repository·master·Indexed 26 days ago
https://github.com/openssh/openssh-portableA complete implementation of the SSH protocol (version 2) ported from OpenBSD to Unix-like operating systems including Linux, OS X, and Cygwin. This documentation covers building from tarballs or git, managing dependencies like libcrypto and zlib, and platform-specific installation guides for AIX, Cygwin, and HP-UX.
To build OpenSSH from a stable release tarball, extract the archive, run the pre-built configure script with your desired options, and use make to build and test the binaries. If you intend to install OpenSSH to a specific system location, use destination path flags (such as --prefix) during the configuration step.
tar zxvf openssh-X.YpZ.tar.gz
cd openssh
./configure # [options]
make && make testsWhen building from the git master branch, you must have autoconf installed to generate the configure script. Follow these steps to clone, generate configuration, and build:
git clone https://github.com/openssh/openssh-portable # or https://anongit.mindrot.org/openssh.git
cd openssh-portable
autoreconf
./configure
make && make testsOpenSSH uses privilege separation (privsep) to mitigate attacks by splitting sshd operations across three discrete binaries. This reduces the privileged attack surface and facilitates OS-level sandboxing.
sshd (listener): The main entry point. It listens for connections and monitors MaxStartups. It does not handle untrusted data; it forks/execs sshd-session for each connection.sshd-session (preauth monitor): Acts as a privileged monitor. It receives RPC messages from sshd-auth to perform privileged tasks (e.g., verifying accounts, signing host keys).sshd-auth (unprivileged): The network-facing process. It handles SSH protocol communication. It sandboxes/chroots and drops privileges to an unprivileged user before processing network traffic.sshd-session (postauth monitor): Continues to act as a privileged monitor for the session, handling tasks like PTY allocation and key re-exchange.sshd-session (unprivileged): A forked child that drops privileges to the authenticated user's level and performs the remainder of the SSH protocol operations./bin/bash) started for the user session.ssh-copy-id shell script automates the process of adding your public key to a remote machine's ~/.ssh/authorized_keys file.The egd.rc script is used to start and stop the Entropy Gathering Daemon (EGD) on HP-UX systems. It relies on a configuration file located at /etc/rc.config.d/egd to define operational parameters.
Settings should be defined in /etc/rc.config.d/egd:
EGD_START: Set to 1 to enable starting the daemon. If not set or not 1, the script returns a skip status (2).EGD_ARGS: Arguments passed to the egd.pl script.EGD_LOG: The path to the EGD log file. If not explicitly set, it defaults to /etc/opt/egd/egd.log.The script accepts the following commands:
start: Starts the EGD daemon if EGD_START is enabled and the executable exists at /opt/perl/bin/egd.pl.stop: Stops the running EGD process.start_msg: Prints a startup message.stop_msg: Prints a shutdown message.0: Success.1: Failure.2: Skip (e.g., if the script is overridden or inappropriate to execute).3: Reboot (system reboot triggered after execution)./usr might not be available. Do not access commands or files in /usr unless the script executes in run state 2 or greater. Filesystems like /var and /opt are typically not mounted until run state 2.To verify host keys using DNS (per RFC 4255), you must first generate a DNS resource record (RR) containing the fingerprint of your public host key.
Use the ssh-keygen -r command to generate a generic DNS RR format. If your nameserver supports the specific SSHFP RR type, you can omit the -g flag to produce a standard SSHFP record.
After generating the record, add it to your DNS zone file and ensure your zone is signed.
To set up the SSH daemon (sshd) startup scripts on HP-UX, follow these steps:
sshd.rc:sshd.rc and verify that WHAT_PATH and WHAT_PID match your local OpenSSH installation paths.SSHD_ARGS if necessary.sshd configuration file to /etc/rc.config.d and set permissions to 444.sshd.rc startup script to /sbin/init.d and set permissions to 555./sbin/rc1.d/K100sshd to stop the service during shutdown./sbin/rc2.d/S900sshd to start the service during boot.# Configure and install sshd
# cp sshd /etc/rc.config.d
# chmod 444 /etc/rc.config.d/sshd
# cp sshd.rc /sbin/init.d
# chmod 555 /sbin/init.d/sshd.rc
# ln -s /sbin/init.d/sshd.rc /sbin/rc1.d/K100sshd
# ln -s /sbin/init.d/sshd.rc /sbin/rc2.d/S900sshdThe contrib directory contains build support and package specification files for several platforms and distributions:
For X11 environments, it is highly recommended to use the x11-ssh-askpass passphrase requester written by Jim Knoble to handle SSH passphrase prompts graphically.
http://www.jmknoble.net/software/x11-ssh-askpass/Use the buildpkg.sh script to create a Solaris package. The process uses a 'dummy install' method (make install-nokeys DESTDIR=[fakeroot]) to ensure manpages are handled correctly while deferring key generation until the first time sshd is started.
Follow these steps to build the package:
make -F Makefile.in distprep../configure with your desired options (e.g., --with-pam).openssh-config.local (refer to the top of buildpkg.sh for available options).buildpkg.sh will source. Supported script names include:pkg_post_make_install_fixes.shpkg-post-prototype-edit.shpkg-preinstall.localpkg-postinstall.localpkg-preremove.localpkg-postremove.localpkg-request.localmake package to generate the Solaris package.# Example build sequence
make -F Makefile.in distprep
./configure --with-pam
make packageIf you need to use outbound SSH through a SOCKS4, SOCKS5, or HTTPS CONNECT style proxy server, you can use connect.c as an SSH ProxyCommand. This is an externally maintained tool by Shun-ichi GOTO. Documentation and Win32 binaries are available on his Bitbucket wiki.
https://bitbucket.org/gotoh/connect/wiki/Home