11. Prerequisites 2---------------- 3 4A C compiler. Any C89 or better compiler should work. Where supported, 5configure will attempt to enable the compiler's run-time integrity checking 6options. Some notes about specific compilers: 7 - clang: -ftrapv and -sanitize=integer require the compiler-rt runtime 8 (CC=clang LDFLAGS=--rtlib=compiler-rt ./configure) 9 10You will need working installations of Zlib and libcrypto (LibreSSL / 11OpenSSL) 12 13Zlib 1.1.4 or 1.2.1.2 or greater (earlier 1.2.x versions have problems): 14http://www.gzip.org/zlib/ 15 16libcrypto (LibreSSL or OpenSSL >= 0.9.8f < 1.1.0) 17LibreSSL http://www.libressl.org/ ; or 18OpenSSL http://www.openssl.org/ 19 20LibreSSL/OpenSSL should be compiled as a position-independent library 21(i.e. with -fPIC) otherwise OpenSSH will not be able to link with it. 22If you must use a non-position-independent libcrypto, then you may need 23to configure OpenSSH --without-pie. Note that because of API changes, 24OpenSSL 1.1.x is not currently supported. 25 26The remaining items are optional. 27 28NB. If you operating system supports /dev/random, you should configure 29libcrypto (LibreSSL/OpenSSL) to use it. OpenSSH relies on libcrypto's 30direct support of /dev/random, or failing that, either prngd or egd 31 32PRNGD: 33 34If your system lacks kernel-based random collection, the use of Lutz 35Jaenicke's PRNGd is recommended. 36 37http://prngd.sourceforge.net/ 38 39EGD: 40 41If the kernel lacks /dev/random the Entropy Gathering Daemon (EGD) is 42supported only if libcrypto supports it. 43 44http://egd.sourceforge.net/ 45 46PAM: 47 48OpenSSH can utilise Pluggable Authentication Modules (PAM) if your 49system supports it. PAM is standard most Linux distributions, Solaris, 50HP-UX 11, AIX >= 5.2, FreeBSD and NetBSD. 51 52Information about the various PAM implementations are available: 53 54Solaris PAM: http://www.sun.com/software/solaris/pam/ 55Linux PAM: http://www.kernel.org/pub/linux/libs/pam/ 56OpenPAM: http://www.openpam.org/ 57 58If you wish to build the GNOME passphrase requester, you will need the GNOME 59libraries and headers. 60 61GNOME: 62http://www.gnome.org/ 63 64Alternatively, Jim Knoble <jmknoble@pobox.com> has written an excellent X11 65passphrase requester. This is maintained separately at: 66 67http://www.jmknoble.net/software/x11-ssh-askpass/ 68 69TCP Wrappers: 70 71If you wish to use the TCP wrappers functionality you will need at least 72tcpd.h and libwrap.a, either in the standard include and library paths, 73or in the directory specified by --with-tcp-wrappers. Version 7.6 is 74known to work. 75 76http://ftp.porcupine.org/pub/security/index.html 77 78S/Key Libraries: 79 80If you wish to use --with-skey then you will need the library below 81installed. No other S/Key library is currently known to be supported. 82 83http://www.sparc.spb.su/solaris/skey/ 84 85LibEdit: 86 87sftp supports command-line editing via NetBSD's libedit. If your platform 88has it available natively you can use that, alternatively you might try 89these multi-platform ports: 90 91http://www.thrysoee.dk/editline/ 92http://sourceforge.net/projects/libedit/ 93 94LDNS: 95 96LDNS is a DNS BSD-licensed resolver library which supports DNSSEC. 97 98http://nlnetlabs.nl/projects/ldns/ 99 100Autoconf: 101 102If you modify configure.ac or configure doesn't exist (eg if you checked 103the code out of CVS yourself) then you will need autoconf-2.69 to rebuild 104the automatically generated files by running "autoreconf". Earlier 105versions may also work but this is not guaranteed. 106 107http://www.gnu.org/software/autoconf/ 108 109Basic Security Module (BSM): 110 111Native BSM support is know to exist in Solaris from at least 2.5.1, 112FreeBSD 6.1 and OS X. Alternatively, you may use the OpenBSM 113implementation (http://www.openbsm.org). 114 115 1162. Building / Installation 117-------------------------- 118 119To install OpenSSH with default options: 120 121./configure 122make 123make install 124 125This will install the OpenSSH binaries in /usr/local/bin, configuration files 126in /usr/local/etc, the server in /usr/local/sbin, etc. To specify a different 127installation prefix, use the --prefix option to configure: 128 129./configure --prefix=/opt 130make 131make install 132 133Will install OpenSSH in /opt/{bin,etc,lib,sbin}. You can also override 134specific paths, for example: 135 136./configure --prefix=/opt --sysconfdir=/etc/ssh 137make 138make install 139 140This will install the binaries in /opt/{bin,lib,sbin}, but will place the 141configuration files in /etc/ssh. 142 143If you are using Privilege Separation (which is enabled by default) 144then you will also need to create the user, group and directory used by 145sshd for privilege separation. See README.privsep for details. 146 147If you are using PAM, you may need to manually install a PAM control 148file as "/etc/pam.d/sshd" (or wherever your system prefers to keep 149them). Note that the service name used to start PAM is __progname, 150which is the basename of the path of your sshd (e.g., the service name 151for /usr/sbin/osshd will be osshd). If you have renamed your sshd 152executable, your PAM configuration may need to be modified. 153 154A generic PAM configuration is included as "contrib/sshd.pam.generic", 155you may need to edit it before using it on your system. If you are 156using a recent version of Red Hat Linux, the config file in 157contrib/redhat/sshd.pam should be more useful. Failure to install a 158valid PAM file may result in an inability to use password 159authentication. On HP-UX 11 and Solaris, the standard /etc/pam.conf 160configuration will work with sshd (sshd will match the other service 161name). 162 163There are a few other options to the configure script: 164 165--with-audit=[module] enable additional auditing via the specified module. 166Currently, drivers for "debug" (additional info via syslog) and "bsm" 167(Sun's Basic Security Module) are supported. 168 169--with-pam enables PAM support. If PAM support is compiled in, it must 170also be enabled in sshd_config (refer to the UsePAM directive). 171 172--with-prngd-socket=/some/file allows you to enable EGD or PRNGD 173support and to specify a PRNGd socket. Use this if your Unix lacks 174/dev/random and you don't want to use OpenSSH's builtin entropy 175collection support. 176 177--with-prngd-port=portnum allows you to enable EGD or PRNGD support 178and to specify a EGD localhost TCP port. Use this if your Unix lacks 179/dev/random and you don't want to use OpenSSH's builtin entropy 180collection support. 181 182--with-lastlog=FILE will specify the location of the lastlog file. 183./configure searches a few locations for lastlog, but may not find 184it if lastlog is installed in a different place. 185 186--without-lastlog will disable lastlog support entirely. 187 188--with-osfsia, --without-osfsia will enable or disable OSF1's Security 189Integration Architecture. The default for OSF1 machines is enable. 190 191--with-skey=PATH will enable S/Key one time password support. You will 192need the S/Key libraries and header files installed for this to work. 193 194--with-tcp-wrappers will enable TCP Wrappers (/etc/hosts.allow|deny) 195support. 196 197--with-md5-passwords will enable the use of MD5 passwords. Enable this 198if your operating system uses MD5 passwords and the system crypt() does 199not support them directly (see the crypt(3/3c) man page). If enabled, the 200resulting binary will support both MD5 and traditional crypt passwords. 201 202--with-utmpx enables utmpx support. utmpx support is automatic for 203some platforms. 204 205--without-shadow disables shadow password support. 206 207--with-ipaddr-display forces the use of a numeric IP address in the 208$DISPLAY environment variable. Some broken systems need this. 209 210--with-default-path=PATH allows you to specify a default $PATH for sessions 211started by sshd. This replaces the standard path entirely. 212 213--with-pid-dir=PATH specifies the directory in which the sshd.pid file is 214created. 215 216--with-xauth=PATH specifies the location of the xauth binary 217 218--with-ssl-dir=DIR allows you to specify where your Libre/OpenSSL 219libraries 220are installed. 221 222--with-ssl-engine enables Libre/OpenSSL's (hardware) ENGINE support 223 224--with-4in6 Check for IPv4 in IPv6 mapped addresses and convert them to 225real (AF_INET) IPv4 addresses. Works around some quirks on Linux. 226 227If you need to pass special options to the compiler or linker, you 228can specify these as environment variables before running ./configure. 229For example: 230 231CFLAGS="-O -m486" LDFLAGS="-s" LIBS="-lrubbish" LD="/usr/foo/ld" ./configure 232 2333. Configuration 234---------------- 235 236The runtime configuration files are installed by in ${prefix}/etc or 237whatever you specified as your --sysconfdir (/usr/local/etc by default). 238 239The default configuration should be instantly usable, though you should 240review it to ensure that it matches your security requirements. 241 242To generate a host key, run "make host-key". Alternately you can do so 243manually using the following commands: 244 245 ssh-keygen -t [type] -f /etc/ssh/ssh_host_key -N "" 246 247for each of the types you wish to generate (rsa, dsa or ecdsa) or 248 249 ssh-keygen -A 250 251to generate keys for all supported types. 252 253Replacing /etc/ssh with the correct path to the configuration directory. 254(${prefix}/etc or whatever you specified with --sysconfdir during 255configuration) 256 257If you have configured OpenSSH with EGD support, ensure that EGD is 258running and has collected some Entropy. 259 260For more information on configuration, please refer to the manual pages 261for sshd, ssh and ssh-agent. 262 2634. (Optional) Send survey 264------------------------- 265 266$ make survey 267[check the contents of the file "survey" to ensure there's no information 268that you consider sensitive] 269$ make send-survey 270 271This will send configuration information for the currently configured 272host to a survey address. This will help determine which configurations 273are actually in use, and what valid combinations of configure options 274exist. The raw data is available only to the OpenSSH developers, however 275summary data may be published. 276 2775. Problems? 278------------ 279 280If you experience problems compiling, installing or running OpenSSH. 281Please refer to the "reporting bugs" section of the webpage at 282https://www.openssh.com/ 283