Portable OpenSSH
Go to file
djm@openbsd.org f80d7d6aa9 upstream: weaken the language for what HashKnownHosts provides with
regards to known_hosts name privacy, it's not practical for this option to
offer any guarantee that hostnames cannot be recovered from a disclosed
known_hosts file (e.g. by brute force).

OpenBSD-Commit-ID: 13f1e3285f8acf7244e9770074296bcf446c6972
2020-01-25 18:20:01 +11:00
contrib Fix typo: 'you' -> 'your'. 2020-01-06 09:02:53 +11:00
openbsd-compat include tunnel device path in error message 2020-01-25 16:30:22 +11:00
regress upstream: Move setting $NC into test-exec since it's now used by 2020-01-25 14:33:53 +11:00
.depend depend 2020-01-21 12:20:05 +11:00
.gitignore Add config.log to .gitignore 2020-01-16 13:27:23 +11:00
.skipped-commit-ids
aclocal.m4
addrmatch.c
atomicio.c
atomicio.h
audit-bsm.c
audit-linux.c
audit.c
audit.h
auth2-chall.c
auth2-gss.c
auth2-hostbased.c upstream: Add new structure for signature options 2019-11-25 12:23:33 +11:00
auth2-kbdint.c
auth2-none.c
auth2-passwd.c
auth2-pubkey.c upstream: Replace all calls to signal(2) with a wrapper around 2020-01-23 18:51:25 +11:00
auth2.c
auth-bsdauth.c
auth-krb5.c
auth-options.c upstream: add a "no-touch-required" option for authorized_keys and 2019-11-25 12:23:40 +11:00
auth-options.h upstream: add a "no-touch-required" option for authorized_keys and 2019-11-25 12:23:40 +11:00
auth-pam.c Fix a couple of mysig_t leftovers. 2020-01-23 21:06:45 +11:00
auth-pam.h
auth-passwd.c
auth-rhosts.c
auth-shadow.c
auth-sia.c
auth-sia.h
auth.c upstream: Replace all calls to signal(2) with a wrapper around 2020-01-23 18:51:25 +11:00
auth.h
authfd.c upstream: Allow forwarding a different agent socket to the path 2019-12-21 13:22:07 +11:00
authfd.h upstream: Allow forwarding a different agent socket to the path 2019-12-21 13:22:07 +11:00
authfile.c upstream: add sshkey_save_public(), to save a public key; ok 2020-01-03 09:41:20 +11:00
authfile.h upstream: add sshkey_save_public(), to save a public key; ok 2020-01-03 09:41:20 +11:00
bitmap.c
bitmap.h
buildpkg.sh.in
canohost.c
canohost.h
chacha.c
chacha.h
channels.c upstream: the GatewayPorts vs -R listen address selection logic is 2020-01-25 18:20:01 +11:00
channels.h
cipher-aes.c
cipher-aesctr.c
cipher-aesctr.h
cipher-chachapoly.c
cipher-chachapoly.h
cipher-ctr.c
cipher.c upstream: Make zlib optional. This adds a "ZLIB" build time option 2020-01-23 21:53:54 +11:00
cipher.h upstream: Make zlib optional. This adds a "ZLIB" build time option 2020-01-23 21:53:54 +11:00
cleanup.c
clientloop.c upstream: allow UpdateKnownHosts=yes to function when multiple 2020-01-25 11:35:56 +11:00
clientloop.h
compat.c
compat.h
config.guess
config.sub
configure.ac Plumb WITH_ZLIB into configure. 2020-01-23 22:16:51 +11:00
CREDITS
crypto_api.h
defines.h
dh.c
dh.h
digest-libc.c
digest-openssl.c Remove configure test & compat code for ripemd160. 2020-01-14 12:05:00 +11:00
digest.h
dispatch.c
dispatch.h
dns.c
dns.h
ed25519.c
entropy.c Fix a couple of mysig_t leftovers. 2020-01-23 21:06:45 +11:00
entropy.h
fatal.c
fe25519.c
fe25519.h
fixalgorithms
fixpaths
ge25519_base.data
ge25519.c
ge25519.h
groupaccess.c
groupaccess.h
gss-genr.c
gss-serv-krb5.c
gss-serv.c
hash.c Wrap sha2.h include in ifdef. 2019-11-29 20:21:36 +11:00
hmac.c
hmac.h
hostfile.c upstream: allow UpdateKnownHosts=yes to function when multiple 2020-01-25 11:35:56 +11:00
hostfile.h
includes.h
INSTALL zlib is now optional. 2020-01-23 22:17:24 +11:00
install-sh
kex.c upstream: Make zlib optional. This adds a "ZLIB" build time option 2020-01-23 21:53:54 +11:00
kex.h
kexc25519.c
kexdh.c
kexecdh.c
kexgen.c upstream: Add new structure for signature options 2019-11-25 12:23:33 +11:00
kexgex.c
kexgexc.c upstream: Add new structure for signature options 2019-11-25 12:23:33 +11:00
kexgexs.c
kexsntrup4591761x25519.c
krl.c upstream: Add new structure for signature options 2019-11-25 12:23:33 +11:00
krl.h
LICENCE
log.c
log.h
loginrec.c
loginrec.h
logintest.c
mac.c
mac.h
Makefile.in only link ssh-sk-helper against libfido2 2019-12-14 08:40:58 +11:00
match.c
match.h
md5crypt.c
md5crypt.h
mdoc2man.awk
misc.c upstream: add xextendf() to extend a string with a format 2020-01-25 11:27:29 +11:00
misc.h upstream: add xextendf() to extend a string with a format 2020-01-25 11:27:29 +11:00
mkinstalldirs
moduli
moduli.5
moduli.c
monitor_fdpass.c
monitor_fdpass.h
monitor_wrap.c upstream: allow security keys to act as host keys as well as user 2019-12-16 14:19:41 +11:00
monitor_wrap.h upstream: Add new structure for signature options 2019-11-25 12:23:33 +11:00
monitor.c upstream: Replace all calls to signal(2) with a wrapper around 2020-01-23 18:51:25 +11:00
monitor.h
msg.c upstream: some __func__ and strerror(errno) here; no functional 2020-01-22 17:17:51 +11:00
msg.h
mux.c upstream: Replace all calls to signal(2) with a wrapper around 2020-01-23 18:51:25 +11:00
myproposal.h upstream: remove ssh-rsa (SHA1) from the list of allowed CA 2020-01-25 11:27:29 +11:00
nchan2.ms
nchan.c
nchan.ms
openssh.xml.in
opensshd.init.in
OVERVIEW
packet.c upstream: Fix typo in comment. 2020-01-23 22:33:18 +11:00
packet.h
pathnames.h
pkcs11.h
platform-misc.c
platform-pledge.c
platform-tracing.c
platform.c
platform.h
poly1305.c
poly1305.h
progressmeter.c upstream: Replace all calls to signal(2) with a wrapper around 2020-01-23 18:51:25 +11:00
progressmeter.h
PROTOCOL
PROTOCOL.agent
PROTOCOL.certkeys upstream: document the "no-touch-required" certificate extension; 2019-11-25 12:25:53 +11:00
PROTOCOL.chacha20poly1305
PROTOCOL.key
PROTOCOL.krl
PROTOCOL.mux
PROTOCOL.sshsig
PROTOCOL.u2f upstream: Extends the SK API to accept a set of key/value options 2020-01-06 13:12:46 +11:00
readconf.c upstream: set UpdateKnownHosts=ask by default; bz#2894; ok 2020-01-25 11:36:20 +11:00
readconf.h upstream: Remove unsupported algorithms from list of defaults at run 2020-01-23 14:40:15 +11:00
README
README.dns
README.md Fix typo in README.md, s/crytpo/crypto/ 2020-01-16 13:26:46 +11:00
README.platform
README.privsep
README.tun
readpass.c upstream: Replace all calls to signal(2) with a wrapper around 2020-01-23 18:51:25 +11:00
rijndael.c
rijndael.h
sandbox-capsicum.c
sandbox-darwin.c sandbox-darwin.c: fix missing prototypes. 2020-01-21 10:37:25 +11:00
sandbox-null.c
sandbox-pledge.c
sandbox-rlimit.c
sandbox-seccomp-filter.c Deny (non-fatal) ipc in preauth privsep child. 2020-01-08 21:47:44 +11:00
sandbox-solaris.c
sandbox-systrace.c upstream: Replace all calls to signal(2) with a wrapper around 2020-01-23 18:51:25 +11:00
sc25519.c
sc25519.h
scp.1 upstream: tweak the Nd lines for a bit of consistency; ok markus 2019-12-11 19:08:22 +11:00
scp.c upstream: Replace all calls to signal(2) with a wrapper around 2020-01-23 18:51:25 +11:00
servconf.c upstream: Make zlib optional. This adds a "ZLIB" build time option 2020-01-23 21:53:54 +11:00
servconf.h upstream: allow security keys to act as host keys as well as user 2019-12-16 14:19:41 +11:00
serverloop.c upstream: unrevert this: 2020-01-25 15:51:20 +11:00
serverloop.h
session.c upstream: Replace all calls to signal(2) with a wrapper around 2020-01-23 18:51:25 +11:00
session.h
sftp-client.c
sftp-client.h
sftp-common.c
sftp-common.h
sftp-glob.c
sftp-realpath.c
sftp-server-main.c
sftp-server.8 upstream: tweak the Nd lines for a bit of consistency; ok markus 2019-12-11 19:08:22 +11:00
sftp-server.c
sftp.1 upstream: tweak the Nd lines for a bit of consistency; ok markus 2019-12-11 19:08:22 +11:00
sftp.c upstream: Replace all calls to signal(2) with a wrapper around 2020-01-23 18:51:25 +11:00
sftp.h
sk-api.h upstream: Extends the SK API to accept a set of key/value options 2020-01-06 13:12:46 +11:00
sk-usbhid.c upstream: missing else in check_enroll_options() 2020-01-06 13:40:28 +11:00
smult_curve25519_ref.c
sntrup4591761.c
sntrup4591761.sh
ssh2.h
ssh_api.c
ssh_api.h
ssh_config
ssh_config.5 upstream: weaken the language for what HashKnownHosts provides with 2020-01-25 18:20:01 +11:00
ssh-add.1 upstream: Document loading of resident keys from a FIDO 2020-01-21 18:09:09 +11:00
ssh-add.c upstream: Document loading of resident keys from a FIDO 2020-01-21 18:09:09 +11:00
ssh-agent.1 upstream: Replace the term "security key" with "(FIDO) 2019-12-30 14:31:40 +11:00
ssh-agent.c upstream: process security key provider via realpath() in agent, 2020-01-25 11:35:56 +11:00
ssh-dss.c
ssh-ecdsa-sk.c Fix building without openssl. 2020-01-20 21:14:46 +11:00
ssh-ecdsa.c
ssh-ed25519-sk.c Include compat header for definitions. 2020-01-14 14:28:01 +11:00
ssh-ed25519.c
ssh-gss.h
ssh-keygen.1 upstream: ssh-keygen -Y find-principals fixes based on feedback 2020-01-25 11:27:29 +11:00
ssh-keygen.c Put EC key export inside OPENSSL_HAS_ECC. 2020-01-25 13:05:42 +11:00
ssh-keyscan.1 upstream: tweak the Nd lines for a bit of consistency; ok markus 2019-12-11 19:08:22 +11:00
ssh-keyscan.c upstream: allow ssh-keyscan to find security key hostkeys 2019-12-16 14:19:41 +11:00
ssh-keysign.8 upstream: tweak the Nd lines for a bit of consistency; ok markus 2019-12-11 19:08:22 +11:00
ssh-keysign.c
ssh-pkcs11-client.c upstream: expose PKCS#11 key labels/X.509 subjects as comments 2020-01-25 11:35:55 +11:00
ssh-pkcs11-helper.8 upstream: tweak the Nd lines for a bit of consistency; ok markus 2019-12-11 19:08:22 +11:00
ssh-pkcs11-helper.c upstream: expose PKCS#11 key labels/X.509 subjects as comments 2020-01-25 11:35:55 +11:00
ssh-pkcs11.c upstream: expose PKCS#11 key labels/X.509 subjects as comments 2020-01-25 11:35:55 +11:00
ssh-pkcs11.h upstream: expose PKCS#11 key labels/X.509 subjects as comments 2020-01-25 11:35:55 +11:00
ssh-rsa.c
ssh-sandbox.h
ssh-sk-client.c upstream: Replace all calls to signal(2) with a wrapper around 2020-01-23 18:51:25 +11:00
ssh-sk-helper.8 upstream: Replace the term "security key" with "(FIDO) 2019-12-30 14:31:40 +11:00
ssh-sk-helper.c upstream: pass the log-on-stderr flag and log level through to 2020-01-21 18:09:09 +11:00
ssh-sk.c Wrap stdint.h inside HAVE_STDINT_H. 2020-01-14 14:41:47 +11:00
ssh-sk.h upstream: pass the log-on-stderr flag and log level through to 2020-01-21 18:09:09 +11:00
ssh-xmss.c
ssh.1 upstream: Replace the term "security key" with "(FIDO) 2019-12-30 14:31:40 +11:00
ssh.c upstream: allow UpdateKnownHosts=yes to function when multiple 2020-01-25 11:35:56 +11:00
ssh.h
sshbuf-getput-basic.c upstream: allow sshbuf_put_stringb(buf, NULL); ok markus@ 2019-12-14 07:17:44 +11:00
sshbuf-getput-crypto.c
sshbuf-misc.c
sshbuf.c upstream: Replace all calls to signal(2) with a wrapper around 2020-01-23 18:51:25 +11:00
sshbuf.h
sshconnect2.c upstream: Make zlib optional. This adds a "ZLIB" build time option 2020-01-23 21:53:54 +11:00
sshconnect.c upstream: Replace all calls to signal(2) with a wrapper around 2020-01-23 18:51:25 +11:00
sshconnect.h
sshd_config
sshd_config.5 upstream: mention that permitopen=/PermitOpen do no name to address 2020-01-25 17:04:14 +11:00
sshd.8 upstream: mention that permitopen=/PermitOpen do no name to address 2020-01-25 17:04:14 +11:00
sshd.c upstream: tweak proctitle to include sshd arguments, as these are 2020-01-25 11:27:29 +11:00
ssherr.c upstream: translate and return error codes; retry on bad PIN 2019-12-30 21:01:51 +11:00
ssherr.h upstream: translate and return error codes; retry on bad PIN 2019-12-30 21:01:51 +11:00
sshkey-xmss.c
sshkey-xmss.h
sshkey.c upstream: fix ssh-keygen not displaying authenticator touch 2020-01-21 18:09:09 +11:00
sshkey.h upstream: SK API and sk-helper error/PIN passing 2019-12-30 20:59:33 +11:00
sshlogin.c
sshlogin.h
sshpty.c
sshpty.h
sshsig.c upstream: ssh-keygen -Y find-principals fixes based on feedback 2020-01-25 11:27:29 +11:00
sshsig.h upstream: ssh-keygen -Y find-principals fixes based on feedback 2020-01-25 11:27:29 +11:00
sshtty.c
survey.sh.in
TODO
ttymodes.c
ttymodes.h
uidswap.c
uidswap.h
umac128.c
umac.c
umac.h
utf8.c
utf8.h
verify.c
version.h
xmalloc.c
xmalloc.h
xmss_commons.c
xmss_commons.h
xmss_fast.c
xmss_fast.h
xmss_hash_address.c
xmss_hash_address.h
xmss_hash.c
xmss_hash.h
xmss_wots.c
xmss_wots.h

Portable OpenSSH

Fuzzing Status

OpenSSH is a complete implementation of the SSH protocol (version 2) for secure remote login, command execution and file transfer. It includes a client ssh and server sshd, file transfer utilities scp and sftp as well as tools for key generation (ssh-keygen), run-time key storage (ssh-agent) and a number of supporting programs.

This is a port of OpenBSD's OpenSSH to most Unix-like operating systems, including Linux, OS X and Cygwin. Portable OpenSSH polyfills OpenBSD APIs that are not available elsewhere, adds sshd sandboxing for more operating systems and includes support for OS-native authentication and auditing (e.g. using PAM).

Documentation

The official documentation for OpenSSH are the man pages for each tool:

Stable Releases

Stable release tarballs are available from a number of download mirrors. We recommend the use of a stable release for most users. Please read the release notes for details of recent changes and potential incompatibilities.

Building Portable OpenSSH

Dependencies

Portable OpenSSH is built using autoconf and make. It requires a working C compiler, standard library and headers, and zlib. libcrypto from either LibreSSL or OpenSSL may also be used, but OpenSSH may be built without it supporting a subset of crypto algorithms. Certain platforms and build-time options may require additional dependencies, see README.platform for details.

Building a release

Releases include a pre-built copy of the configure script and may be built using:

tar zxvf openssh-X.YpZ.tar.gz
cd openssh
./configure # [options]
make && make tests

See the Build-time Customisation section below for configure options. If you plan on installing OpenSSH to your system, then you will usually want to specify destination paths.

Building from git

If building from git, you'll need autoconf installed to build the configure script. The following commands will check out and build portable OpenSSH from git:

git clone https://github.com/openssh/openssh-portable # or https://anongit.mindrot.org/openssh.git
cd openssh-portable
autoreconf
./configure
make && make tests

Build-time Customisation

There are many build-time customisation options available. All Autoconf destination path flags (e.g. --prefix) are supported (and are usually required if you want to install OpenSSH).

For a full list of available flags, run configure --help but a few of the more frequently-used ones are described below. Some of these flags will require additional libraries and/or headers be installed.

Flag Meaning
--with-pam Enable PAM support. OpenPAM, Linux PAM and Solaris PAM are supported.
--with-libedit Enable libedit support for sftp.
--with-kerberos5 Enable Kerberos/GSSAPI support. Both Heimdal and MIT Kerberos implementations are supported.
--with-selinux Enable SELinux support.
--with-security-key-builtin Include built-in support for U2F/FIDO2 security keys. This requires libfido2 be installed.

Development

Portable OpenSSH development is discussed on the openssh-unix-dev mailing list (archive mirror). Bugs and feature requests are tracked on our Bugzilla.

Reporting bugs

Non-security bugs may be reported to the developers via Bugzilla or via the mailing list above. Security bugs should be reported to openssh@openssh.com.