RepoMirrors/openssh
1
0
Fork 0
mirror of git://anongit.mindrot.org/openssh.git synced 2024-12-22 10:00:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

- (djm) Remove UPGRADING document in favour of a link to the better

Browse Source 
maintained FAQ on www.openssh.com
This commit is contained in:
Damien Miller 2000-11-06 12:48:54 +11:00
parent 389edc4ce4
commit 6604fadbdd
3 changed files with 8 additions and 136 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
ChangeLog
View File

@ -1,6 +1,8 @@
20001106
- (djm) Use Jim's new 1.0.3 askpass in Redhat RPMs
- (djm) Manually fix up missed diff hunks (mainly RCS idents)
- (djm) Remove UPGRADING document in favour of a link to the better
maintained FAQ on www.openssh.com
20001105
- (bal) Sync with OpenBSD:

10
README
View File

@ -9,7 +9,7 @@
* you generated host or user keys with v1.2.2 or previous versions,
* please generate new ones using a more recent version.
This is the port of OpenBSD's excellent OpenSSH to Linux and other
This is the port of OpenBSD's excellent OpenSSH[0] to Linux and other
Unices.
OpenSSH is based on the last free version of Tatu Ylonen's SSH with
@ -47,8 +47,9 @@ Other code contribution are accepted, but please follow the OpenBSD
style guidelines[5].
Please refer to the INSTALL document for information on how to install
OpenSSH on your system. The UPGRADING document details differences
between this port of OpenSSH and F-Secure SSH 1.x.
OpenSSH on your system. There are a number of differences between this
port of OpenSSH and F-Secure SSH 1.x, please refer to the OpenSSH FAQ[6]
for details and general tips.
Damien Miller <djm@mindrot.org>
@ -60,9 +61,10 @@ version of SSH released by Tatu Ylonen.
References -
[0] http://www.openssh.com/faq.html
[1] http://www.lothar.com/tech/crypto/
[2] ftp://ftp.freesoftware.com/pub/infozip/zlib/
[3] http://www.openssl.org/
[4] http://www.kernel.org/pub/linux/libs/pam/ (PAM is standard on Solaris)
[5] http://www.openbsd.org/cgi-bin/man.cgi?query=style&sektion=9&apropos=0&manpath=OpenBSD+Current
[6] http://www.openssh.com/faq.html

132
UPGRADING
View File

@ -1,132 +0,0 @@
[ A Japanese translation of this document is available at
[ http://www.unixuser.org/%7Eharuyama/security/openssh/index.html
[ Thanks to HARUYAMA Seigo <haruyama@nt.phys.s.u-tokyo.ac.jp>
OpenSSH is almost completely compatible with the commercial SSH 1.2.x.
There are, however, a few exceptions that you will need to bear in
mind while upgrading:
1. OpenSSH does not support any patented transport algorithms.
Only 3DES and Blowfish can be selected. This difference may manifest
itself in the ssh command refusing to read its config files.
Solution: Edit /etc/ssh/ssh_config and select a different "Cipher"
option ("3des" or "blowfish").
2. Old versions of commercial SSH encrypt host keys with IDEA
The old versions of SSH used a patented algorithm to encrypt their
/etc/ssh/ssh_host_key
This problem will manifest as sshd not being able to read its host
key.
Solution: You will need to run the *commercial* version of ssh-keygen
on the host's private key:
ssh-keygen -u -f /etc/ssh/ssh_host_key
3. Incompatible changes to sshd_config format.
OpenSSH extends the sshd_config file format in a number of ways. There
is currently one change which is incompatible with the old.
Commercial SSH controlled logging using the "QuietMode" and
"FascistLogging" directives. OpenSSH introduces a more general set of
logging options "SyslogFacility" and "LogLevel". See the sshd manual
page for details.
4. Warning messages about key lengths
Commercial SSH's ssh-keygen program contained a bug which caused it to
occasionally generate RSA keys which had their Most Significant Bit
(MSB) unset. Such keys were advertised as being full-length, but are
actually only half as secure.
OpenSSH will print warning messages when it encounters such keys. To
rid yourself of these message, edit you known_hosts files and replace
the incorrect key length (usually "1024") with the correct key length
(usually "1023").
5. Spurious PAM authentication messages in logfiles
OpenSSH will generate spurious authentication failures at every login,
similar to "authentication failure; (uid=0) -> root for sshd service".
These are generated because OpenSSH first tries to determine whether a
user needs authentication to login (e.g. empty password). Unfortunatly
PAM likes to log all authentication events, this one included.
If it annoys you too much, set "PermitEmptyPasswords no" in
sshd_config. This will quiet the error message at the expense of
disabling logins to accounts with no password set. This is the
default if you use the supplied sshd_config file.
6. Empty passwords not allowed with PAM authentication
To enable empty passwords with a version of OpenSSH built with PAM you
must add the flag "nullok" to the end of the password checking module
in the /etc/pam.d/sshd file. For example:
auth required/lib/security/pam_unix.so shadow nodelay nullok
This must be done in addtion to setting "PermitEmptyPasswords yes"
in the sshd_config file.
There is one caveat when using empty passwords with PAM
authentication: PAM will allow _any_ password when authenticating
an account with an empty password. This breaks the check that sshd
uses to determined whether an account has no password set and grant
users access to the account regardless of the policy specified by
"PermitEmptyPasswords". For this reason, it is recommended that you do
not add the "nullok" directive to your PAM configuration file unless
you specifically wish to allow empty passwords.
7. X11 and/or agent forwarding does not work
Check your ssh_config and sshd_config. The default configuration files
disable authentication agent and X11 forwarding.
8. ssh takes a long time to connect with Linux/glibc 2.1
The glibc shipped with Redhat 6.1 appears to take a long time to resolve
"IPv6 or IPv4" addresses from domain names. This can be kludged around
with the --with-ipv4-default configure option. This instructs OpenSSH to
use IPv4-only address resolution. (IPv6 lookups may still be made by
specifying the -6 option).
9. Logins from commercial ssh generate the error "Selected cipher type
idea not supported by server"
This error is generated when a commercial ssh which has been configured to
use the 'idea' cipher attempts to connect to an OpenSSH server. To rectify
this, select a different cipher in ssh_config or ~/.ssh/config (3des for
security or blowfish for speed).
10. "can't locate module net-pf-10" messages in log under Linux
The Linux kernel is looking (via modprobe) for protocol family 10 (IPv6).
Either 1. load the appropriate kernel module, 2. enter the correct alias
in /etc/modules.conf or 3. disable IPv6 in /etc/modules.conf.
For some silly reason /etc/modules.conf may also be named /etc/conf.modules
11. Password authentication doesn't work on Slackware 7.0
Configure OpenSSH with --with-md5-passwords
12. ./configure or sshd complain about lack of RSA support
Ensure that your OpenSSL libraries have been built to include RSA support
either internally or through RSAref.
13. "scp: command not found" errors
scp must be in the default PATH on both the client and the server. You may
need to use the --with-default-path option to specify a custom path to
search on the server. This option replaces the default path, so you need
to specify all the current directories on your path as well as where you
have installed scp. For example:
./configure --with-default-path=/bin:/usr/bin:/usr/local/bin:/path/to/scp