INSTALL revision 7c478bd95313f5f23a4c958a745db2134aa03244
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosiński1. Prerequisites
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosiński----------------
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof KosińskiYou will need working installations of Zlib and OpenSSL.
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosińskihttp://www.freesoftware.com/pub/infozip/zlib/
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof KosińskiOpenSSL 0.9.5a or greater:
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof KosińskiRPMs of OpenSSL are available at http://violet.ibs.com.au/openssh/files/support
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof KosińskiOpenSSH can utilise Pluggable Authentication Modules (PAM) if your system
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosińskisupports it. PAM is standard on Redhat and Debian Linux and on Solaris.
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof KosińskiIf you wish to build the GNOME passphrase requester, you will need the GNOME
3a3365c39fe3932d005ae1aa4324ef48606f5e18Krzysztof Kosińskilibraries and headers.
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof KosińskiAlternatively, Jim Knoble <jmknoble@pobox.com> has written an excellent X11
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosińskipassphrase requester. This is maintained separately at:
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosińskihttp://www.ntrnet.net/~jmknoble/software/x11-ssh-askpass/index.html
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof KosińskiThe Entropy Gathering Daemon (EGD) is supported if you have a system which
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosińskilacks /dev/random and don't want to use OpenSSH's internal entropy collection.
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof KosińskiOpenSSH has only been tested with GNU make. It may work with other
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosiński'make' programs, but you are on your own.
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosińskipcre (POSIX Regular Expression library):
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosińskiftp://ftp.cus.cam.ac.uk/pub/software/programs/pcre/
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof KosińskiMost platforms do not required this. However older 4.3 BSD do not
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosińskihave a posix regex library.
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosiński2. Building / Installation
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosiński--------------------------
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof KosińskiTo install OpenSSH with default options:
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof KosińskiThis will install the OpenSSH binaries in /usr/local/bin, configuration files
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosińskiin /usr/local/etc, the server in /usr/local/sbin, etc. To specify a different
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosińskiinstallation prefix, use the --prefix option to configure:
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosiński./configure --prefix=/opt
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof KosińskiWill install OpenSSH in /opt/{bin,etc,lib,sbin}. You can also override
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosińskispecific paths, for example:
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosiński./configure --prefix=/opt --sysconfdir=/etc/ssh
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof KosińskiThis will install the binaries in /opt/{bin,lib,sbin}, but will place the
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosińskiconfiguration files in /etc/ssh.
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof KosińskiIf you are using PAM, you will need to manually install a PAM
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosińskicontrol file as "/etc/pam.d/sshd" (or wherever your system
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosińskiprefers to keep them). A generic PAM configuration is included as
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosiński"contrib/sshd.pam.generic", you may need to edit it before using it on
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosińskiyour system. If you are using a recent version of Redhat Linux, the
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosińskiconfig file in contrib/redhat/sshd.pam should be more useful.
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof KosińskiFailure to install a valid PAM file may result in an inability to
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosińskiuse password authentication.
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof KosińskiThere are a few other options to the configure script:
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosiński--with-rsh=PATH allows you to specify the path to your rsh program.
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof KosińskiNormally ./configure will search the current $PATH for 'rsh'. You
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosińskimay need to specify this option if rsh is not in your path or has a
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosińskidifferent name.
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosiński--without-pam will disable PAM support. PAM is automatically detected
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosińskiand switched on if found.
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosiński--enable-gnome-askpass will build the GNOME passphrase dialog. You
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosińskineed a working installation of GNOME, including the development
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosińskiheaders, for this to work.
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosiński--with-random=/some/file allows you to specify an alternate source of
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosińskirandom numbers (the default is /dev/urandom). Unless you are absolutely
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosińskisure of what you are doing, it is best to leave this alone.
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosiński--with-egd-pool=/some/file allows you to enable Entropy Gathering
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof KosińskiDaemon support and to specify a EGD pool socket. Use this if your
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof KosińskiUnix lacks /dev/random and you don't want to use OpenSSH's builtin
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosińskientropy collection support.
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosiński--with-lastlog=FILE will specify the location of the lastlog file.
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosiński./configure searches a few locations for lastlog, but may not find
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosińskiit if lastlog is installed in a different place.
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosiński--without-lastlog will disable lastlog support entirely.
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosiński--with-kerberos4=PATH will enable Kerberos IV support. You will need
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosińskito have the Kerberos libraries and header files installed for this
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosińskito work. Use the optional PATH argument to specify the root of your
3a3365c39fe3932d005ae1aa4324ef48606f5e18Krzysztof KosińskiKerberos installation.
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosiński--with-afs=PATH will enable AFS support. You will need to have the
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof KosińskiKerberos IV and the AFS libraries and header files installed for this
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosińskito work. Use the optional PATH argument to specify the root of your
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof KosińskiAFS installation. AFS requires Kerberos support to be enabled.
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosiński--with-skey will enable S/Key one time password support. You will need
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosińskithe S/Key libraries and header files installed for this to work.
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosiński--with-tcp-wrappers will enable TCP Wrappers (/etc/hosts.allow|deny)
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosińskisupport. You will need libwrap.a and tcpd.h installed.
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosiński--with-md5-passwords will enable the use of MD5 passwords. Enable this
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosińskiif your operating system uses MD5 passwords without using PAM.
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosiński--with-utmpx enables utmpx support. utmpx support is automatic for
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosińskisome platforms.
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosiński--without-shadow disables shadow password support.
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosiński--with-ipaddr-display forces the use of a numeric IP address in the
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosiński$DISPLAY environment variable. Some broken systems need this.
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosiński--with-default-path=PATH allows you to specify a default $PATH for sessions
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosińskistarted by sshd. This replaces the standard path entirely.
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosiński--with-pid-dir=PATH specifies the directory in which the ssh.pid file is
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosiński--with-xauth=PATH specifies the location of the xauth binary
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosiński--with-ipv4-default instructs OpenSSH to use IPv4 by default for new
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosińskiconnections. Normally OpenSSH will try attempt to lookup both IPv6 and
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof KosińskiIPv4 addresses. On Linux/glibc-2.1.2 this causes long delays in name
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosińskiresolution. If this option is specified, you can still attempt to
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosińskiconnect to IPv6 addresses using the command line option '-6'.
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosiński--with-ssl-dir=DIR allows you to specify where your OpenSSL libraries
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosiński--with-4in6 Check for IPv4 in IPv6 mapped addresses and convert them to
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosińskireal (AF_INET) IPv4 addresses. Works around some quirks on Linux.
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof KosińskiIf you need to pass special options to the compiler or linker, you
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosińskican specify these as environment variables before running ./configure.
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof KosińskiCFLAGS="-O -m486" LDFLAGS="-s" LIBS="-lrubbish" LD="/usr/foo/ld" ./configure
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosiński3. Configuration
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosiński----------------
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof KosińskiThe runtime configuration files are installed by in ${prefix}/etc or
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosińskiwhatever you specified as your --sysconfdir (/usr/local/etc by default).
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof KosińskiThe default configuration should be instantly usable, though you should
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosińskireview it to ensure that it matches your security requirements.
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof KosińskiTo generate a host key, run "make host-key". Alternately you can do so
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosińskimanually using the following commands:
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosiński ssh-keygen -b 1024 -f /etc/ssh/ssh_host_key -N ""
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosiński ssh-keygen -d -f /etc/ssh/ssh_host_dsa_key -N ""
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof KosińskiReplacing /etc/ssh with the correct path to the configuration directory.
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosiński(${prefix}/etc or whatever you specified with --sysconfdir during
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof KosińskiIf you have configured OpenSSH with EGD support, ensure that EGD is
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosińskirunning and has collected some Entropy.
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof KosińskiFor more information on configuration, please refer to the manual pages
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof Kosińskifor sshd, ssh and ssh-agent.
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof KosińskiIf you experience problems compiling, installing or running OpenSSH.
d1bde559850436556ebee2e70e10f1cfc8aff636Krzysztof KosińskiPlease refer to the "reporting bugs" section of the webpage at