NameDateSize

..27-Aug-20236

.dependH A D07-Jan-2024131.6 KiB

.git_allowed_signersH A D21-Oct-2022997

.git_allowed_signers.ascH A D21-Oct-2022833

.github/H19-Mar-20248

.gitignoreH A D19-Mar-2024465

.skipped-commit-idsH A D19-Mar-20243.3 KiB

aclocal.m4H A D07-Feb-2023694

addr.cH A D11-Aug-202310 KiB

addr.hH A D07-Feb-20232.4 KiB

addrmatch.cH A D08-Sep-20214.4 KiB

atomicio.cH A D14-Apr-20224.7 KiB

atomicio.hH A D08-Sep-20212.2 KiB

audit-bsm.cH A D08-Sep-202111.7 KiB

audit-linux.cH A D08-Sep-20213.4 KiB

audit.cH A D08-Sep-20215.7 KiB

audit.hH A D08-Sep-20212.3 KiB

auth-bsdauth.cH A D08-Sep-20213.6 KiB

auth-krb5.cH A D08-Sep-20216.9 KiB

auth-options.cH A D11-Aug-202323.5 KiB

auth-options.hH A D08-Sep-20213.1 KiB

auth-pam.cH A D11-Aug-202336.8 KiB

auth-pam.hH A D08-Sep-20211.9 KiB

auth-passwd.cH A D08-Sep-20216.4 KiB

auth-rhosts.cH A D07-Feb-20239.2 KiB

auth-shadow.cH A D17-Mar-20234.3 KiB

auth-sia.cH A D22-Jun-20213.2 KiB

auth-sia.hH A D22-Jun-20211.4 KiB

auth.cH A D17-Mar-202324.4 KiB

auth.hH A D21-Oct-20228.2 KiB

auth2-chall.cH A D08-Sep-20219.5 KiB

auth2-gss.cH A D11-Aug-20239.8 KiB

auth2-hostbased.cH A D17-Mar-20237.8 KiB

auth2-kbdint.cH A D14-Apr-20222.2 KiB

auth2-none.cH A D17-Mar-20232.3 KiB

auth2-passwd.cH A D21-Oct-20222.4 KiB

auth2-pubkey.cH A D11-Aug-202323.8 KiB

auth2-pubkeyfile.cH A D17-Mar-202313.7 KiB

auth2.cH A D07-Jan-202423.2 KiB

authfd.cH A D07-Jan-202419.6 KiB

authfd.hH A D07-Jan-20244.1 KiB

authfile.cH A D17-Mar-202312.5 KiB

authfile.hH A D08-Sep-20212.4 KiB

bitmap.cH A D22-Jun-20214.4 KiB

bitmap.hH A D22-Jun-20211.9 KiB

blacklist.cH A D15-Sep-20212.8 KiB

blacklist_client.hH A D15-Sep-20212.1 KiB

buildpkg.sh.inH A D08-Sep-202117.6 KiB

canohost.cH A D11-Aug-20234.8 KiB

canohost.hH A D22-Jun-2021842

chacha.cH A D11-Aug-20235.3 KiB

chacha.hH A D08-Sep-2021994

ChangeLogH A D19-Mar-2024271.6 KiB

channels.cH A D19-Mar-2024146 KiB

channels.hH A D07-Jan-202415 KiB

cipher-aes.cH A D11-Aug-20234.5 KiB

cipher-aesctr.cH A D22-Jun-20212.1 KiB

cipher-aesctr.hH A D22-Jun-20211.3 KiB

cipher-chachapoly-libcrypto.cH A D11-Aug-20234.9 KiB

cipher-chachapoly.cH A D11-Aug-20234.1 KiB

cipher-chachapoly.hH A D08-Sep-20211.6 KiB

cipher.cH A D07-Jan-202412.9 KiB

cipher.hH A D07-Jan-20243.2 KiB

cleanup.cH A D22-Jun-20211 KiB

clientloop.cH A D19-Mar-202483 KiB

clientloop.hH A D08-Sep-20213.7 KiB

compat.cH A D17-Mar-20235.1 KiB

compat.hH A D17-Mar-20232.5 KiB

config.guessH A D07-Feb-202348.8 KiB

config.hH A D19-Mar-202456.3 KiB

config.subH A D07-Feb-202335 KiB

configure.acH A D19-Mar-2024156.9 KiB

contrib/H11-Aug-202318

CREDITSH A D08-Sep-20215.4 KiB

crypto_api.hH A D07-Feb-20231.7 KiB

defines.hH A D14-Apr-202223.7 KiB

dh.cH A D08-Sep-202115.4 KiB

dh.hH A D08-Sep-20212.7 KiB

digest-libc.cH A D14-Apr-20226.1 KiB

digest-openssl.cH A D08-Sep-20214.9 KiB

digest.hH A D22-Jun-20212.5 KiB

dispatch.cH A D17-Mar-20233.5 KiB

dispatch.hH A D08-Sep-20212 KiB

dns.cH A D17-Mar-20238.9 KiB

dns.hH A D17-Mar-20232.1 KiB

ed25519.cH A D07-Feb-2023196.8 KiB

ed25519.shH A D07-Feb-20234.1 KiB

entropy.cH A D07-Feb-20233 KiB

entropy.hH A D22-Jun-20211.5 KiB

fatal.cH A D08-Sep-20211.8 KiB

fixalgorithmsH A D22-Jun-2021422

fixpathsH A D22-Jun-2021499

freebsd-configure.shH A D23-Apr-20221.8 KiB

freebsd-namespace.shH A D23-Apr-20221.9 KiB

FREEBSD-upgradeH A D19-Mar-20246.2 KiB

groupaccess.cH A D08-Sep-20213.5 KiB

groupaccess.hH A D22-Jun-20211.5 KiB

gss-genr.cH A D19-Mar-20247.9 KiB

gss-serv-krb5.cH A D22-Jun-20215.6 KiB

gss-serv.cH A D11-Aug-202310.3 KiB

hash.cH A D08-Sep-2021781

hmac.cH A D08-Sep-20215.1 KiB

hmac.hH A D22-Jun-20211.6 KiB

hostfile.cH A D17-Mar-202324.7 KiB

hostfile.hH A D08-Sep-20214.4 KiB

includes.hH A D14-Apr-20223.8 KiB

INSTALLH A D11-Aug-202310 KiB

install-shH A D07-Feb-202315 KiB

kex.cH A D19-Mar-202443.9 KiB

kex.hH A D19-Mar-20249 KiB

kexc25519.cH A D08-Sep-20215.7 KiB

kexdh.cH A D08-Sep-20215 KiB

kexecdh.cH A D08-Sep-20216.1 KiB

kexgen.cH A D14-Apr-202210.4 KiB

kexgex.cH A D08-Sep-20213.7 KiB

kexgexc.cH A D14-Apr-20227 KiB

kexgexs.cH A D11-Aug-20236.3 KiB

kexsntrup761x25519.cH A D14-Apr-20227.6 KiB

krb5_config.hH A D23-Apr-2022299

krl.cH A D11-Aug-202335.6 KiB

krl.hH A D11-Aug-20232.7 KiB

LICENCEH A D21-Oct-202218.1 KiB

log.cH A D07-Jan-202412 KiB

log.hH A D08-Sep-20217 KiB

loginrec.cH A D14-Apr-202242.1 KiB

loginrec.hH A D08-Sep-20214.6 KiB

logintest.cH A D08-Sep-20218.5 KiB

m4/H19-Mar-20243

mac.cH A D08-Sep-20217.2 KiB

mac.hH A D22-Jun-20212 KiB

Makefile.inH A D07-Jan-202429.2 KiB

match.cH A D11-Aug-20239.6 KiB

match.hH A D08-Sep-20211.2 KiB

mdoc2man.awkH A D22-Jun-20218.4 KiB

misc.cH A D19-Mar-202466 KiB

misc.hH A D19-Mar-20248.9 KiB

mkinstalldirsH A D22-Jun-2021633

moduliH A D07-Jan-2024605.6 KiB

moduli.5H A D21-Oct-20223.6 KiB

moduli.cH A D17-Mar-202320.7 KiB

monitor.cH A D10-Oct-202351.8 KiB

monitor.hH A D08-Sep-20213.9 KiB

monitor_fdpass.cH A D08-Sep-20214.6 KiB

monitor_fdpass.hH A D22-Jun-20211.5 KiB

monitor_wrap.cH A D07-Jan-202426 KiB

monitor_wrap.hH A D21-Oct-20223.8 KiB

msg.cH A D08-Sep-20212.7 KiB

msg.hH A D22-Jun-20211.5 KiB

mux.cH A D07-Jan-202462.8 KiB

myproposal.hH A D16-Apr-20223.7 KiB

nchan.cH A D19-Mar-202411.8 KiB

nchan.msH A D22-Jun-20213.9 KiB

nchan2.msH A D22-Jun-20213.4 KiB

openbsd-compat/H19-Mar-2024120

openssh.xml.inH A D22-Jun-20212.8 KiB

opensshd.init.inH A D20-Dec-20211.2 KiB

OVERVIEWH A D08-Sep-20216.2 KiB

packet.cH A D19-Dec-202372.3 KiB

packet.hH A D19-Dec-20237.6 KiB

pathnames.hH A D23-Apr-20226 KiB

pkcs11.hH A D22-Jun-202141.4 KiB

platform-misc.cH A D22-Jun-20211.1 KiB

platform-pledge.cH A D22-Jun-20211.9 KiB

platform-tracing.cH A D10-Nov-20222.5 KiB

platform.cH A D16-Apr-20225.8 KiB

platform.hH A D16-Apr-20221.5 KiB

poly1305.cH A D11-Aug-20234.5 KiB

poly1305.hH A D22-Jun-2021645

progressmeter.cH A D11-Aug-20237.5 KiB

progressmeter.hH A D08-Sep-20211.5 KiB

PROTOCOLH A D19-Mar-202427.8 KiB

PROTOCOL.agentH A D19-Mar-20244.2 KiB

PROTOCOL.certkeysH A D08-Sep-202112.8 KiB

PROTOCOL.chacha20poly1305H A D08-Sep-20214.5 KiB

PROTOCOL.keyH A D21-Oct-20221.6 KiB

PROTOCOL.krlH A D11-Aug-20236.9 KiB

PROTOCOL.muxH A D19-Mar-20248.8 KiB

PROTOCOL.sshsigH A D08-Sep-20213.3 KiB

PROTOCOL.u2fH A D08-Sep-202110.8 KiB

readconf.cH A D19-Mar-2024104.2 KiB

readconf.hH A D19-Mar-20249 KiB

READMEH A D19-Mar-20242.1 KiB

README.dnsH A D08-Sep-20211.6 KiB

README.mdH A D17-Mar-20235.1 KiB

README.platformH A D19-Mar-20244 KiB

README.privsepH A D08-Sep-20212.2 KiB

README.tunH A D22-Jun-20214.8 KiB

readpass.cH A D21-Oct-20228.3 KiB

regress/H19-Mar-2024127

rijndael.cH A D22-Jun-202151.6 KiB

rijndael.hH A D14-Apr-20222 KiB

sandbox-capsicum.cH A D21-Oct-20223.4 KiB

sandbox-darwin.cH A D08-Sep-20212.5 KiB

sandbox-null.cH A D22-Jun-20211.6 KiB

sandbox-pledge.cH A D08-Sep-20211.8 KiB

sandbox-rlimit.cH A D08-Sep-20212.4 KiB

sandbox-seccomp-filter.cH A D17-Mar-202315.8 KiB

sandbox-solaris.cH A D22-Jun-20212.9 KiB

sandbox-systrace.cH A D08-Sep-20216.3 KiB

scp.1H A D07-Feb-20237.9 KiB

scp.cH A D07-Jan-202453.5 KiB

SECURITY.mdH A D14-Apr-2022163

servconf.cH A D19-Mar-202496.7 KiB

servconf.hH A D10-Oct-202311.7 KiB

serverloop.cH A D10-Oct-202328.6 KiB

serverloop.hH A D22-Jun-20211,000

session.cH A D19-Mar-202467.9 KiB

session.hH A D07-Feb-20232.6 KiB

sftp-client.cH A D07-Jan-202479 KiB

sftp-client.hH A D10-Oct-20236.5 KiB

sftp-common.cH A D11-Aug-20236.9 KiB

sftp-common.hH A D21-Oct-20222.1 KiB

sftp-glob.cH A D10-Oct-20234.3 KiB

sftp-realpath.cH A D20-Dec-20216 KiB

sftp-server-main.cH A D21-Oct-20221.4 KiB

sftp-server.8H A D08-Sep-20215 KiB

sftp-server.cH A D11-Aug-202351.9 KiB

sftp-usergroup.cH A D10-Oct-20235.5 KiB

sftp-usergroup.hH A D21-Oct-20221.1 KiB

sftp.1H A D07-Feb-202316.9 KiB

sftp.cH A D19-Mar-202463.7 KiB

sftp.hH A D22-Jun-20213.3 KiB

sk-api.hH A D21-Oct-20222.9 KiB

sk-usbhid.cH A D11-Aug-202338.3 KiB

sk_config.hH A D21-Oct-2022338

smult_curve25519_ref.cH A D22-Jun-20216.7 KiB

sntrup761.cH A D07-Feb-202325.3 KiB

sntrup761.shH A D07-Feb-20232.8 KiB

srclimit.cH A D08-Sep-20213.8 KiB

srclimit.hH A D08-Sep-2021895

ssh-add.1H A D19-Mar-202410.5 KiB

ssh-add.cH A D19-Mar-202427 KiB

ssh-agent.1H A D10-Oct-20238.1 KiB

ssh-agent.cH A D19-Mar-202465.6 KiB

ssh-dss.cH A D19-Mar-202411.8 KiB

ssh-ecdsa-sk.cH A D17-Mar-202313.6 KiB

ssh-ecdsa.cH A D17-Mar-202312.1 KiB

ssh-ed25519-sk.cH A D07-Feb-20237.6 KiB

ssh-ed25519.cH A D07-Feb-20237.8 KiB

ssh-gss.hH A D23-Apr-20224.7 KiB

ssh-keygen.1H A D08-Sep-202341 KiB

ssh-keygen.cH A D19-Mar-2024106.7 KiB

ssh-keyscan.1H A D17-Mar-20234.7 KiB

ssh-keyscan.cH A D19-Mar-202420.2 KiB

ssh-keysign.8H A D16-Apr-20222.9 KiB

ssh-keysign.cH A D19-Mar-20248.1 KiB

ssh-pkcs11-client.cH A D19-Mar-202417.2 KiB

ssh-pkcs11-helper.8H A D21-Oct-20221.7 KiB

ssh-pkcs11-helper.cH A D14-Apr-202210.5 KiB

ssh-pkcs11.cH A D11-Aug-202347.3 KiB

ssh-pkcs11.hH A D07-Jan-20241.7 KiB

ssh-rsa.cH A D17-Mar-202319.6 KiB

ssh-sandbox.hH A D22-Jun-20211.1 KiB

ssh-sk-client.cH A D14-Apr-202211.2 KiB

ssh-sk-helper.8H A D21-Oct-20221.7 KiB

ssh-sk-helper.cH A D07-Feb-202310 KiB

ssh-sk.cH A D11-Aug-202322.5 KiB

ssh-sk.hH A D14-Apr-20222.7 KiB

ssh-xmss.cH A D11-Aug-202310.1 KiB

ssh.1H A D07-Jan-202446.3 KiB

ssh.cH A D19-Mar-202472.6 KiB

ssh.hH A D08-Sep-20212.8 KiB

ssh2.hH A D07-Jan-20245.8 KiB

ssh_api.cH A D19-Mar-202414.8 KiB

ssh_api.hH A D22-Jun-20214.3 KiB

ssh_configH A D11-Aug-20231.5 KiB

ssh_config.5H A D19-Mar-202466.5 KiB

ssh_namespace.hH A D19-Mar-202451.5 KiB

sshbuf-getput-basic.cH A D21-Oct-202212.2 KiB

sshbuf-getput-crypto.cH A D19-Mar-20244.4 KiB

sshbuf-io.cH A D08-Sep-20212.7 KiB

sshbuf-misc.cH A D14-Apr-20227 KiB

sshbuf.cH A D07-Feb-20239.8 KiB

sshbuf.hH A D07-Feb-202313.5 KiB

sshconnect.cH A D19-Mar-202449 KiB

sshconnect.hH A D07-Jan-20243.2 KiB

sshconnect2.cH A D19-Mar-202465 KiB

sshd.8H A D10-Oct-202332.1 KiB

sshd.cH A D19-Mar-202469.2 KiB

sshd_configH A D19-Mar-20243.2 KiB

sshd_config.5H A D19-Mar-202459.4 KiB

ssherr.cH A D08-Sep-20215.2 KiB

ssherr.hH A D08-Sep-20213.4 KiB

sshkey-xmss.cH A D07-Feb-202329.7 KiB

sshkey-xmss.hH A D07-Feb-20232.9 KiB

sshkey.cH A D19-Mar-202491.1 KiB

sshkey.hH A D11-Aug-202312.3 KiB

sshlogin.cH A D21-Oct-20225.3 KiB

sshlogin.hH A D22-Jun-2021935

sshpty.cH A D08-Sep-20215.7 KiB

sshpty.hH A D22-Jun-20211 KiB

sshsig.cH A D19-Mar-202429.4 KiB

sshsig.hH A D14-Apr-20224 KiB

sshtty.cH A D22-Jun-20212.9 KiB

survey.sh.inH A D22-Jun-20211.7 KiB

TODOH A D22-Jun-20212.5 KiB

ttymodes.cH A D08-Sep-20219.7 KiB

ttymodes.hH A D22-Jun-20214.9 KiB

uidswap.cH A D08-Sep-20217.3 KiB

uidswap.hH A D22-Jun-2021680

umac.cH A D17-Mar-202344.9 KiB

umac.hH A D14-Apr-20224.6 KiB

umac128.cH A D23-Apr-2022398

utf8.cH A D08-Sep-20218.2 KiB

utf8.hH A D08-Sep-20211.3 KiB

version.hH A D19-Mar-2024219

xmalloc.cH A D16-Apr-20222.5 KiB

xmalloc.hH A D08-Sep-20211.1 KiB

xmss_commons.cH A D08-Sep-2021631

xmss_commons.hH A D22-Jun-2021450

xmss_fast.cH A D08-Sep-202132.2 KiB

xmss_fast.hH A D22-Jun-20213.6 KiB

xmss_hash.cH A D19-Mar-20243.3 KiB

xmss_hash.hH A D22-Jun-2021841

xmss_hash_address.cH A D08-Sep-20211.2 KiB

xmss_hash_address.hH A D22-Jun-2021836

xmss_wots.cH A D08-Sep-20214.7 KiB

xmss_wots.hH A D22-Jun-20211.9 KiB

README

1See https://www.openssh.com/releasenotes.html#9.7p1 for the release
2notes.
3
4Please read https://www.openssh.com/report.html for bug reporting
5instructions and note that we do not use Github for bug reporting or
6patch/pull-request management.
7
8This is the port of OpenBSD's excellent OpenSSH[0] to Linux and other
9Unices.
10
11OpenSSH is based on the last free version of Tatu Ylonen's sample
12implementation with all patent-encumbered algorithms removed (to
13external libraries), all known security bugs fixed, new features
14reintroduced and many other clean-ups.  OpenSSH has been created by
15Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos, Theo de Raadt,
16and Dug Song. It has a homepage at https://www.openssh.com/
17
18This port consists of the re-introduction of autoconf support, PAM
19support, EGD/PRNGD support and replacements for OpenBSD library
20functions that are (regrettably) absent from other unices. This port
21has been best tested on AIX, Cygwin, HP-UX, Linux, MacOS/X,
22FreeBSD, NetBSD, OpenBSD, OpenServer, Solaris and UnixWare.
23
24This version actively tracks changes in the OpenBSD CVS repository.
25
26The PAM support is now more functional than the popular packages of
27commercial ssh-1.2.x. It checks "account" and "session" modules for
28all logins, not just when using password authentication.
29
30There is now several mailing lists for this port of OpenSSH. Please
31refer to https://www.openssh.com/list.html for details on how to join.
32
33Please send bug reports and patches to https://bugzilla.mindrot.org or
34the mailing list openssh-unix-dev@mindrot.org.  To mitigate spam, the
35list only allows posting from subscribed addresses.  Code contribution
36are welcomed, but please follow the OpenBSD style guidelines[1].
37
38Please refer to the INSTALL document for information on dependencies and
39how to install OpenSSH on your system.
40
41Damien Miller <djm@mindrot.org>
42
43Miscellania -
44
45This version of OpenSSH is based upon code retrieved from the OpenBSD CVS
46repository which in turn was based on the last free sample implementation
47released by Tatu Ylonen.
48
49References -
50
51[0] https://www.openssh.com/
52[1] https://man.openbsd.org/style.9
53
54

README.dns

1How to verify host keys using OpenSSH and DNS
2---------------------------------------------
3
4OpenSSH contains support for verifying host keys using DNS as described
5in https://tools.ietf.org/html/rfc4255. The document contains very brief
6instructions on how to use this feature. Configuring DNS is out of the
7scope of this document.
8
9
10(1) Server: Generate and publish the DNS RR
11
12To create a DNS resource record (RR) containing a fingerprint of the
13public host key, use the following command:
14
15	ssh-keygen -r hostname -f keyfile -g
16
17where "hostname" is your fully qualified hostname and "keyfile" is the
18file containing the public host key file. If you have multiple keys,
19you should generate one RR for each key.
20
21In the example above, ssh-keygen will print the fingerprint in a
22generic DNS RR format parsable by most modern name server
23implementations. If your nameserver has support for the SSHFP RR
24you can omit the -g flag and ssh-keygen will print a standard SSHFP RR.
25
26To publish the fingerprint using the DNS you must add the generated RR
27to your DNS zone file and sign your zone.
28
29
30(2) Client: Enable ssh to verify host keys using DNS
31
32To enable the ssh client to verify host keys using DNS, you have to
33add the following option to the ssh configuration file
34($HOME/.ssh/config or /etc/ssh/ssh_config):
35
36    VerifyHostKeyDNS yes
37
38Upon connection the client will try to look up the fingerprint RR
39using DNS. If the fingerprint received from the DNS server matches
40the remote host key, the user will be notified.
41
42
43	Jakob Schlyter
44	Wesley Griffin
45
46
47$OpenBSD: README.dns,v 1.2 2003/10/14 19:43:23 jakob Exp $
48

README.md

1# Portable OpenSSH
2
3[![C/C++ CI](https://github.com/openssh/openssh-portable/actions/workflows/c-cpp.yml/badge.svg)](https://github.com/openssh/openssh-portable/actions/workflows/c-cpp.yml)
4[![Fuzzing Status](https://oss-fuzz-build-logs.storage.googleapis.com/badges/openssh.svg)](https://bugs.chromium.org/p/oss-fuzz/issues/list?sort=-opened&can=1&q=proj:openssh)
5[![Coverity Status](https://scan.coverity.com/projects/21341/badge.svg)](https://scan.coverity.com/projects/openssh-portable)
6
7OpenSSH is a complete implementation of the SSH protocol (version 2) for secure remote login, command execution and file transfer. It includes a client ``ssh`` and server ``sshd``, file transfer utilities ``scp`` and ``sftp`` as well as tools for key generation (``ssh-keygen``), run-time key storage (``ssh-agent``) and a number of supporting programs.
8
9This is a port of OpenBSD's [OpenSSH](https://openssh.com) to most Unix-like operating systems, including Linux, OS X and Cygwin. Portable OpenSSH polyfills OpenBSD APIs that are not available elsewhere, adds sshd sandboxing for more operating systems and includes support for OS-native authentication and auditing (e.g. using PAM).
10
11## Documentation
12
13The official documentation for OpenSSH are the man pages for each tool:
14
15* [ssh(1)](https://man.openbsd.org/ssh.1)
16* [sshd(8)](https://man.openbsd.org/sshd.8)
17* [ssh-keygen(1)](https://man.openbsd.org/ssh-keygen.1)
18* [ssh-agent(1)](https://man.openbsd.org/ssh-agent.1)
19* [scp(1)](https://man.openbsd.org/scp.1)
20* [sftp(1)](https://man.openbsd.org/sftp.1)
21* [ssh-keyscan(8)](https://man.openbsd.org/ssh-keyscan.8)
22* [sftp-server(8)](https://man.openbsd.org/sftp-server.8)
23
24## Stable Releases
25
26Stable release tarballs are available from a number of [download mirrors](https://www.openssh.com/portable.html#downloads). We recommend the use of a stable release for most users. Please read the [release notes](https://www.openssh.com/releasenotes.html) for details of recent changes and potential incompatibilities.
27
28## Building Portable OpenSSH
29
30### Dependencies
31
32Portable OpenSSH is built using autoconf and make. It requires a working C compiler, standard library and headers.
33
34``libcrypto`` from either [LibreSSL](https://www.libressl.org/) or [OpenSSL](https://www.openssl.org) may also be used.  OpenSSH may be built without either of these, but the resulting binaries will have only a subset of the cryptographic algorithms normally available.
35
36[zlib](https://www.zlib.net/) is optional; without it transport compression is not supported.
37
38FIDO security token support needs [libfido2](https://github.com/Yubico/libfido2) and its dependencies and will be enabled automatically if they are found.
39
40In addition, certain platforms and build-time options may require additional dependencies; see README.platform for details about your platform.
41
42### Building a release
43
44Releases include a pre-built copy of the ``configure`` script and may be built using:
45
46```
47tar zxvf openssh-X.YpZ.tar.gz
48cd openssh
49./configure # [options]
50make && make tests
51```
52
53See the [Build-time Customisation](#build-time-customisation) section below for configure options. If you plan on installing OpenSSH to your system, then you will usually want to specify destination paths.
54
55### Building from git
56
57If building from git, you'll need [autoconf](https://www.gnu.org/software/autoconf/) installed to build the ``configure`` script. The following commands will check out and build portable OpenSSH from git:
58
59```
60git clone https://github.com/openssh/openssh-portable # or https://anongit.mindrot.org/openssh.git
61cd openssh-portable
62autoreconf
63./configure
64make && make tests
65```
66
67### Build-time Customisation
68
69There are many build-time customisation options available. All Autoconf destination path flags (e.g. ``--prefix``) are supported (and are usually required if you want to install OpenSSH).
70
71For a full list of available flags, run ``./configure --help`` but a few of the more frequently-used ones are described below. Some of these flags will require additional libraries and/or headers be installed.
72
73Flag | Meaning
74--- | ---
75``--with-pam`` | Enable [PAM](https://en.wikipedia.org/wiki/Pluggable_authentication_module) support. [OpenPAM](https://www.openpam.org/), [Linux PAM](http://www.linux-pam.org/) and Solaris PAM are supported.
76``--with-libedit`` | Enable [libedit](https://www.thrysoee.dk/editline/) support for sftp.
77``--with-kerberos5`` | Enable Kerberos/GSSAPI support. Both [Heimdal](https://www.h5l.org/) and [MIT](https://web.mit.edu/kerberos/) Kerberos implementations are supported.
78``--with-selinux`` | Enable [SELinux](https://en.wikipedia.org/wiki/Security-Enhanced_Linux) support.
79
80## Development
81
82Portable OpenSSH development is discussed on the [openssh-unix-dev mailing list](https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev) ([archive mirror](https://marc.info/?l=openssh-unix-dev)). Bugs and feature requests are tracked on our [Bugzilla](https://bugzilla.mindrot.org/).
83
84## Reporting bugs
85
86_Non-security_ bugs may be reported to the developers via [Bugzilla](https://bugzilla.mindrot.org/) or via the mailing list above. Security bugs should be reported to [openssh@openssh.com](mailto:openssh.openssh.com).
87

README.platform

1This file contains notes about OpenSSH on specific platforms.
2
3AIX
4
5Beginning with OpenSSH 3.8p1, sshd will honour an account's password
6expiry settings, where prior to that it did not.  Because of this,
7it's possible for sites that have used OpenSSH's sshd exclusively to
8have accounts which have passwords expired longer than the inactive time
9(ie the "Weeks between password EXPIRATION and LOCKOUT" setting in SMIT
10or the maxexpired chuser attribute).
11
12Accounts in this state must have their passwords reset manually by the
13administrator.  As a precaution, it is recommended that the administrative
14passwords be reset before upgrading from OpenSSH <3.8.
15
16As of OpenSSH 4.0p1, configure will attempt to detect if your version
17and maintenance level of AIX has a working getaddrinfo, and will use it
18if found.  This will enable IPv6 support.  If for some reason configure
19gets it wrong, or if you want to build binaries to work on earlier MLs
20than the build host then you can add "-DBROKEN_GETADDRINFO" to CFLAGS
21to force the previous IPv4-only behaviour.
22
23IPv6 known to work: 5.1ML7 5.2ML2 5.2ML5
24IPv6 known broken: 4.3.3ML11 5.1ML4
25
26If you wish to use dynamic libraries that aren't in the normal system
27locations (eg IBM's OpenSSL and zlib packages) then you will need to
28define the environment variable blibpath before running configure, eg
29
30blibpath=/lib:/usr/lib:/opt/freeware/lib ./configure \
31  --with-ssl-dir=/opt/freeware --with-zlib=/opt/freeware
32
33If sshd is built with the WITH_AIXAUTHENTICATE option (which is enabled
34by default) then sshd checks that users are permitted via the
35loginrestrictions() function, in particular that the user has the
36"rlogin" attribute set.  This check is not done for the root account,
37instead the PermitRootLogin setting in sshd_config is used.
38
39If you are using the IBM compiler you probably want to use CC=xlc rather
40than the default of cc.
41
42
43Cygwin
44------
45To build on Cygwin, OpenSSH requires the following packages:
46gcc, gcc-mingw-core, mingw-runtime, binutils, make, openssl,
47openssl-devel, zlib, minres, minires-devel.
48
49
50Darwin and MacOS X
51------------------
52Darwin does not provide a tun(4) driver required for OpenSSH-based
53virtual private networks. The BSD manpage still exists, but the driver
54has been removed in recent releases of Darwin and MacOS X.
55
56Tunnel support is known to work with Darwin 8 and MacOS X 10.4 in
57Point-to-Point (Layer 3) and Ethernet (Layer 2) mode using a third
58party driver. More information is available at:
59	https://tuntaposx.sourceforge.net
60
61Recent Darwin/MacOS X versions are likely unsupported.
62
63Linux
64-----
65
66Some Linux distributions (including Red Hat/Fedora/CentOS) include
67headers and library links in the -devel RPMs rather than the main
68binary RPMs. If you get an error about headers, or complaining about a
69missing prerequisite then you may need to install the equivalent
70development packages.  On Redhat based distros these may be openssl-devel,
71zlib-devel and pam-devel, on Debian based distros these may be
72libssl-dev, libz-dev and libpam-dev.
73
74
75Solaris
76-------
77If you enable BSM auditing on Solaris, you need to update audit_event(4)
78for praudit(1m) to give sensible output.  The following line needs to be
79added to /etc/security/audit_event:
80
81	32800:AUE_openssh:OpenSSH login:lo
82
83The BSM audit event range available for third party TCB applications is
8432768 - 65535.  Event number 32800 has been chosen for AUE_openssh.
85There is no official registry of 3rd party event numbers, so if this
86number is already in use on your system, you may change it at build time
87by configure'ing --with-cflags=-DAUE_openssh=32801 then rebuilding.
88
89
90Platforms using PAM
91-------------------
92As of OpenSSH 4.3p1, sshd will no longer check /etc/nologin itself when
93PAM is enabled.  To maintain existing behaviour, pam_nologin should be
94added to sshd's session stack which will prevent users from starting shell
95sessions.  Alternatively, pam_nologin can be added to either the auth or
96account stacks which will prevent authentication entirely, but will still
97return the output from pam_nologin to the client.
98

README.privsep

1Privilege separation, or privsep, is method in OpenSSH by which
2operations that require root privilege are performed by a separate
3privileged monitor process.  Its purpose is to prevent privilege
4escalation by containing corruption to an unprivileged process.
5More information is available at:
6	http://www.citi.umich.edu/u/provos/ssh/privsep.html
7
8Privilege separation is now mandatory.  During the pre-authentication
9phase sshd will chroot(2) to "/var/empty" and change its privileges to the
10"sshd" user and its primary group.  sshd is a pseudo-account that should
11not be used by other daemons, and must be locked and should contain a
12"nologin" or invalid shell.
13
14You should do something like the following to prepare the privsep
15preauth environment:
16
17	# mkdir /var/empty
18	# chown root:sys /var/empty
19	# chmod 755 /var/empty
20	# groupadd sshd
21	# useradd -g sshd -c 'sshd privsep' -d /var/empty -s /bin/false sshd
22
23/var/empty should not contain any files.
24
25configure supports the following options to change the default
26privsep user and chroot directory:
27
28  --with-privsep-path=xxx Path for privilege separation chroot
29  --with-privsep-user=user Specify non-privileged user for privilege separation
30
31PAM-enabled OpenSSH is known to function with privsep on AIX, FreeBSD, 
32HP-UX (including Trusted Mode), Linux, NetBSD and Solaris.
33
34On Cygwin, Tru64 Unix and OpenServer only the pre-authentication part
35of privsep is supported.  Post-authentication privsep is disabled
36automatically (so you won't see the additional process mentioned below).
37
38Note that for a normal interactive login with a shell, enabling privsep
39will require 1 additional process per login session.
40
41Given the following process listing (from HP-UX):
42
43     UID   PID  PPID  C    STIME TTY       TIME COMMAND
44    root  1005     1  0 10:45:17 ?         0:08 /opt/openssh/sbin/sshd -u0
45    root  6917  1005  0 15:19:16 ?         0:00 sshd: stevesk [priv]
46 stevesk  6919  6917  0 15:19:17 ?         0:03 sshd: stevesk@2
47 stevesk  6921  6919  0 15:19:17 pts/2     0:00 -bash
48
49process 1005 is the sshd process listening for new connections.
50process 6917 is the privileged monitor process, 6919 is the user owned
51sshd process and 6921 is the shell process.
52

README.tun

1How to use OpenSSH-based virtual private networks
2-------------------------------------------------
3
4OpenSSH contains support for VPN tunneling using the tun(4) network
5tunnel pseudo-device which is available on most platforms, either for
6layer 2 or 3 traffic.
7
8The following brief instructions on how to use this feature use
9a network configuration specific to the OpenBSD operating system.
10
11(1) Server: Enable support for SSH tunneling
12
13To enable the ssh server to accept tunnel requests from the client, you
14have to add the following option to the ssh server configuration file
15(/etc/ssh/sshd_config):
16
17	PermitTunnel yes
18
19Restart the server or send the hangup signal (SIGHUP) to let the server
20reread it's configuration.
21
22(2) Server: Restrict client access and assign the tunnel
23
24The OpenSSH server simply uses the file /root/.ssh/authorized_keys to
25restrict the client to connect to a specified tunnel and to
26automatically start the related interface configuration command. These
27settings are optional but recommended:
28
29	tunnel="1",command="sh /etc/netstart tun1" ssh-rsa ... reyk@openbsd.org
30
31(3) Client: Configure the local network tunnel interface
32
33Use the hostname.if(5) interface-specific configuration file to set up
34the network tunnel configuration with OpenBSD. For example, use the
35following configuration in /etc/hostname.tun0 to set up the layer 3
36tunnel on the client:
37
38	inet 192.168.5.1 255.255.255.252 192.168.5.2
39
40OpenBSD also supports layer 2 tunneling over the tun device by adding
41the link0 flag:
42
43	inet 192.168.1.78 255.255.255.0 192.168.1.255 link0
44
45Layer 2 tunnels can be used in combination with an Ethernet bridge(4)
46interface, like the following example for /etc/bridgename.bridge0:
47
48	add tun0
49	add sis0
50	up
51
52(4) Client: Configure the OpenSSH client
53
54To establish tunnel forwarding for connections to a specified
55remote host by default, use the following ssh client configuration for
56the privileged user (in /root/.ssh/config):
57
58	Host sshgateway
59		Tunnel yes
60		TunnelDevice 0:any
61		PermitLocalCommand yes
62	        LocalCommand sh /etc/netstart tun0
63
64A more complicated configuration is possible to establish a tunnel to
65a remote host which is not directly accessible by the client.
66The following example describes a client configuration to connect to
67the remote host over two ssh hops in between. It uses the OpenSSH
68ProxyCommand in combination with the nc(1) program to forward the final
69ssh tunnel destination over multiple ssh sessions.
70
71	Host access.somewhere.net
72	        User puffy
73	Host dmzgw
74	        User puffy
75	        ProxyCommand ssh access.somewhere.net nc dmzgw 22
76	Host sshgateway
77	        Tunnel Ethernet
78	        TunnelDevice 0:any
79	        PermitLocalCommand yes
80	        LocalCommand sh /etc/netstart tun0
81	        ProxyCommand ssh dmzgw nc sshgateway 22
82
83The following network plan illustrates the previous configuration in
84combination with layer 2 tunneling and Ethernet bridging.
85
86+--------+       (          )      +----------------------+
87| Client |------(  Internet  )-----| access.somewhere.net |
88+--------+       (          )      +----------------------+
89    : 192.168.1.78                             |
90    :.............................         +-------+
91     Forwarded ssh connection    :         | dmzgw |
92     Layer 2 tunnel              :         +-------+
93                                 :             |
94                                 :             |
95                                 :      +------------+
96                                 :......| sshgateway |
97                                      | +------------+
98--- real connection                 Bridge ->  |          +----------+
99... "virtual connection"                     [ X ]--------| somehost |
100[X] switch                                                +----------+
101                                                          192.168.1.25
102
103(5) Client: Connect to the server and establish the tunnel
104
105Finally connect to the OpenSSH server to establish the tunnel by using
106the following command:
107
108	ssh sshgateway
109
110It is also possible to tell the client to fork into the background after
111the connection has been successfully established:
112
113	ssh -f sshgateway true
114
115Without the ssh configuration done in step (4), it is also possible
116to use the following command lines:
117
118	ssh -fw 0:1 sshgateway true
119	ifconfig tun0 192.168.5.1 192.168.5.2 netmask 255.255.255.252
120
121Using OpenSSH tunnel forwarding is a simple way to establish secure
122and ad hoc virtual private networks. Possible fields of application
123could be wireless networks or administrative VPN tunnels.
124
125Nevertheless, ssh tunneling requires some packet header overhead and
126runs on top of TCP. It is still suggested to use the IP Security
127Protocol (IPSec) for robust and permanent VPN connections and to
128interconnect corporate networks.
129
130	Reyk Floeter
131
132$OpenBSD: README.tun,v 1.4 2006/03/28 00:12:31 deraadt Exp $
133