Portable OpenSSH
Go to file
Darren Tucker 65380ff7e0 Only run selfhosted tests from selfhosted repo. 2021-02-17 18:27:36 +11:00
.github Only run selfhosted tests from selfhosted repo. 2021-02-17 18:27:36 +11:00
contrib shift contents of long $() into filter_ids() 2020-10-13 12:45:05 +11:00
m4 Replace AC_TRY_COMPILE obsoleted in autoconf 2.70. 2020-11-06 13:56:41 +11:00
openbsd-compat Using explicit_memset for the explicit_bzero compatibility layer. 2021-02-05 17:07:03 +11:00
regress upstream: Make sure puttygen is new enough to successfully run the 2021-02-17 15:08:29 +11:00
.depend upstream: Update/replace the experimental post-quantim hybrid key 2020-12-29 12:38:53 +11:00
.gitignore Add aclocal.m4 and config.h.in~ to .gitignore. 2020-09-11 13:18:42 +10:00
.skipped-commit-ids upstream: Add a comment documenting the source of the moduli group 2020-11-09 00:02:27 +11:00
CREDITS convert to UTF-8; from Mike Frysinger 2019-07-29 09:49:23 +10:00
INSTALL Restore first section title of INSTALL 2020-09-27 21:12:12 +10:00
LICENCE add some openbsd-compat licenses we missed 2020-10-03 13:39:17 +10:00
Makefile.in upstream: Add PerSourceMaxStartups and PerSourceNetBlockSize 2021-01-11 15:04:12 +11:00
OVERVIEW upstream: refer to OpenSSL not SSLeay; 2018-10-23 16:57:54 +11:00
PROTOCOL upstream: sftp: add missing lsetstat@openssh.com documentation 2021-02-17 15:03:41 +11:00
PROTOCOL.agent upstream: Agent protocol draft is now at rev 4. ok djm@ 2020-10-07 13:34:11 +11:00
PROTOCOL.certkeys upstream: document the "no-touch-required" certificate extension; 2019-11-25 12:25:53 +11:00
PROTOCOL.chacha20poly1305 upstream: Fix some typos and an incorrect word in docs. Patch from 2020-02-21 12:27:23 +11:00
PROTOCOL.key
PROTOCOL.krl upstream: allow key revocation by SHA256 hash and allow ssh-keygen 2018-09-12 16:49:21 +10:00
PROTOCOL.mux upstream: spelling errors in comments; no code change from 2020-03-14 19:39:09 +11:00
PROTOCOL.sshsig upstream: Add RCS IDs to the few files that are missing them; from 2020-08-31 14:34:41 +10:00
PROTOCOL.u2f upstream: when writing an attestation blob for a FIDO key, record all 2020-09-09 13:11:34 +10:00
README update version numbers 2020-09-27 17:25:01 +10:00
README.dns Minor documentation update: 2020-02-11 12:51:24 +11:00
README.md whitespace at EOL 2020-12-22 19:42:52 +11:00
README.platform Improve AIX text. 2020-12-22 19:21:26 +11:00
README.privsep Privsep is now required. 2019-09-19 15:41:23 +10:00
README.tun
TODO Remove support for S/Key 2018-07-31 12:59:30 +10:00
addr.c ifdef new instance of sin6_scope_id 2021-01-23 18:28:37 +11:00
addr.h upstream: Move address handling functions out into their own file 2021-01-11 15:04:12 +11:00
addrmatch.c upstream: Move address handling functions out into their own file 2021-01-11 15:04:12 +11:00
atomicio.c upstream: Check for both EAGAIN and EWOULDBLOCK. This is a no-op 2019-01-24 14:40:03 +11:00
atomicio.h upstream: move client/server SSH-* banners to buffers under 2018-12-27 14:38:22 +11:00
audit-bsm.c last bits of old packet API / active_state global 2019-01-20 14:55:27 +11:00
audit-linux.c last bits of old packet API / active_state global 2019-01-20 14:55:27 +11:00
audit.c last bits of old packet API / active_state global 2019-01-20 14:55:27 +11:00
audit.h last bits of old packet API / active_state global 2019-01-20 14:55:27 +11:00
auth-bsdauth.c remove duplicate #includes 2019-10-02 10:54:28 +10:00
auth-krb5.c
auth-options.c upstream: use the new variant log macros instead of prepending 2020-10-18 23:46:29 +11:00
auth-options.h upstream: support for requiring user verified FIDO keys in sshd 2020-08-27 11:28:36 +10:00
auth-pam.c Prevent excessively long username going to PAM. 2020-11-11 14:05:30 +11:00
auth-pam.h remove PAM dependencies on old packet API 2019-01-20 10:22:18 +11:00
auth-passwd.c upstream: use the new variant log macros instead of prepending 2020-10-18 23:46:29 +11:00
auth-rhosts.c upstream: use the new variant log macros instead of prepending 2020-10-18 23:46:29 +11:00
auth-shadow.c
auth-sia.c
auth-sia.h
auth.c upstream: move subprocess() from auth.c to misc.c 2020-12-22 15:43:59 +11:00
auth.h upstream: move subprocess() from auth.c to misc.c 2020-12-22 15:43:59 +11:00
auth2-chall.c upstream: use the new variant log macros instead of prepending 2020-10-18 23:46:29 +11:00
auth2-gss.c upstream: this needs kex.h now 2021-01-27 21:16:45 +11:00
auth2-hostbased.c upstream: make ssh->kex->session_id a sshbuf instead of u_char*/size_t 2021-01-27 21:10:57 +11:00
auth2-kbdint.c upstream: use the new variant log macros instead of prepending 2020-10-18 23:46:29 +11:00
auth2-none.c upstream: use the new variant log macros instead of prepending 2020-10-18 23:46:29 +11:00
auth2-passwd.c upstream: use the new variant log macros instead of prepending 2020-10-18 23:46:29 +11:00
auth2-pubkey.c upstream: make ssh->kex->session_id a sshbuf instead of u_char*/size_t 2021-01-27 21:10:57 +11:00
auth2.c upstream: make ssh->kex->session_id a sshbuf instead of u_char*/size_t 2021-01-27 21:10:57 +11:00
authfd.c upstream: factor out common code in the agent client 2021-01-26 12:21:48 +11:00
authfd.h upstream: constify a few things; ok dtucker (as part of another 2020-06-26 15:24:28 +10:00
authfile.c upstream: avoid spurious "Unable to load host key" message when 2020-06-19 15:51:04 +10:00
authfile.h upstream: factor out reading/writing sshbufs to dedicated 2020-01-26 10:18:42 +11:00
bitmap.c
bitmap.h
buildpkg.sh.in whitespace at EOL 2020-12-22 19:43:55 +11:00
canohost.c upstream: use the new variant log macros instead of prepending 2020-10-18 23:46:29 +11:00
canohost.h
chacha.c
chacha.h
channels.c upstream: ssh: add PermitRemoteOpen for remote dynamic forwarding 2021-02-17 15:03:41 +11:00
channels.h upstream: cap channel input buffer size at 16MB; avoids high memory use 2020-09-20 16:16:46 +10:00
cipher-aes.c
cipher-aesctr.c
cipher-aesctr.h
cipher-chachapoly-libcrypto.c Fix conditional for openssl-based chacha20. 2020-05-01 09:21:52 +10:00
cipher-chachapoly.c Include openssl-compat.h before checking ifdefs. 2020-04-06 20:54:34 +10:00
cipher-chachapoly.h upstream: make Chacha20-POLY1305 context struct opaque; ok tb@ as 2020-04-03 15:36:57 +11:00
cipher-ctr.c
cipher.c upstream: Remove the pre-standardization cipher 2020-12-21 22:35:41 +11:00
cipher.h upstream: Make zlib optional. This adds a "ZLIB" build time option 2020-01-23 21:53:54 +11:00
cleanup.c
clientloop.c upstream: make ssh->kex->session_id a sshbuf instead of u_char*/size_t 2021-01-27 21:10:57 +11:00
clientloop.h upstream: make failures when establishing "Tunnel" forwarding terminate 2020-04-03 13:42:33 +11:00
compat.c upstream: remove global variable used to stash compat flags and use the 2021-01-27 20:28:25 +11:00
compat.h upstream: remove global variable used to stash compat flags and use the 2021-01-27 20:28:25 +11:00
config.guess sync config.guess/config.sub with latest versions 2020-05-08 13:32:12 +10:00
config.sub sync config.guess/config.sub with latest versions 2020-05-08 13:32:12 +10:00
configure.ac Using explicit_memset for the explicit_bzero compatibility layer. 2021-02-05 17:07:03 +11:00
crypto_api.h upstream: Update the sntrup761 creation script and generated code: 2021-01-08 13:49:49 +11:00
defines.h Disable sntrup761 if compiler doesn't support VLAs. 2021-01-26 14:48:07 +11:00
dh.c upstream: use the new variant log macros instead of prepending 2020-10-18 23:46:29 +11:00
dh.h upstream: fixes for !WITH_OPENSSL compilation; ok dtucker@ 2019-09-06 17:54:21 +10:00
digest-libc.c upstream: change explicit_bzero();free() to freezero() 2020-02-28 12:26:28 +11:00
digest-openssl.c upstream: whitespace; no code change 2020-10-29 13:54:13 +11:00
digest.h
dispatch.c upstream: allow sshpkt_fatal() to take a varargs format; we'll 2019-01-20 09:02:20 +11:00
dispatch.h upstream: remove last traces of old packet API! 2019-01-20 09:45:18 +11:00
dns.c upstream: use the new variant log macros instead of prepending 2020-10-18 23:46:29 +11:00
dns.h
ed25519.c
entropy.c Fix a couple of mysig_t leftovers. 2020-01-23 21:06:45 +11:00
entropy.h
fatal.c upstream: fix SEGV on fatal() errors spotted by dtucker@ 2020-10-19 19:09:08 +11:00
fe25519.c
fe25519.h
fixalgorithms
fixpaths
ge25519.c
ge25519.h
ge25519_base.data
groupaccess.c upstream: Move checks for lists of users or groups into their own 2019-03-08 15:10:07 +11:00
groupaccess.h
gss-genr.c upstream: make ssh->kex->session_id a sshbuf instead of u_char*/size_t 2021-01-27 21:10:57 +11:00
gss-serv-krb5.c
gss-serv.c upstream: spelling errors in comments; no code change from 2020-03-14 19:39:09 +11:00
hash.c Wrap sha2.h include in ifdef. 2019-11-29 20:21:36 +11:00
hmac.c upstream: change explicit_bzero();free() to freezero() 2020-02-28 12:26:28 +11:00
hmac.h
hostfile.c upstream: make struct hostkeys public; I have no idea why I made it 2021-01-26 12:21:48 +11:00
hostfile.h upstream: make struct hostkeys public; I have no idea why I made it 2021-01-26 12:21:48 +11:00
includes.h
install-sh
int32_minmax.inc upstream: estructure sntrup761.sh to process all files in a single 2021-01-08 13:46:35 +11:00
kex.c upstream: more strictly enforce KEX state-machine by banning packet 2021-02-01 09:57:28 +11:00
kex.h upstream: more strictly enforce KEX state-machine by banning packet 2021-02-01 09:57:28 +11:00
kexc25519.c upstream: rename kex->kem_client_pub -> kex->client_pub now that 2019-01-21 23:13:03 +11:00
kexdh.c upstream: memleak of DH public bignum; found with libfuzzer 2020-12-04 13:43:01 +11:00
kexecdh.c Put ssherr.h back as it's actually needed. 2019-10-02 14:30:55 +10:00
kexgen.c upstream: more strictly enforce KEX state-machine by banning packet 2021-02-01 09:57:28 +11:00
kexgex.c upstream: pass most arguments to the KEX hash functions as sshbuf 2019-01-23 13:02:02 +11:00
kexgexc.c upstream: more strictly enforce KEX state-machine by banning packet 2021-02-01 09:57:28 +11:00
kexgexs.c upstream: more strictly enforce KEX state-machine by banning packet 2021-02-01 09:57:28 +11:00
kexsntrup761x25519.c Disable sntrup761 if compiler doesn't support VLAs. 2021-01-26 14:48:07 +11:00
krl.c upstream: use the new variant log macros instead of prepending 2020-10-18 23:46:29 +11:00
krl.h upstream: give ssh-keygen the ability to dump the contents of a 2020-04-03 13:33:25 +11:00
log.c upstream: make program name be const 2020-12-04 13:43:01 +11:00
log.h upstream: make program name be const 2020-12-04 13:43:01 +11:00
loginrec.c support NetBSD's utmpx.ut_ss address field 2020-08-05 08:58:57 +10:00
loginrec.h remove vestiges of old packet API from loginrec.c 2019-01-20 09:58:45 +11:00
logintest.c
mac.c remove duplicate #includes 2019-10-02 10:54:28 +10:00
mac.h
match.c upstream: fold consecutive '*' wildcards to mitigate combinatorial 2020-11-04 10:09:25 +11:00
match.h upstream: some language improvements; ok markus 2020-07-15 15:07:42 +10:00
md5crypt.c
md5crypt.h
mdoc2man.awk
misc.c upstream: factor out opt_array_append; ok djm@ 2021-02-17 15:03:41 +11:00
misc.h upstream: factor out opt_array_append; ok djm@ 2021-02-17 15:03:41 +11:00
mkinstalldirs
moduli upstream: Regen moduli. 2020-09-30 19:35:35 +10:00
moduli.5
moduli.c upstream: remove most uses of BN_CTX 2019-11-17 09:44:43 +11:00
monitor.c upstream: make ssh->kex->session_id a sshbuf instead of u_char*/size_t 2021-01-27 21:10:57 +11:00
monitor.h upstream: remove last references to active_state 2019-01-20 09:45:18 +11:00
monitor_fdpass.c upstream: use the new variant log macros instead of prepending 2020-10-18 23:46:29 +11:00
monitor_fdpass.h
monitor_wrap.c upstream: clean up passing of struct passwd from monitor to preauth 2020-11-27 13:16:32 +11:00
monitor_wrap.h upstream: revised log infrastructure for OpenSSH 2020-10-17 00:42:29 +11:00
msg.c upstream: use the new variant log macros instead of prepending 2020-10-18 23:46:29 +11:00
msg.h
mux.c upstream: whitespace; no code change 2020-10-29 13:54:13 +11:00
myproposal.h upstream: prefer ed25519 signature algorithm variants to ECDSA; ok 2020-10-03 14:34:06 +10:00
nchan.c upstream: remove global variable used to stash compat flags and use the 2021-01-27 20:28:25 +11:00
nchan.ms
nchan2.ms
openssh.xml.in
opensshd.init.in
packet.c upstream: make ssh->kex->session_id a sshbuf instead of u_char*/size_t 2021-01-27 21:10:57 +11:00
packet.h upstream: sshpkt_fatal() does not return; ok djm 2020-03-13 13:13:30 +11:00
pathnames.h upstream: enable ed25519 support; ok djm 2019-11-13 08:54:09 +11:00
pkcs11.h
platform-misc.c
platform-pledge.c
platform-tracing.c
platform.c Add headers to prevent warnings w/out OpenSSL. 2019-07-23 22:26:20 +10:00
platform.h
poly1305.c
poly1305.h
progressmeter.c upstream: Replace all calls to signal(2) with a wrapper around 2020-01-23 18:51:25 +11:00
progressmeter.h upstream: Have progressmeter force an update at the beginning and 2019-01-25 06:32:14 +11:00
readconf.c upstream: ssh: add PermitRemoteOpen for remote dynamic forwarding 2021-02-17 15:03:41 +11:00
readconf.h upstream: ssh: add PermitRemoteOpen for remote dynamic forwarding 2021-02-17 15:03:41 +11:00
readpass.c upstream: Free the previously allocated msg buffer after writing it 2020-11-12 10:53:03 +11:00
rijndael.c
rijndael.h
sandbox-capsicum.c
sandbox-darwin.c sandbox-darwin.c: fix missing prototypes. 2020-01-21 10:37:25 +11:00
sandbox-null.c
sandbox-pledge.c upstream: use the new variant log macros instead of prepending 2020-10-18 23:46:29 +11:00
sandbox-rlimit.c upstream: use the new variant log macros instead of prepending 2020-10-18 23:46:29 +11:00
sandbox-seccomp-filter.c Add __NR_futex_time64 to seccomp sandbox. 2021-02-11 10:18:05 +11:00
sandbox-solaris.c
sandbox-systrace.c upstream: Replace all calls to signal(2) with a wrapper around 2020-01-23 18:51:25 +11:00
sc25519.c
sc25519.h
scp.1 upstream: move HostbasedAcceptedAlgorithms to the right place in 2021-01-27 11:45:50 +11:00
scp.c upstream: use the new variant log macros instead of prepending 2020-10-18 23:46:29 +11:00
servconf.c upstream: factor out opt_array_append; ok djm@ 2021-02-17 15:03:41 +11:00
servconf.h upstream: Rename HostbasedKeyTypes (ssh) and 2021-01-26 22:50:40 +11:00
serverloop.c upstream: make ssh->kex->session_id a sshbuf instead of u_char*/size_t 2021-01-27 21:10:57 +11:00
serverloop.h
session.c upstream: use _PATH_SSH_USER_DIR instead of hardcoded .ssh in path 2020-12-14 15:38:50 +11:00
session.h upstream: Add server support for signalling sessions via the SSH 2018-10-02 22:41:01 +10:00
sftp-client.c upstream: shuffle a few utility functions into sftp-client.c; from 2020-12-04 13:43:01 +11:00
sftp-client.h upstream: shuffle a few utility functions into sftp-client.c; from 2020-12-04 13:43:01 +11:00
sftp-common.c upstream: use the new variant log macros instead of prepending 2020-10-18 23:46:29 +11:00
sftp-common.h
sftp-glob.c upstream: stdarg.h required more broadly; ok djm 2019-11-15 08:50:10 +11:00
sftp-realpath.c sftp-realpath.c needs includes.h 2019-07-08 13:44:32 +10:00
sftp-server-main.c upstream: Replace calls to ssh_malloc_init() by a static init of 2019-06-08 00:25:42 +10:00
sftp-server.8 upstream: supply word missing in previous; 2020-06-26 15:18:07 +10:00
sftp-server.c upstream: sftp: add missing lsetstat@openssh.com documentation 2021-02-17 15:03:41 +11:00
sftp.1 upstream: sftp: add missing lsetstat@openssh.com documentation 2021-02-17 15:03:41 +11:00
sftp.c upstream: don't try to use timespeccmp(3) directly as a qsort(3) 2021-01-08 13:50:46 +11:00
sftp.h
sk-api.h upstream: when writing an attestation blob for a FIDO key, record all 2020-09-09 13:11:34 +10:00
sk-usbhid.c upstream: use the new variant log macros instead of prepending 2020-10-18 23:46:29 +11:00
smult_curve25519_ref.c
sntrup761.c Disable sntrup761 if compiler doesn't support VLAs. 2021-01-26 14:48:07 +11:00
sntrup761.sh upstream: Update the sntrup761 creation script and generated code: 2021-01-08 13:49:49 +11:00
srclimit.c upstream: Add PerSourceMaxStartups and PerSourceNetBlockSize 2021-01-11 15:04:12 +11:00
srclimit.h upstream: Add PerSourceMaxStartups and PerSourceNetBlockSize 2021-01-11 15:04:12 +11:00
ssh-add.1 upstream: allow some additional control over the use of ssh-askpass 2020-07-15 15:08:10 +10:00
ssh-add.c upstream: Change convtime() from returning long to returning int. 2021-01-11 15:04:12 +11:00
ssh-agent.1 upstream: better terminology for permissions; feedback & ok markus@ 2020-06-22 16:11:14 +10:00
ssh-agent.c upstream: factor SSH_AGENT_CONSTRAIN_EXTENSION parsing into its own 2021-02-17 15:03:41 +11:00
ssh-dss.c upstream: change explicit_bzero();free() to freezero() 2020-02-28 12:26:28 +11:00
ssh-ecdsa-sk.c upstream: some clarifying comments 2020-06-26 15:18:07 +10:00
ssh-ecdsa.c upstream: Make sshpkt_get_bignum2() allocate the bignum it is 2019-01-21 21:47:28 +11:00
ssh-ed25519-sk.c upstream: use the new variant log macros instead of prepending 2020-10-18 23:46:29 +11:00
ssh-ed25519.c upstream: use the new variant log macros instead of prepending 2020-10-18 23:46:29 +11:00
ssh-gss.h upstream: make ssh->kex->session_id a sshbuf instead of u_char*/size_t 2021-01-27 21:10:57 +11:00
ssh-keygen.1 upstream: Document ssh-keygen -Z, sanity check its argument earlier and 2020-11-27 21:37:17 +11:00
ssh-keygen.c upstream: load_hostkeys()/hostkeys_foreach() variants for FILE* 2020-12-21 10:52:28 +11:00
ssh-keyscan.1 upstream: tweak the Nd lines for a bit of consistency; ok markus 2019-12-11 19:08:22 +11:00
ssh-keyscan.c upstream: remove global variable used to stash compat flags and use the 2021-01-27 20:28:25 +11:00
ssh-keysign.8 upstream: tweak the Nd lines for a bit of consistency; ok markus 2019-12-11 19:08:22 +11:00
ssh-keysign.c upstream: prepare readconf.c for fuzzing; remove fatal calls and 2020-12-21 10:52:22 +11:00
ssh-pkcs11-client.c upstream: use the new variant log macros instead of prepending 2020-10-18 23:46:29 +11:00
ssh-pkcs11-helper.8 upstream: tweak the Nd lines for a bit of consistency; ok markus 2019-12-11 19:08:22 +11:00
ssh-pkcs11-helper.c upstream: use the new variant log macros instead of prepending 2020-10-18 23:46:29 +11:00
ssh-pkcs11.c upstream: when loading PKCS#11 keys, include the key fingerprints 2020-11-27 11:50:30 +11:00
ssh-pkcs11.h upstream: expose PKCS#11 key labels/X.509 subjects as comments 2020-01-25 11:35:55 +11:00
ssh-rsa.c adapt -portable to OpenSSL 1.1x API 2018-09-13 12:13:50 +10:00
ssh-sandbox.h
ssh-sk-client.c upstream: use the new variant log macros instead of prepending 2020-10-18 23:46:29 +11:00
ssh-sk-helper.8 upstream: Replace the term "security key" with "(FIDO) 2019-12-30 14:31:40 +11:00
ssh-sk-helper.c upstream: use the new variant log macros instead of prepending 2020-10-18 23:46:29 +11:00
ssh-sk.c upstream: use the new variant log macros instead of prepending 2020-10-18 23:46:29 +11:00
ssh-sk.h upstream: pass the log-on-stderr flag and log level through to 2020-01-21 18:09:09 +11:00
ssh-xmss.c upstream: Adapt XMSS to new logging infrastructure. With markus@, ok 2020-10-20 10:15:02 +11:00
ssh.1 upstream: ssh: add PermitRemoteOpen for remote dynamic forwarding 2021-02-17 15:03:41 +11:00
ssh.c upstream: ssh: add PermitRemoteOpen for remote dynamic forwarding 2021-02-17 15:03:41 +11:00
ssh.h upstream: allow some additional control over the use of ssh-askpass 2020-07-15 15:08:10 +10:00
ssh2.h upstream: draft-ietf-secsh-architecture is now RFC4251. 2020-11-20 13:34:46 +11:00
ssh_api.c upstream: make ssh->kex->session_id a sshbuf instead of u_char*/size_t 2021-01-27 21:10:57 +11:00
ssh_api.h
ssh_config upstream: Add a '%k' TOKEN that expands to the effective HostKey of 2020-07-17 13:52:46 +10:00
ssh_config.5 upstream: ssh: add PermitRemoteOpen for remote dynamic forwarding 2021-02-17 15:03:41 +11:00
sshbuf-getput-basic.c upstream: make sshbuf_putb(b, NULL) a no-op 2020-06-05 13:28:29 +10:00
sshbuf-getput-crypto.c upstream: remove most uses of BN_CTX 2019-11-17 09:44:43 +11:00
sshbuf-io.c upstream: tidy headers; some junk snuck into sshbuf-misc.c and 2020-01-26 10:34:50 +11:00
sshbuf-misc.c upstream: support for RFC4648 base64url encoding; ok markus 2020-06-22 16:11:14 +10:00
sshbuf.c upstream: change explicit_bzero();free() to freezero() 2020-02-28 12:26:28 +11:00
sshbuf.h upstream: support for RFC4648 base64url encoding; ok markus 2020-06-22 16:11:14 +10:00
sshconnect.c upstream: move check_host_cert() from sshconnect,c to sshkey.c and 2021-01-26 12:21:48 +11:00
sshconnect.h upstream: add a ssh_config KnownHostsCommand that allows the client 2020-12-22 15:43:59 +11:00
sshconnect2.c upstream: make ssh->kex->session_id a sshbuf instead of u_char*/size_t 2021-01-27 21:10:57 +11:00
sshd.8 upstream: support for requiring user verified FIDO keys in sshd 2020-08-27 11:28:36 +10:00
sshd.c upstream: Remove debug message from sigchld handler. While this 2021-02-05 13:38:57 +11:00
sshd_config
sshd_config.5 upstream: Rename HostbasedKeyTypes (ssh) and 2021-01-26 22:50:40 +11:00
ssherr.c upstream: improve the error message for u2f enrollment errors by 2020-01-26 10:18:42 +11:00
ssherr.h upstream: improve the error message for u2f enrollment errors by 2020-01-26 10:18:42 +11:00
sshkey-xmss.c upstream: Adapt XMSS to new logging infrastructure. With markus@, ok 2020-10-20 10:15:02 +11:00
sshkey-xmss.h upstream: Adapt XMSS to new logging infrastructure. With markus@, ok 2020-10-20 10:15:02 +11:00
sshkey.c upstream: fix memleaks in private key deserialisation; enforce more 2021-02-05 13:38:57 +11:00
sshkey.h upstream: move check_host_cert() from sshconnect,c to sshkey.c and 2021-01-26 12:21:48 +11:00
sshlogin.c upstream: use the new variant log macros instead of prepending 2020-10-18 23:46:29 +11:00
sshlogin.h
sshpty.c Include stdio.h for FILE in misc.h. 2020-12-22 18:56:54 +11:00
sshpty.h
sshsig.c upstream: Set linesize returned by getline to zero when freeing and 2021-02-01 09:57:28 +11:00
sshsig.h upstream: Add RCS IDs to the few files that are missing them; from 2020-08-31 14:34:41 +10:00
sshtty.c
survey.sh.in
ttymodes.c upstream: remove global variable used to stash compat flags and use the 2021-01-27 20:28:25 +11:00
ttymodes.h
uidswap.c explicitly test set[ug]id() return values 2019-09-13 13:15:14 +10:00
uidswap.h
umac.c upstream: spelling errors in comments; no code change from 2020-03-14 19:39:09 +11:00
umac.h upstream: Typo and spelling fixes in comments and error messages. 2019-06-08 00:49:26 +10:00
umac128.c
utf8.c upstream: expose vasnmprintf(); ok (as part of other commit) markus 2020-05-01 16:40:11 +10:00
utf8.h upstream: expose vasnmprintf(); ok (as part of other commit) markus 2020-05-01 16:40:11 +10:00
verify.c
version.h upstream: openssh 8.4 2020-09-27 17:23:20 +10:00
xmalloc.c upstream: add xvasprintf() 2019-11-13 10:15:46 +11:00
xmalloc.h upstream: add xvasprintf() 2019-11-13 10:15:46 +11:00
xmss_commons.c wrap stdint.h include in HAVE_STDINT_H 2019-10-09 09:06:35 +11:00
xmss_commons.h
xmss_fast.c wrap stdint.h include in HAVE_STDINT_H 2019-10-09 09:06:35 +11:00
xmss_fast.h
xmss_hash.c wrap stdint.h include in HAVE_STDINT_H 2019-10-09 09:06:35 +11:00
xmss_hash.h
xmss_hash_address.c wrap stdint.h include in HAVE_STDINT_H 2019-10-09 09:06:35 +11:00
xmss_hash_address.h
xmss_wots.c wrap stdint.h include in HAVE_STDINT_H 2019-10-09 09:06:35 +11:00
xmss_wots.h

README.md

Portable OpenSSH

Fuzzing Status

OpenSSH is a complete implementation of the SSH protocol (version 2) for secure remote login, command execution and file transfer. It includes a client ssh and server sshd, file transfer utilities scp and sftp as well as tools for key generation (ssh-keygen), run-time key storage (ssh-agent) and a number of supporting programs.

This is a port of OpenBSD's OpenSSH to most Unix-like operating systems, including Linux, OS X and Cygwin. Portable OpenSSH polyfills OpenBSD APIs that are not available elsewhere, adds sshd sandboxing for more operating systems and includes support for OS-native authentication and auditing (e.g. using PAM).

Documentation

The official documentation for OpenSSH are the man pages for each tool:

Stable Releases

Stable release tarballs are available from a number of download mirrors. We recommend the use of a stable release for most users. Please read the release notes for details of recent changes and potential incompatibilities.

Building Portable OpenSSH

Dependencies

Portable OpenSSH is built using autoconf and make. It requires a working C compiler, standard library and headers, and zlib. libcrypto from either LibreSSL or OpenSSL may also be used, but OpenSSH may be built without it supporting a subset of crypto algorithms.

FIDO security token support need libfido2 and its dependencies. Also, certain platforms and build-time options may require additional dependencies, see README.platform for details.

Building a release

Releases include a pre-built copy of the configure script and may be built using:

tar zxvf openssh-X.YpZ.tar.gz
cd openssh
./configure # [options]
make && make tests

See the Build-time Customisation section below for configure options. If you plan on installing OpenSSH to your system, then you will usually want to specify destination paths.

Building from git

If building from git, you'll need autoconf installed to build the configure script. The following commands will check out and build portable OpenSSH from git:

git clone https://github.com/openssh/openssh-portable # or https://anongit.mindrot.org/openssh.git
cd openssh-portable
autoreconf
./configure
make && make tests

Build-time Customisation

There are many build-time customisation options available. All Autoconf destination path flags (e.g. --prefix) are supported (and are usually required if you want to install OpenSSH).

For a full list of available flags, run configure --help but a few of the more frequently-used ones are described below. Some of these flags will require additional libraries and/or headers be installed.

Flag Meaning
--with-pam Enable PAM support. OpenPAM, Linux PAM and Solaris PAM are supported.
--with-libedit Enable libedit support for sftp.
--with-kerberos5 Enable Kerberos/GSSAPI support. Both Heimdal and MIT Kerberos implementations are supported.
--with-selinux Enable SELinux support.
--with-security-key-builtin Include built-in support for U2F/FIDO2 security keys. This requires libfido2 be installed.

Development

Portable OpenSSH development is discussed on the openssh-unix-dev mailing list (archive mirror). Bugs and feature requests are tracked on our Bugzilla.

Reporting bugs

Non-security bugs may be reported to the developers via Bugzilla or via the mailing list above. Security bugs should be reported to openssh@openssh.com.