1# Portable OpenSSH 2 3[](../../actions/workflows/c-cpp.yml) 4[](../../actions/workflows/vm.yml) 5[](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/selfhosted.yml) 6[](../../actions/workflows/cifuzz.yml) 7[](https://issues.oss-fuzz.com/issues?q="Project:+openssh"+is:open) 8[](https://scan.coverity.com/projects/openssh-portable) 9 10OpenSSH is a complete implementation of the SSH protocol (version 2) for secure remote login, command execution and file transfer. It includes a client ``ssh`` and server ``sshd``, file transfer utilities ``scp`` and ``sftp`` as well as tools for key generation (``ssh-keygen``), run-time key storage (``ssh-agent``) and a number of supporting programs. 11 12This is a port of OpenBSD's [OpenSSH](https://openssh.com) to most Unix-like operating systems, including Linux, OS X and Cygwin. Portable OpenSSH polyfills OpenBSD APIs that are not available elsewhere, adds sshd sandboxing for more operating systems and includes support for OS-native authentication and auditing (e.g. using PAM). 13 14## Documentation 15 16The official documentation for OpenSSH are the man pages for each tool: 17 18* [ssh(1)](https://man.openbsd.org/ssh.1) 19* [sshd(8)](https://man.openbsd.org/sshd.8) 20* [ssh-keygen(1)](https://man.openbsd.org/ssh-keygen.1) 21* [ssh-agent(1)](https://man.openbsd.org/ssh-agent.1) 22* [scp(1)](https://man.openbsd.org/scp.1) 23* [sftp(1)](https://man.openbsd.org/sftp.1) 24* [ssh-keyscan(8)](https://man.openbsd.org/ssh-keyscan.8) 25* [sftp-server(8)](https://man.openbsd.org/sftp-server.8) 26 27## Stable Releases 28 29Stable release tarballs are available from a number of [download mirrors](https://www.openssh.com/portable.html#downloads). We recommend the use of a stable release for most users. Please read the [release notes](https://www.openssh.com/releasenotes.html) for details of recent changes and potential incompatibilities. 30 31## Building Portable OpenSSH 32 33### Dependencies 34 35Portable OpenSSH is built using autoconf and make. It requires a working C compiler, standard library and headers. 36 37``libcrypto`` from one of [LibreSSL](https://www.libressl.org/), [OpenSSL](https://www.openssl.org), [AWS-LC](https://github.com/aws/aws-lc) or [BoringSSL](https://github.com/google/boringssl) may also be used. OpenSSH may be built without either of these, but the resulting binaries will have only a subset of the cryptographic algorithms normally available. 38 39[zlib](https://www.zlib.net/) is optional; without it transport compression is not supported. 40 41FIDO security token support needs [libfido2](https://github.com/Yubico/libfido2) and its dependencies and will be enabled automatically if they are found. 42 43In addition, certain platforms and build-time options may require additional dependencies; see README.platform for details about your platform. 44 45### Building a release 46 47Release tarballs and release branches in git include a pre-built copy of the ``configure`` script and may be built using: 48 49``` 50tar zxvf openssh-X.YpZ.tar.gz 51cd openssh 52./configure # [options] 53make && make tests 54``` 55 56See the [Build-time Customisation](#build-time-customisation) section below for configure options. If you plan on installing OpenSSH to your system, then you will usually want to specify destination paths. 57 58### Building from git 59 60If building from the git master branch, you'll need [autoconf](https://www.gnu.org/software/autoconf/) installed to build the ``configure`` script. The following commands will check out and build portable OpenSSH from git: 61 62``` 63git clone https://github.com/openssh/openssh-portable # or https://anongit.mindrot.org/openssh.git 64cd openssh-portable 65autoreconf 66./configure 67make && make tests 68``` 69 70### Build-time Customisation 71 72There are many build-time customisation options available. All Autoconf destination path flags (e.g. ``--prefix``) are supported (and are usually required if you want to install OpenSSH). 73 74For a full list of available flags, run ``./configure --help`` but a few of the more frequently-used ones are described below. Some of these flags will require additional libraries and/or headers be installed. 75 76Flag | Meaning 77--- | --- 78``--with-pam`` | Enable [PAM](https://en.wikipedia.org/wiki/Pluggable_authentication_module) support. [OpenPAM](https://www.openpam.org/), [Linux PAM](http://www.linux-pam.org/) and Solaris PAM are supported. 79``--with-libedit`` | Enable [libedit](https://www.thrysoee.dk/editline/) support for sftp. 80``--with-kerberos5`` | Enable Kerberos/GSSAPI support. Both [Heimdal](https://www.h5l.org/) and [MIT](https://web.mit.edu/kerberos/) Kerberos implementations are supported. 81``--with-selinux`` | Enable [SELinux](https://en.wikipedia.org/wiki/Security-Enhanced_Linux) support. 82 83## Development 84 85Portable OpenSSH development is discussed on the [openssh-unix-dev mailing list](https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev) ([archive mirror](https://marc.info/?l=openssh-unix-dev)). Bugs and feature requests are tracked on our [Bugzilla](https://bugzilla.mindrot.org/). 86 87## Reporting bugs 88 89_Non-security_ bugs may be reported to the developers via [Bugzilla](https://bugzilla.mindrot.org/) or via the mailing list above. Security bugs should be reported to [openssh@openssh.com](mailto:openssh.openssh.com). 90
){kind=link}
){kind=link}
){kind=link}