11. Prerequisites 2---------------- 3 4You will need working installations of Zlib and OpenSSL. 5 6Zlib: 7http://www.gzip.org/zlib/ 8 9OpenSSL 0.9.6 or greater: 10http://www.openssl.org/ 11 12(OpenSSL 0.9.5a is partially supported, but some ciphers (SSH protocol 1 13Blowfish) do not work correctly.) 14 15OpenSSH can utilise Pluggable Authentication Modules (PAM) if your system 16supports it. PAM is standard on Redhat and Debian Linux, Solaris and 17HP-UX 11. 18 19NB. If you operating system supports /dev/random, you should configure 20OpenSSL to use it. OpenSSH relies on OpenSSL's direct support of 21/dev/random. If you don't you will have to rely on ssh-rand-helper, which 22is inferior to a good kernel-based solution. 23 24PAM: 25http://www.kernel.org/pub/linux/libs/pam/ 26 27If you wish to build the GNOME passphrase requester, you will need the GNOME 28libraries and headers. 29 30GNOME: 31http://www.gnome.org/ 32 33Alternatively, Jim Knoble <jmknoble@jmknoble.cx> has written an excellent X11 34passphrase requester. This is maintained separately at: 35 36http://www.ntrnet.net/~jmknoble/software/x11-ssh-askpass/index.html 37 38PRNGD: 39 40If your system lacks Kernel based random collection, the use of Lutz 41Jaenicke's PRNGd is recommended. 42 43http://www.aet.tu-cottbus.de/personen/jaenicke/postfix_tls/prngd.html 44 45EGD: 46 47The Entropy Gathering Daemon (EGD) is supported if you have a system which 48lacks /dev/random and don't want to use OpenSSH's internal entropy collection. 49 50http://www.lothar.com/tech/crypto/ 51 52S/Key Libraries: 53http://www.sparc.spb.su/solaris/skey/ 54 55If you wish to use --with-skey then you will need the above library 56installed. No other current S/Key library is currently known to be 57supported. 58 592. Building / Installation 60-------------------------- 61 62To install OpenSSH with default options: 63 64./configure 65make 66make install 67 68This will install the OpenSSH binaries in /usr/local/bin, configuration files 69in /usr/local/etc, the server in /usr/local/sbin, etc. To specify a different 70installation prefix, use the --prefix option to configure: 71 72./configure --prefix=/opt 73make 74make install 75 76Will install OpenSSH in /opt/{bin,etc,lib,sbin}. You can also override 77specific paths, for example: 78 79./configure --prefix=/opt --sysconfdir=/etc/ssh 80make 81make install 82 83This will install the binaries in /opt/{bin,lib,sbin}, but will place the 84configuration files in /etc/ssh. 85 86If you are using PAM, you may need to manually install a PAM control 87file as "/etc/pam.d/sshd" (or wherever your system prefers to keep 88them). Note that the service name used to start PAM is __progname, 89which is the basename of the path of your sshd (e.g., the service name 90for /usr/sbin/osshd will be osshd). If you have renamed your sshd 91executable, your PAM configuration may need to be modified. 92 93A generic PAM configuration is included as "contrib/sshd.pam.generic", 94you may need to edit it before using it on your system. If you are 95using a recent version of Red Hat Linux, the config file in 96contrib/redhat/sshd.pam should be more useful. Failure to install a 97valid PAM file may result in an inability to use password 98authentication. On HP-UX 11 and Solaris, the standard /etc/pam.conf 99configuration will work with sshd (sshd will match the other service 100name). 101 102There are a few other options to the configure script: 103 104--with-pam enables PAM support. 105 106--enable-gnome-askpass will build the GNOME passphrase dialog. You 107need a working installation of GNOME, including the development 108headers, for this to work. 109 110--with-prngd-socket=/some/file allows you to enable EGD or PRNGD 111support and to specify a PRNGd socket. Use this if your Unix lacks 112/dev/random and you don't want to use OpenSSH's builtin entropy 113collection support. 114 115--with-prngd-port=portnum allows you to enable EGD or PRNGD support 116and to specify a EGD localhost TCP port. Use this if your Unix lacks 117/dev/random and you don't want to use OpenSSH's builtin entropy 118collection support. 119 120--with-lastlog=FILE will specify the location of the lastlog file. 121./configure searches a few locations for lastlog, but may not find 122it if lastlog is installed in a different place. 123 124--without-lastlog will disable lastlog support entirely. 125 126--with-sia, --without-sia will enable or disable OSF1's Security 127Integration Architecture. The default for OSF1 machines is enable. 128 129--with-kerberos4=PATH will enable Kerberos IV support. You will need 130to have the Kerberos libraries and header files installed for this 131to work. Use the optional PATH argument to specify the root of your 132Kerberos installation. 133 134--with-afs=PATH will enable AFS support. You will need to have the 135Kerberos IV and the AFS libraries and header files installed for this 136to work. Use the optional PATH argument to specify the root of your 137AFS installation. AFS requires Kerberos support to be enabled. 138 139--with-skey=PATH will enable S/Key one time password support. You will 140need the S/Key libraries and header files installed for this to work. 141 142--with-tcp-wrappers will enable TCP Wrappers (/etc/hosts.allow|deny) 143support. You will need libwrap.a and tcpd.h installed. 144 145--with-md5-passwords will enable the use of MD5 passwords. Enable this 146if your operating system uses MD5 passwords without using PAM. 147 148--with-utmpx enables utmpx support. utmpx support is automatic for 149some platforms. 150 151--without-shadow disables shadow password support. 152 153--with-ipaddr-display forces the use of a numeric IP address in the 154$DISPLAY environment variable. Some broken systems need this. 155 156--with-default-path=PATH allows you to specify a default $PATH for sessions 157started by sshd. This replaces the standard path entirely. 158 159--with-pid-dir=PATH specifies the directory in which the ssh.pid file is 160created. 161 162--with-xauth=PATH specifies the location of the xauth binary 163 164--with-ipv4-default instructs OpenSSH to use IPv4 by default for new 165connections. Normally OpenSSH will try attempt to lookup both IPv6 and 166IPv4 addresses. On Linux/glibc-2.1.2 this causes long delays in name 167resolution. If this option is specified, you can still attempt to 168connect to IPv6 addresses using the command line option '-6'. 169 170--with-ssl-dir=DIR allows you to specify where your OpenSSL libraries 171are installed. 172 173--with-4in6 Check for IPv4 in IPv6 mapped addresses and convert them to 174real (AF_INET) IPv4 addresses. Works around some quirks on Linux. 175 176--with-opensc=DIR 177--with-sectok=DIR allows for OpenSC or sectok smartcard libraries to 178be used with OpenSSH. See 'README.smartcard' for more details. 179 180If you need to pass special options to the compiler or linker, you 181can specify these as environment variables before running ./configure. 182For example: 183 184CFLAGS="-O -m486" LDFLAGS="-s" LIBS="-lrubbish" LD="/usr/foo/ld" ./configure 185 1863. Configuration 187---------------- 188 189The runtime configuration files are installed by in ${prefix}/etc or 190whatever you specified as your --sysconfdir (/usr/local/etc by default). 191 192The default configuration should be instantly usable, though you should 193review it to ensure that it matches your security requirements. 194 195To generate a host key, run "make host-key". Alternately you can do so 196manually using the following commands: 197 198 ssh-keygen -t rsa1 -f /etc/ssh/ssh_host_key -N "" 199 ssh-keygen -t rsa -f /etc/ssh/ssh_host_rsa_key -N "" 200 ssh-keygen -t dsa -f /etc/ssh/ssh_host_dsa_key -N "" 201 202Replacing /etc/ssh with the correct path to the configuration directory. 203(${prefix}/etc or whatever you specified with --sysconfdir during 204configuration) 205 206If you have configured OpenSSH with EGD support, ensure that EGD is 207running and has collected some Entropy. 208 209For more information on configuration, please refer to the manual pages 210for sshd, ssh and ssh-agent. 211 2124. Problems? 213------------ 214 215If you experience problems compiling, installing or running OpenSSH. 216Please refer to the "reporting bugs" section of the webpage at 217http://www.openssh.com/ 218 219 220$Id: INSTALL,v 1.55 2002/07/25 04:36:25 djm Exp $ 221