +1095,9 @@
+ +			fprintf(stderr, "NONE cipher switch disabled when a TTY is allocated\n");
+ +		}
+ +	}
+-+
+- 	debug("Authentication succeeded (%s).", authctxt.method->name);
+- }
+  
++ #ifdef WITH_OPENSSL
++ 	if (options.disable_multithreaded == 0) {
+ diff --git a/sshd.c b/sshd.c
+ index a738c3a..b32dbe0 100644
+ --- a/sshd.c
+@@ -1217,11 +1194,10 @@
+ index f1bbf00..21a70c2 100644
+ --- a/version.h
+ +++ b/version.h
+-@@ -3,4 +3,6 @@
++@@ -3,4 +3,5 @@
+  #define SSH_VERSION	"OpenSSH_7.8"
+  
+  #define SSH_PORTABLE	"p1"
+ -#define SSH_RELEASE	SSH_VERSION SSH_PORTABLE
+-+#define SSH_HPN         "-hpn14v16"
+ +#define SSH_RELEASE	SSH_VERSION SSH_PORTABLE SSH_HPN
+ + 
diff --git a/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/openssh-7.9_p1-hpn-openssl-1.1.patch b/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/openssh-7.9_p1-hpn-openssl-1.1.patch
new file mode 100644
index 0000000000..78b7545327
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/openssh-7.9_p1-hpn-openssl-1.1.patch
@@ -0,0 +1,91 @@
+--- openssh-7.9p1.orig/cipher-ctr-mt.c	2018-10-24 20:48:00.909255466 -0000
++++ openssh-7.9p1/cipher-ctr-mt.c	2018-10-24 20:48:17.378155144 -0000
+@@ -46,7 +46,7 @@
+
+ /*-------------------- TUNABLES --------------------*/
+ /* maximum number of threads and queues */
+-#define MAX_THREADS      32
++#define MAX_THREADS      32
+ #define MAX_NUMKQ        (MAX_THREADS * 2)
+
+ /* Number of pregen threads to use */
+@@ -435,7 +435,7 @@
+ 		destp.u += AES_BLOCK_SIZE;
+ 		srcp.u += AES_BLOCK_SIZE;
+ 		len -= AES_BLOCK_SIZE;
+-		ssh_ctr_inc(ctx->iv, AES_BLOCK_SIZE);
++		ssh_ctr_inc(c->aes_counter, AES_BLOCK_SIZE);
+
+ 		/* Increment read index, switch queues on rollover */
+ 		if ((ridx = (ridx + 1) % KQLEN) == 0) {
+@@ -481,8 +481,6 @@
+ 	/* get the number of cores in the system */
+ 	/* if it's not linux it currently defaults to 2 */
+ 	/* divide by 2 to get threads for each direction (MODE_IN||MODE_OUT) */
+-	/* NB: assigning a float to an int discards the remainder which is */
+-	/* acceptable (and wanted) in this case */
+ #ifdef __linux__
+ 	cipher_threads = sysconf(_SC_NPROCESSORS_ONLN) / 2;
+ #endif /*__linux__*/
+@@ -551,16 +550,16 @@
+ 	}
+
+ 	if (iv != NULL) {
+-		memcpy(ctx->iv, iv, AES_BLOCK_SIZE);
++		memcpy(c->aes_counter, iv, AES_BLOCK_SIZE);
+ 		c->state |= HAVE_IV;
+ 	}
+
+ 	if (c->state == (HAVE_KEY | HAVE_IV)) {
+ 		/* Clear queues */
+-		memcpy(c->q[0].ctr, ctx->iv, AES_BLOCK_SIZE);
++		memcpy(c->q[0].ctr, c->aes_counter, AES_BLOCK_SIZE);
+ 		c->q[0].qstate = KQINIT;
+ 		for (i = 1; i < numkq; i++) {
+-			memcpy(c->q[i].ctr, ctx->iv, AES_BLOCK_SIZE);
++			memcpy(c->q[i].ctr, c->aes_counter, AES_BLOCK_SIZE);
+ 			ssh_ctr_add(c->q[i].ctr, i * KQLEN, AES_BLOCK_SIZE);
+ 			c->q[i].qstate = KQEMPTY;
+ 		}
+@@ -644,8 +643,22 @@
+ const EVP_CIPHER *
+ evp_aes_ctr_mt(void)
+ {
++# if OPENSSL_VERSION_NUMBER >= 0x10100000UL && !defined(LIBRESSL_VERSION_NUMBER)
++	static EVP_CIPHER *aes_ctr;
++	aes_ctr = EVP_CIPHER_meth_new(NID_undef, 16/*block*/, 16/*key*/);
++	EVP_CIPHER_meth_set_iv_length(aes_ctr, AES_BLOCK_SIZE);
++	EVP_CIPHER_meth_set_init(aes_ctr, ssh_aes_ctr_init);
++	EVP_CIPHER_meth_set_cleanup(aes_ctr, ssh_aes_ctr_cleanup);
++	EVP_CIPHER_meth_set_do_cipher(aes_ctr, ssh_aes_ctr);
++#  ifndef SSH_OLD_EVP
++	EVP_CIPHER_meth_set_flags(aes_ctr, EVP_CIPH_CBC_MODE
++				      | EVP_CIPH_VARIABLE_LENGTH
++				      | EVP_CIPH_ALWAYS_CALL_INIT
++				      | EVP_CIPH_CUSTOM_IV);
++#  endif /*SSH_OLD_EVP*/
++	return (aes_ctr);
++# else /*earlier version of openssl*/
+ 	static EVP_CIPHER aes_ctr;
+-
+ 	memset(&aes_ctr, 0, sizeof(EVP_CIPHER));
+ 	aes_ctr.nid = NID_undef;
+ 	aes_ctr.block_size = AES_BLOCK_SIZE;
+@@ -654,11 +667,12 @@
+ 	aes_ctr.init = ssh_aes_ctr_init;
+ 	aes_ctr.cleanup = ssh_aes_ctr_cleanup;
+ 	aes_ctr.do_cipher = ssh_aes_ctr;
+-#ifndef SSH_OLD_EVP
+-	aes_ctr.flags = EVP_CIPH_CBC_MODE | EVP_CIPH_VARIABLE_LENGTH |
+-	    EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CUSTOM_IV;
+-#endif
+-	return &aes_ctr;
++#  ifndef SSH_OLD_EVP
++        aes_ctr.flags = EVP_CIPH_CBC_MODE | EVP_CIPH_VARIABLE_LENGTH |
++		EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CUSTOM_IV;
++#  endif /*SSH_OLD_EVP*/
++        return &aes_ctr;
++# endif /*OPENSSH_VERSION_NUMBER*/
+ }
+
+ #endif /* defined(WITH_OPENSSL) */
diff --git a/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/openssh-7.9_p1-hpn-sctp-glue.patch b/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/openssh-7.9_p1-hpn-sctp-glue.patch
new file mode 100644
index 0000000000..a7d51ad948
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/openssh-7.9_p1-hpn-sctp-glue.patch
@@ -0,0 +1,17 @@
+--- dd/openssh-7_8_P1-hpn-DynWinNoneSwitch-14.16.diff.orig	2018-09-12 18:18:51.851536374 -0700
++++ dd/openssh-7_8_P1-hpn-DynWinNoneSwitch-14.16.diff	2018-09-12 18:19:01.116475099 -0700
+@@ -1190,14 +1190,3 @@
+  # Example of overriding settings on a per-user basis
+  #Match User anoncvs
+  #	X11Forwarding no
+-diff --git a/version.h b/version.h
+-index f1bbf00..21a70c2 100644
+---- a/version.h
+-+++ b/version.h
+-@@ -3,4 +3,5 @@
+- #define SSH_VERSION	"OpenSSH_7.8"
+- 
+- #define SSH_PORTABLE	"p1"
+--#define SSH_RELEASE	SSH_VERSION SSH_PORTABLE
+-+#define SSH_RELEASE	SSH_VERSION SSH_PORTABLE SSH_HPN
+-+ 
diff --git a/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/openssh-7.9_p1-include-stdlib.patch b/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/openssh-7.9_p1-include-stdlib.patch
new file mode 100644
index 0000000000..c5697c2b8b
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/openssh-7.9_p1-include-stdlib.patch
@@ -0,0 +1,48 @@
+diff --git a/auth-options.c b/auth-options.c
+index b05d6d6f..d1f42f04 100644
+--- a/auth-options.c
++++ b/auth-options.c
+@@ -26,6 +26,7 @@
+ #include <stdarg.h>
+ #include <ctype.h>
+ #include <limits.h>
++#include <stdlib.h>
+ 
+ #include "openbsd-compat/sys-queue.h"
+ 
+diff --git a/hmac.c b/hmac.c
+index 1c879640..a29f32c5 100644
+--- a/hmac.c
++++ b/hmac.c
+@@ -19,6 +19,7 @@
+ 
+ #include <sys/types.h>
+ #include <string.h>
++#include <stdlib.h>
+ 
+ #include "sshbuf.h"
+ #include "digest.h"
+diff --git a/krl.c b/krl.c
+index 8e2d5d5d..c32e147a 100644
+--- a/krl.c
++++ b/krl.c
+@@ -28,6 +28,7 @@
+ #include <string.h>
+ #include <time.h>
+ #include <unistd.h>
++#include <stdlib.h>
+ 
+ #include "sshbuf.h"
+ #include "ssherr.h"
+diff --git a/mac.c b/mac.c
+index 51dc11d7..3d11eba6 100644
+--- a/mac.c
++++ b/mac.c
+@@ -29,6 +29,7 @@
+ 
+ #include <string.h>
+ #include <stdio.h>
++#include <stdlib.h>
+ 
+ #include "digest.h"
+ #include "hmac.h"
diff --git a/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/openssh-7.9_p1-openssl-1.0.2-compat.patch b/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/openssh-7.9_p1-openssl-1.0.2-compat.patch
new file mode 100644
index 0000000000..c1c310e8f1
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/openssh-7.9_p1-openssl-1.0.2-compat.patch
@@ -0,0 +1,13 @@
+diff --git a/openbsd-compat/openssl-compat.c b/openbsd-compat/openssl-compat.c
+index 8b4a3627..590b66d1 100644
+--- a/openbsd-compat/openssl-compat.c
++++ b/openbsd-compat/openssl-compat.c
+@@ -76,7 +76,7 @@ ssh_OpenSSL_add_all_algorithms(void)
+ 	ENGINE_load_builtin_engines();
+ 	ENGINE_register_all_complete();
+
+-#if OPENSSL_VERSION_NUMBER < 0x10001000L
++#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
+ 	OPENSSL_config(NULL);
+ #else
+ 	OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS |
diff --git a/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/sshd-r1.confd b/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/sshd-r1.confd
new file mode 100644
index 0000000000..cf430371bf
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/sshd-r1.confd
@@ -0,0 +1,33 @@
+# /etc/conf.d/sshd: config file for /etc/init.d/sshd
+
+# Where is your sshd_config file stored?
+
+SSHD_CONFDIR="${RC_PREFIX%/}/etc/ssh"
+
+
+# Any random options you want to pass to sshd.
+# See the sshd(8) manpage for more info.
+
+SSHD_OPTS=""
+
+
+# Wait one second (length chosen arbitrarily) to see if sshd actually
+# creates a PID file, or if it crashes for some reason like not being
+# able to bind to the address in ListenAddress.
+
+#SSHD_SSD_OPTS="--wait 1000"
+
+
+# Pid file to use (needs to be absolute path).
+
+#SSHD_PIDFILE="${RC_PREFIX%/}/run/sshd.pid"
+
+
+# Path to the sshd binary (needs to be absolute path).
+
+#SSHD_BINARY="${RC_PREFIX%/}/usr/sbin/sshd"
+
+
+# Path to the ssh-keygen binary (needs to be absolute path).
+
+#SSHD_KEYGEN_BINARY="${RC_PREFIX%/}/usr/bin/ssh-keygen"
diff --git a/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/sshd-r1.initd b/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/sshd-r1.initd
new file mode 100644
index 0000000000..e91cd0116c
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/sshd-r1.initd
@@ -0,0 +1,87 @@
+#!/sbin/openrc-run
+# Copyright 1999-2019 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+extra_commands="checkconfig"
+extra_started_commands="reload"
+
+: ${SSHD_CONFDIR:=${RC_PREFIX%/}/etc/ssh}
+: ${SSHD_CONFIG:=${SSHD_CONFDIR}/sshd_config}
+: ${SSHD_PIDFILE:=${RC_PREFIX%/}/run/${SVCNAME}.pid}
+: ${SSHD_BINARY:=${RC_PREFIX%/}/usr/sbin/sshd}
+: ${SSHD_KEYGEN_BINARY:=${RC_PREFIX%/}/usr/bin/ssh-keygen}
+
+command="${SSHD_BINARY}"
+pidfile="${SSHD_PIDFILE}"
+command_args="${SSHD_OPTS} -o PidFile=${pidfile} -f ${SSHD_CONFIG}"
+
+# Wait one second (length chosen arbitrarily) to see if sshd actually
+# creates a PID file, or if it crashes for some reason like not being
+# able to bind to the address in ListenAddress (bug 617596).
+: ${SSHD_SSD_OPTS:=--wait 1000}
+start_stop_daemon_args="${SSHD_SSD_OPTS}"
+
+depend() {
+	# Entropy can be used by ssh-keygen, among other things, but
+	# is not strictly required (bug 470020).
+	use logger dns entropy
+	if [ "${rc_need+set}" = "set" ] ; then
+		: # Do nothing, the user has explicitly set rc_need
+	else
+		local x warn_addr
+		for x in $(awk '/^ListenAddress/{ print $2 }' "$SSHD_CONFIG" 2>/dev/null) ; do
+			case "${x}" in
+				0.0.0.0|0.0.0.0:*) ;;
+				::|\[::\]*) ;;
+				*) warn_addr="${warn_addr} ${x}" ;;
+			esac
+		done
+		if [ -n "${warn_addr}" ] ; then
+			need net
+			ewarn "You are binding an interface in ListenAddress statement in your sshd_config!"
+			ewarn "You must add rc_need=\"net.FOO\" to your ${RC_PREFIX%/}/etc/conf.d/sshd"
+			ewarn "where FOO is the interface(s) providing the following address(es):"
+			ewarn "${warn_addr}"
+		fi
+	fi
+}
+
+checkconfig() {
+	checkpath --mode 0755 --directory "${RC_PREFIX%/}/var/empty"
+
+	if [ ! -e "${SSHD_CONFIG}" ] ; then
+		eerror "You need an ${SSHD_CONFIG} file to run sshd"
+		eerror "There is a sample file in /usr/share/doc/openssh"
+		return 1
+	fi
+
+	${SSHD_KEYGEN_BINARY} -A || return 2
+
+	"${command}" -t ${command_args} || return 3
+}
+
+start_pre() {
+	# Make sure that the user's config isn't busted before we try
+	# to start the daemon (this will produce better error messages
+	# than if we just try to start it blindly).
+	#
+	# We always need to call checkconfig because this function will
+	# also generate any missing host key and you can start a
+	# non-running service with "restart" argument.
+	checkconfig || return $?
+}
+
+stop_pre() {
+	# If this is a restart, check to make sure the user's config
+	# isn't busted before we stop the running daemon.
+	if [ "${RC_CMD}" = "restart" ] ; then
+		checkconfig || return $?
+	fi
+}
+
+reload() {
+	checkconfig || return $?
+	ebegin "Reloading ${SVCNAME}"
+	start-stop-daemon --signal HUP --pidfile "${pidfile}"
+	eend $?
+}
diff --git a/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/sshd.socket b/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/sshd.socket
index d19f34be86..94b9533180 100644
--- a/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/sshd.socket
+++ b/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/sshd.socket
@@ -5,7 +5,6 @@ Conflicts=sshd.service
 [Socket]
 ListenStream=22
 Accept=yes
-TriggerLimitBurst=0
 
 [Install]
 WantedBy=sockets.target
diff --git a/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/openssh-7.7_p1-r9.ebuild b/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/openssh-7.9_p1-r4.ebuild
similarity index 82%
rename from sdk_container/src/third_party/coreos-overlay/net-misc/openssh/openssh-7.7_p1-r9.ebuild
rename to sdk_container/src/third_party/coreos-overlay/net-misc/openssh/openssh-7.9_p1-r4.ebuild
index 6683813ac7..0fdfa8edce 100644
--- a/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/openssh-7.7_p1-r9.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/openssh-7.9_p1-r4.ebuild
@@ -1,34 +1,41 @@
-# Copyright 1999-2018 Gentoo Foundation
+# Copyright 1999-2019 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI="6"
+EAPI=6
 
 inherit user flag-o-matic multilib autotools pam systemd
 
 # Make it more portable between straight releases
 # and _p? releases.
 PARCH=${P/_}
+#HPN_PV="${PV^^}"
+HPN_PV="7.8_P1"
 
-HPN_VER="14v15-gentoo2" HPN_PATCH="${PARCH}-hpnssh${HPN_VER}.patch.xz"
-SCTP_VER="1.1" SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
-X509_VER="11.3.1" X509_PATCH="${PARCH}-x509-${X509_VER}.patch.xz"
+HPN_VER="14.16"
+HPN_PATCHES=(
+	${PN}-${HPN_PV/./_}-hpn-DynWinNoneSwitch-${HPN_VER}.diff
+	${PN}-${HPN_PV/./_}-hpn-AES-CTR-${HPN_VER}.diff
+)
 
-PATCH_SET="openssh-7.7p1-patches-1.2"
+SCTP_VER="1.2" SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
+X509_VER="11.6" X509_PATCH="${PARCH}+x509-${X509_VER}.diff.gz"
+
+PATCH_SET="openssh-7.9p1-patches-1.0"
 
 DESCRIPTION="Port of OpenBSD's free SSH release"
 HOMEPAGE="https://www.openssh.com/"
 SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
 	https://dev.gentoo.org/~whissi/dist/${PN}/${PATCH_SET}.tar.xz
 	${SCTP_PATCH:+sctp? ( https://dev.gentoo.org/~whissi/dist/openssh/${SCTP_PATCH} )}
-	${HPN_PATCH:+hpn? ( https://dev.gentoo.org/~whissi/dist/openssh/${HPN_PATCH} )}
-	${X509_PATCH:+X509? ( https://dev.gentoo.org/~whissi/dist/openssh/${X509_PATCH} )}
+	${HPN_VER:+hpn? ( $(printf "mirror://sourceforge/hpnssh/HPN-SSH%%20${HPN_VER/./v}%%20${HPN_PV/_}/%s\n" "${HPN_PATCHES[@]}") )}
+	${X509_PATCH:+X509? ( https://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )}
 	"
 
 LICENSE="BSD GPL-2"
 SLOT="0"
-KEYWORDS="alpha amd64 arm arm64 hppa ia64 m68k ~mips ppc ppc64 s390 sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="alpha amd64 arm arm64 hppa ia64 ~m68k ~mips ppc ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
 # Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux skey +ssl static test X X509"
+IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux +ssl static test X X509"
 RESTRICT="!test? ( test )"
 REQUIRED_USE="ldns? ( ssl )
 	pie? ( !static )
@@ -39,15 +46,22 @@ REQUIRED_USE="ldns? ( ssl )
 LIB_DEPEND="
 	audit? ( sys-process/audit[static-libs(+)] )
 	ldns? (
-		net-libs/ldns[ecdsa,ssl(+),static-libs(+)]
+		net-libs/ldns[static-libs(+)]
+		!bindist? ( net-libs/ldns[ecdsa,ssl(+)] )
+		bindist? ( net-libs/ldns[-ecdsa,ssl(+)] )
 	)
 	libedit? ( dev-libs/libedit:=[static-libs(+)] )
 	sctp? ( net-misc/lksctp-tools[static-libs(+)] )
 	selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
-	skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] )
 	ssl? (
 		!libressl? (
-			>=dev-libs/openssl-1.0.1:0=[-bindist(-)]
+			|| (
+				(
+					>=dev-libs/openssl-1.0.1:0[bindist=]
+					<dev-libs/openssl-1.1.0:0[bindist=]
+				)
+				>=dev-libs/openssl-1.1.0g:0[bindist=]
+			)
 			dev-libs/openssl:0=[static-libs(+)]
 		)
 		libressl? ( dev-libs/libressl:0=[static-libs(+)] )
@@ -74,7 +88,7 @@ pkg_pretend() {
 	# than not be able to log in to their server any more
 	maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
 	local fail="
-		$(use hpn && maybe_fail hpn HPN_PATCH)
+		$(use hpn && maybe_fail hpn HPN_VER)
 		$(use sctp && maybe_fail sctp SCTP_PATCH)
 		$(use X509 && maybe_fail X509 X509_PATCH)
 	"
@@ -102,14 +116,39 @@ src_prepare() {
 	# don't break .ssh/authorized_keys2 for fun
 	sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
 
-	eapply "${FILESDIR}"/${PN}-7.7_p1-GSSAPI-dns.patch #165444 integrated into gsskex
+	eapply "${FILESDIR}"/${PN}-7.9_p1-openssl-1.0.2-compat.patch
+	eapply "${FILESDIR}"/${PN}-7.9_p1-include-stdlib.patch
+	eapply "${FILESDIR}"/${PN}-7.8_p1-GSSAPI-dns.patch #165444 integrated into gsskex
 	eapply "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
 	eapply "${FILESDIR}"/${PN}-7.5_p1-disable-conch-interop-tests.patch
 
+	if use X509 ; then
+		# patch doesn't apply due to X509 modifications
+		rm \
+			"${WORKDIR}"/patches/0001-fix-key-type-check.patch \
+			"${WORKDIR}"/patches/0002-request-rsa-sha2-cert-signatures.patch \
+			|| die
+	else
+		eapply "${FILESDIR}"/${PN}-7.9_p1-CVE-2018-20685.patch # X509 patch set includes this patch
+	fi
+
+	[[ -d ${WORKDIR}/patches ]] && eapply "${WORKDIR}"/patches
+
 	local PATCHSET_VERSION_MACROS=()
 
 	if use X509 ; then
+		pushd "${WORKDIR}" || die
+		eapply "${FILESDIR}/${P}-X509-glue-${X509_VER}.patch"
+		eapply "${FILESDIR}/${P}-X509-dont-make-piddir-${X509_VER}.patch"
+		popd || die
+
+		if use hpn ; then
+			einfo "Will disable MT AES cipher due to incompatbility caused by X509 patch set"
+			HPN_DISABLE_MTAES=1
+		fi
+
 		eapply "${WORKDIR}"/${X509_PATCH%.*}
+		eapply "${FILESDIR}"/${P}-X509-${X509_VER}-tests.patch
 
 		# We need to patch package version or any X.509 sshd will reject our ssh client
 		# with "userauth_pubkey: could not parse key: string is too large [preauth]"
@@ -124,20 +163,6 @@ src_prepare() {
 			-e "/^#define SSH_PORTABLE.*/a #define SSH_X509               \"-PKIXSSH-${X509_VER}\"" \
 			"${S}"/version.h || die "Failed to sed-in X.509 patch version"
 		PATCHSET_VERSION_MACROS+=( 'SSH_X509' )
-
-		einfo "Disabling broken X.509 agent test ..."
-		sed -i \
-			-e "/^ agent$/d" \
-			"${S}"/tests/CA/config || die "Failed to disable broken X.509 agent test"
-
-		# The following patches don't apply on top of X509 patch
-		rm "${WORKDIR}"/patch/2002_all_openssh-7.7p1_upstream_bug2840.patch || die
-		rm "${WORKDIR}"/patch/2009_all_openssh-7.7p1_make-shell-tests-portable.patch || die
-		rm "${WORKDIR}"/patch/2016_all_openssh-7.7p1_implement-EMFILE-mitigation-for-ssh-agent.patch || die
-		rm "${WORKDIR}"/patch/2025_all_openssh-7.7p1_prefer-argv0-to-ssh-when-re-executing-ssh-for-proxyjump.patch || die
-	else
-		rm "${WORKDIR}"/patch/2016_all_openssh-7.7p1-X509_implement-EMFILE-mitigation-for-ssh-agent.patch || die
-		rm "${WORKDIR}"/patch/2025_all_openssh-7.7p1-X509_prefer-argv0-to-ssh-when-re-executing-ssh-for-proxyjump.patch || die
 	fi
 
 	if use sctp ; then
@@ -156,7 +181,17 @@ src_prepare() {
 	fi
 
 	if use hpn ; then
-		eapply "${WORKDIR}"/${HPN_PATCH%.*}
+		local hpn_patchdir="${T}/${P}-hpn${HPN_VER}"
+		mkdir "${hpn_patchdir}"
+		cp $(printf -- "${DISTDIR}/%s\n" "${HPN_PATCHES[@]}") "${hpn_patchdir}"
+		pushd "${hpn_patchdir}"
+		eapply "${FILESDIR}"/${P}-hpn-glue.patch
+		use X509 && eapply "${FILESDIR}"/${P}-hpn-X509-glue.patch
+		use sctp && eapply "${FILESDIR}"/${P}-hpn-sctp-glue.patch
+		popd
+
+		eapply "${hpn_patchdir}"
+		eapply "${FILESDIR}/openssh-7.9_p1-hpn-openssl-1.1.patch"
 
 		einfo "Patching Makefile.in for HPN patch set ..."
 		sed -i \
@@ -165,7 +200,7 @@ src_prepare() {
 
 		einfo "Patching version.h to expose HPN patch set ..."
 		sed -i \
-			-e "/^#define SSH_PORTABLE/a #define SSH_HPN         \"-hpn${HPN_VER}\"" \
+			-e "/^#define SSH_PORTABLE/a #define SSH_HPN         \"-hpn${HPN_VER//./v}\"" \
 			"${S}"/version.h || die "Failed to sed-in HPN patch version"
 		PATCHSET_VERSION_MACROS+=( 'SSH_HPN' )
 
@@ -188,13 +223,6 @@ src_prepare() {
 		fi
 	fi
 
-	if use X509 || use hpn ; then
-		einfo "Patching packet.c for X509 and/or HPN patch set ..."
-		sed -i \
-			-e "s/const struct sshcipher/struct sshcipher/" \
-			"${S}"/packet.c || die "Failed to patch ssh_packet_set_connection() (packet.c)"
-	fi
-
 	if use X509 || use sctp || use hpn ; then
 		einfo "Patching sshconnect.c to use SSH_RELEASE in send_client_banner() ..."
 		sed -i \
@@ -216,8 +244,6 @@ src_prepare() {
 		-e "/#UseLogin no/d" \
 		"${S}"/sshd_config || die "Failed to remove removed UseLogin option (sshd_config)"
 
-	eapply "${WORKDIR}"/patch/*.patch
-
 	eapply_user #473004
 
 	tc-export PKG_CONFIG
@@ -263,12 +289,11 @@ src_configure() {
 		# We apply the sctp patch conditionally, so can't pass --without-sctp
 		# unconditionally else we get unknown flag warnings.
 		$(use sctp && use_with sctp)
-		$(use_with ldns)
+		$(use_with ldns ldns "${EPREFIX%/}"/usr)
 		$(use_with libedit)
 		$(use_with pam)
 		$(use_with pie)
 		$(use_with selinux)
-		$(use_with skey)
 		$(use_with ssl openssl)
 		$(use_with ssl md5-passwords)
 		$(use_with ssl ssl-engine)
@@ -365,6 +390,8 @@ src_install() {
 	emake install-nokeys DESTDIR="${D}"
 	fperms 600 /etc/ssh/sshd_config
 	dobin contrib/ssh-copy-id
+	newinitd "${FILESDIR}"/sshd-r1.initd sshd
+	newconfd "${FILESDIR}"/sshd-r1.confd sshd
 
 	newpamd "${FILESDIR}"/sshd.pam_include.2 sshd