1*0Sstevel@tonic-gate1. Prerequisites 2*0Sstevel@tonic-gate---------------- 3*0Sstevel@tonic-gate 4*0Sstevel@tonic-gateYou will need working installations of Zlib and OpenSSL. 5*0Sstevel@tonic-gate 6*0Sstevel@tonic-gateZlib: 7*0Sstevel@tonic-gatehttp://www.freesoftware.com/pub/infozip/zlib/ 8*0Sstevel@tonic-gate 9*0Sstevel@tonic-gateOpenSSL 0.9.5a or greater: 10*0Sstevel@tonic-gatehttp://www.openssl.org/ 11*0Sstevel@tonic-gate 12*0Sstevel@tonic-gateRPMs of OpenSSL are available at http://violet.ibs.com.au/openssh/files/support 13*0Sstevel@tonic-gate 14*0Sstevel@tonic-gateOpenSSH can utilise Pluggable Authentication Modules (PAM) if your system 15*0Sstevel@tonic-gatesupports it. PAM is standard on Redhat and Debian Linux and on Solaris. 16*0Sstevel@tonic-gate 17*0Sstevel@tonic-gatePAM: 18*0Sstevel@tonic-gatehttp://www.kernel.org/pub/linux/libs/pam/ 19*0Sstevel@tonic-gate 20*0Sstevel@tonic-gateIf you wish to build the GNOME passphrase requester, you will need the GNOME 21*0Sstevel@tonic-gatelibraries and headers. 22*0Sstevel@tonic-gate 23*0Sstevel@tonic-gateGNOME: 24*0Sstevel@tonic-gatehttp://www.gnome.org/ 25*0Sstevel@tonic-gate 26*0Sstevel@tonic-gateAlternatively, Jim Knoble <jmknoble@pobox.com> has written an excellent X11 27*0Sstevel@tonic-gatepassphrase requester. This is maintained separately at: 28*0Sstevel@tonic-gate 29*0Sstevel@tonic-gatehttp://www.ntrnet.net/~jmknoble/software/x11-ssh-askpass/index.html 30*0Sstevel@tonic-gate 31*0Sstevel@tonic-gateThe Entropy Gathering Daemon (EGD) is supported if you have a system which 32*0Sstevel@tonic-gatelacks /dev/random and don't want to use OpenSSH's internal entropy collection. 33*0Sstevel@tonic-gate 34*0Sstevel@tonic-gateEGD: 35*0Sstevel@tonic-gatehttp://www.lothar.com/tech/crypto/ 36*0Sstevel@tonic-gate 37*0Sstevel@tonic-gateGNU Make: 38*0Sstevel@tonic-gateftp://ftp.gnu.org/gnu/make/ 39*0Sstevel@tonic-gate 40*0Sstevel@tonic-gateOpenSSH has only been tested with GNU make. It may work with other 41*0Sstevel@tonic-gate'make' programs, but you are on your own. 42*0Sstevel@tonic-gate 43*0Sstevel@tonic-gatepcre (POSIX Regular Expression library): 44*0Sstevel@tonic-gateftp://ftp.cus.cam.ac.uk/pub/software/programs/pcre/ 45*0Sstevel@tonic-gate 46*0Sstevel@tonic-gateMost platforms do not required this. However older 4.3 BSD do not 47*0Sstevel@tonic-gatehave a posix regex library. 48*0Sstevel@tonic-gate 49*0Sstevel@tonic-gate 50*0Sstevel@tonic-gate2. Building / Installation 51*0Sstevel@tonic-gate-------------------------- 52*0Sstevel@tonic-gate 53*0Sstevel@tonic-gateTo install OpenSSH with default options: 54*0Sstevel@tonic-gate 55*0Sstevel@tonic-gate./configure 56*0Sstevel@tonic-gatemake 57*0Sstevel@tonic-gatemake install 58*0Sstevel@tonic-gate 59*0Sstevel@tonic-gateThis will install the OpenSSH binaries in /usr/local/bin, configuration files 60*0Sstevel@tonic-gatein /usr/local/etc, the server in /usr/local/sbin, etc. To specify a different 61*0Sstevel@tonic-gateinstallation prefix, use the --prefix option to configure: 62*0Sstevel@tonic-gate 63*0Sstevel@tonic-gate./configure --prefix=/opt 64*0Sstevel@tonic-gatemake 65*0Sstevel@tonic-gatemake install 66*0Sstevel@tonic-gate 67*0Sstevel@tonic-gateWill install OpenSSH in /opt/{bin,etc,lib,sbin}. You can also override 68*0Sstevel@tonic-gatespecific paths, for example: 69*0Sstevel@tonic-gate 70*0Sstevel@tonic-gate./configure --prefix=/opt --sysconfdir=/etc/ssh 71*0Sstevel@tonic-gatemake 72*0Sstevel@tonic-gatemake install 73*0Sstevel@tonic-gate 74*0Sstevel@tonic-gateThis will install the binaries in /opt/{bin,lib,sbin}, but will place the 75*0Sstevel@tonic-gateconfiguration files in /etc/ssh. 76*0Sstevel@tonic-gate 77*0Sstevel@tonic-gateIf you are using PAM, you will need to manually install a PAM 78*0Sstevel@tonic-gatecontrol file as "/etc/pam.d/sshd" (or wherever your system 79*0Sstevel@tonic-gateprefers to keep them). A generic PAM configuration is included as 80*0Sstevel@tonic-gate"contrib/sshd.pam.generic", you may need to edit it before using it on 81*0Sstevel@tonic-gateyour system. If you are using a recent version of Redhat Linux, the 82*0Sstevel@tonic-gateconfig file in contrib/redhat/sshd.pam should be more useful. 83*0Sstevel@tonic-gateFailure to install a valid PAM file may result in an inability to 84*0Sstevel@tonic-gateuse password authentication. 85*0Sstevel@tonic-gate 86*0Sstevel@tonic-gateThere are a few other options to the configure script: 87*0Sstevel@tonic-gate 88*0Sstevel@tonic-gate--with-rsh=PATH allows you to specify the path to your rsh program. 89*0Sstevel@tonic-gateNormally ./configure will search the current $PATH for 'rsh'. You 90*0Sstevel@tonic-gatemay need to specify this option if rsh is not in your path or has a 91*0Sstevel@tonic-gatedifferent name. 92*0Sstevel@tonic-gate 93*0Sstevel@tonic-gate--without-pam will disable PAM support. PAM is automatically detected 94*0Sstevel@tonic-gateand switched on if found. 95*0Sstevel@tonic-gate 96*0Sstevel@tonic-gate--enable-gnome-askpass will build the GNOME passphrase dialog. You 97*0Sstevel@tonic-gateneed a working installation of GNOME, including the development 98*0Sstevel@tonic-gateheaders, for this to work. 99*0Sstevel@tonic-gate 100*0Sstevel@tonic-gate--with-random=/some/file allows you to specify an alternate source of 101*0Sstevel@tonic-gaterandom numbers (the default is /dev/urandom). Unless you are absolutely 102*0Sstevel@tonic-gatesure of what you are doing, it is best to leave this alone. 103*0Sstevel@tonic-gate 104*0Sstevel@tonic-gate--with-egd-pool=/some/file allows you to enable Entropy Gathering 105*0Sstevel@tonic-gateDaemon support and to specify a EGD pool socket. Use this if your 106*0Sstevel@tonic-gateUnix lacks /dev/random and you don't want to use OpenSSH's builtin 107*0Sstevel@tonic-gateentropy collection support. 108*0Sstevel@tonic-gate 109*0Sstevel@tonic-gate--with-lastlog=FILE will specify the location of the lastlog file. 110*0Sstevel@tonic-gate./configure searches a few locations for lastlog, but may not find 111*0Sstevel@tonic-gateit if lastlog is installed in a different place. 112*0Sstevel@tonic-gate 113*0Sstevel@tonic-gate--without-lastlog will disable lastlog support entirely. 114*0Sstevel@tonic-gate 115*0Sstevel@tonic-gate--with-kerberos4=PATH will enable Kerberos IV support. You will need 116*0Sstevel@tonic-gateto have the Kerberos libraries and header files installed for this 117*0Sstevel@tonic-gateto work. Use the optional PATH argument to specify the root of your 118*0Sstevel@tonic-gateKerberos installation. 119*0Sstevel@tonic-gate 120*0Sstevel@tonic-gate--with-afs=PATH will enable AFS support. You will need to have the 121*0Sstevel@tonic-gateKerberos IV and the AFS libraries and header files installed for this 122*0Sstevel@tonic-gateto work. Use the optional PATH argument to specify the root of your 123*0Sstevel@tonic-gateAFS installation. AFS requires Kerberos support to be enabled. 124*0Sstevel@tonic-gate 125*0Sstevel@tonic-gate--with-skey will enable S/Key one time password support. You will need 126*0Sstevel@tonic-gatethe S/Key libraries and header files installed for this to work. 127*0Sstevel@tonic-gate 128*0Sstevel@tonic-gate--with-tcp-wrappers will enable TCP Wrappers (/etc/hosts.allow|deny) 129*0Sstevel@tonic-gatesupport. You will need libwrap.a and tcpd.h installed. 130*0Sstevel@tonic-gate 131*0Sstevel@tonic-gate--with-md5-passwords will enable the use of MD5 passwords. Enable this 132*0Sstevel@tonic-gateif your operating system uses MD5 passwords without using PAM. 133*0Sstevel@tonic-gate 134*0Sstevel@tonic-gate--with-utmpx enables utmpx support. utmpx support is automatic for 135*0Sstevel@tonic-gatesome platforms. 136*0Sstevel@tonic-gate 137*0Sstevel@tonic-gate--without-shadow disables shadow password support. 138*0Sstevel@tonic-gate 139*0Sstevel@tonic-gate--with-ipaddr-display forces the use of a numeric IP address in the 140*0Sstevel@tonic-gate$DISPLAY environment variable. Some broken systems need this. 141*0Sstevel@tonic-gate 142*0Sstevel@tonic-gate--with-default-path=PATH allows you to specify a default $PATH for sessions 143*0Sstevel@tonic-gatestarted by sshd. This replaces the standard path entirely. 144*0Sstevel@tonic-gate 145*0Sstevel@tonic-gate--with-pid-dir=PATH specifies the directory in which the ssh.pid file is 146*0Sstevel@tonic-gatecreated. 147*0Sstevel@tonic-gate 148*0Sstevel@tonic-gate--with-xauth=PATH specifies the location of the xauth binary 149*0Sstevel@tonic-gate 150*0Sstevel@tonic-gate--with-ipv4-default instructs OpenSSH to use IPv4 by default for new 151*0Sstevel@tonic-gateconnections. Normally OpenSSH will try attempt to lookup both IPv6 and 152*0Sstevel@tonic-gateIPv4 addresses. On Linux/glibc-2.1.2 this causes long delays in name 153*0Sstevel@tonic-gateresolution. If this option is specified, you can still attempt to 154*0Sstevel@tonic-gateconnect to IPv6 addresses using the command line option '-6'. 155*0Sstevel@tonic-gate 156*0Sstevel@tonic-gate--with-ssl-dir=DIR allows you to specify where your OpenSSL libraries 157*0Sstevel@tonic-gateare installed. 158*0Sstevel@tonic-gate 159*0Sstevel@tonic-gate--with-4in6 Check for IPv4 in IPv6 mapped addresses and convert them to 160*0Sstevel@tonic-gatereal (AF_INET) IPv4 addresses. Works around some quirks on Linux. 161*0Sstevel@tonic-gate 162*0Sstevel@tonic-gateIf you need to pass special options to the compiler or linker, you 163*0Sstevel@tonic-gatecan specify these as environment variables before running ./configure. 164*0Sstevel@tonic-gateFor example: 165*0Sstevel@tonic-gate 166*0Sstevel@tonic-gateCFLAGS="-O -m486" LDFLAGS="-s" LIBS="-lrubbish" LD="/usr/foo/ld" ./configure 167*0Sstevel@tonic-gate 168*0Sstevel@tonic-gate3. Configuration 169*0Sstevel@tonic-gate---------------- 170*0Sstevel@tonic-gate 171*0Sstevel@tonic-gateThe runtime configuration files are installed by in ${prefix}/etc or 172*0Sstevel@tonic-gatewhatever you specified as your --sysconfdir (/usr/local/etc by default). 173*0Sstevel@tonic-gate 174*0Sstevel@tonic-gateThe default configuration should be instantly usable, though you should 175*0Sstevel@tonic-gatereview it to ensure that it matches your security requirements. 176*0Sstevel@tonic-gate 177*0Sstevel@tonic-gateTo generate a host key, run "make host-key". Alternately you can do so 178*0Sstevel@tonic-gatemanually using the following commands: 179*0Sstevel@tonic-gate 180*0Sstevel@tonic-gate ssh-keygen -b 1024 -f /etc/ssh/ssh_host_key -N "" 181*0Sstevel@tonic-gate ssh-keygen -d -f /etc/ssh/ssh_host_dsa_key -N "" 182*0Sstevel@tonic-gate 183*0Sstevel@tonic-gateReplacing /etc/ssh with the correct path to the configuration directory. 184*0Sstevel@tonic-gate(${prefix}/etc or whatever you specified with --sysconfdir during 185*0Sstevel@tonic-gateconfiguration) 186*0Sstevel@tonic-gate 187*0Sstevel@tonic-gateIf you have configured OpenSSH with EGD support, ensure that EGD is 188*0Sstevel@tonic-gaterunning and has collected some Entropy. 189*0Sstevel@tonic-gate 190*0Sstevel@tonic-gateFor more information on configuration, please refer to the manual pages 191*0Sstevel@tonic-gatefor sshd, ssh and ssh-agent. 192*0Sstevel@tonic-gate 193*0Sstevel@tonic-gate4. Problems? 194*0Sstevel@tonic-gate------------ 195*0Sstevel@tonic-gate 196*0Sstevel@tonic-gateIf you experience problems compiling, installing or running OpenSSH. 197*0Sstevel@tonic-gatePlease refer to the "reporting bugs" section of the webpage at 198*0Sstevel@tonic-gatehttp://www.openssh.com/ 199*0Sstevel@tonic-gate 200