1This package describes important Cygwin specific stuff concerning OpenSSH. 2 3The binary package is usually built for recent Cygwin versions and might 4not run on older versions. Please check http://cygwin.com/ for information 5about current Cygwin releases. 6 7Build instructions are at the end of the file. 8 9=========================================================================== 10Important change since 3.7.1p2-2: 11 12The ssh-host-config file doesn't create the /etc/ssh_config and 13/etc/sshd_config files from builtin here-scripts anymore, but it uses 14skeleton files installed in /etc/defaults/etc. 15 16Also it now tries hard to create appropriate permissions on files. 17Same applies for ssh-user-config. 18 19After creating the sshd service with ssh-host-config, it's advisable to 20call ssh-user-config for all affected users, also already exising user 21configurations. In the latter case, file and directory permissions are 22checked and changed, if requireed to match the host configuration. 23 24Important note for Windows 2003 Server users: 25--------------------------------------------- 26 272003 Server has a funny new feature. When starting services under SYSTEM 28account, these services have nearly all user rights which SYSTEM holds... 29except for the "Create a token object" right, which is needed to allow 30public key authentication :-( 31 32There's no way around this, except for creating a substitute account which 33has the appropriate privileges. Basically, this account should be member 34of the administrators group, plus it should have the following user rights: 35 36 Create a token object 37 Logon as a service 38 Replace a process level token 39 Increase Quota 40 41The ssh-host-config script asks you, if it should create such an account, 42called "sshd_server". If you say "no" here, you're on your own. Please 43follow the instruction in ssh-host-config exactly if possible. Note that 44ssh-user-config sets the permissions on 2003 Server machines dependent of 45whether a sshd_server account exists or not. 46=========================================================================== 47 48=========================================================================== 49Important change since 3.4p1-2: 50 51This version adds privilege separation as default setting, see 52/usr/doc/openssh/README.privsep. According to that document the 53privsep feature requires a non-privileged account called 'sshd'. 54 55The new ssh-host-config file which is part of this version asks 56to create 'sshd' as local user if you want to use privilege 57separation. If you confirm, it creates that NT user and adds 58the necessary entry to /etc/passwd. 59 60On 9x/Me systems the script just sets UsePrivilegeSeparation to "no" 61since that feature doesn't make any sense on a system which doesn't 62differ between privileged and unprivileged users. 63 64The new ssh-host-config script also adds the /var/empty directory 65needed by privilege separation. When creating the /var/empty directory 66by yourself, please note that in contrast to the README.privsep document 67the owner sshould not be "root" but the user which is running sshd. So, 68in the standard configuration this is SYSTEM. The ssh-host-config script 69chowns /var/empty accordingly. 70=========================================================================== 71 72=========================================================================== 73Important change since 3.0.1p1-2: 74 75This version introduces the ability to register sshd as service on 76Windows 9x/Me systems. This is done only when the options -D and/or 77-d are not given. 78=========================================================================== 79 80=========================================================================== 81Important change since 2.9p2: 82 83Since Cygwin is able to switch user context without password beginning 84with version 1.3.2, OpenSSH now allows to do so when it's running under 85a version >= 1.3.2. Keep in mind that `ntsec' has to be activated to 86allow that feature. 87=========================================================================== 88 89=========================================================================== 90Important change since 2.3.0p1: 91 92When using `ntea' or `ntsec' you now have to care for the ownership 93and permission bits of your host key files and your private key files. 94The host key files have to be owned by the NT account which starts 95sshd. The user key files have to be owned by the user. The permission 96bits of the private key files (host and user) have to be at least 97rw------- (0600)! 98 99Note that this is forced under `ntsec' only if the files are on a NTFS 100filesystem (which is recommended) due to the lack of any basic security 101features of the FAT/FAT32 filesystems. 102=========================================================================== 103 104If you are installing OpenSSH the first time, you can generate global config 105files and server keys by running 106 107 /usr/bin/ssh-host-config 108 109Note that this binary archive doesn't contain default config files in /etc. 110That files are only created if ssh-host-config is started. 111 112If you are updating your installation you may run the above ssh-host-config 113as well to move your configuration files to the new location and to 114erase the files at the old location. 115 116To support testing and unattended installation ssh-host-config got 117some options: 118 119usage: ssh-host-config [OPTION]... 120Options: 121 --debug -d Enable shell's debug output. 122 --yes -y Answer all questions with "yes" automatically. 123 --no -n Answer all questions with "no" automatically. 124 --cygwin -c <options> Use "options" as value for CYGWIN environment var. 125 --port -p <n> sshd listens on port n. 126 --pwd -w <passwd> Use "pwd" as password for user 'sshd_server'. 127 128Additionally ssh-host-config now asks if it should install sshd as a 129service when running under NT/W2K. This requires cygrunsrv installed. 130 131You can create the private and public keys for a user now by running 132 133 /usr/bin/ssh-user-config 134 135under the users account. 136 137To support testing and unattended installation ssh-user-config got 138some options as well: 139 140usage: ssh-user-config [OPTION]... 141Options: 142 --debug -d Enable shell's debug output. 143 --yes -y Answer all questions with "yes" automatically. 144 --no -n Answer all questions with "no" automatically. 145 --passphrase -p word Use "word" as passphrase automatically. 146 147Install sshd as daemon via cygrunsrv.exe (recommended on NT/W2K), via inetd 148(results in very slow deamon startup!) or from the command line (recommended 149on 9X/ME). 150 151If you start sshd as deamon via cygrunsrv.exe you MUST give the 152"-D" option to sshd. Otherwise the service can't get started at all. 153 154If starting via inetd, copy sshd to eg. /usr/sbin/in.sshd and add the 155following line to your inetd.conf file: 156 157ssh stream tcp nowait root /usr/sbin/in.sshd sshd -i 158 159Moreover you'll have to add the following line to your 160${SYSTEMROOT}/system32/drivers/etc/services file: 161 162 ssh 22/tcp #SSH daemon 163 164Please note that OpenSSH does never use the value of $HOME to 165search for the users configuration files! It always uses the 166value of the pw_dir field in /etc/passwd as the home directory. 167If no home diretory is set in /etc/passwd, the root directory 168is used instead! 169 170You may use all features of the CYGWIN=ntsec setting the same 171way as they are used by Cygwin's login(1) port: 172 173 The pw_gecos field may contain an additional field, that begins 174 with (upper case!) "U-", followed by the domain and the username 175 separated by a backslash. 176 CAUTION: The SID _must_ remain the _last_ field in pw_gecos! 177 BTW: The field separator in pw_gecos is the comma. 178 The username in pw_name itself may be any nice name: 179 180 domuser::1104:513:John Doe,U-domain\user,S-1-5-21-... 181 182 Now you may use `domuser' as your login name with telnet! 183 This is possible additionally for local users, if you don't like 184 your NT login name ;-) You only have to leave out the domain: 185 186 locuser::1104:513:John Doe,U-user,S-1-5-21-... 187 188Note that the CYGWIN=ntsec setting is required for public key authentication. 189 190SSH2 server and user keys are generated by the `ssh-*-config' scripts 191as well. 192 193If you want to build from source, the following options to 194configure are used for the Cygwin binary distribution: 195 196 --prefix=/usr \ 197 --sysconfdir=/etc \ 198 --libexecdir='$(sbindir)' \ 199 --localstatedir=/var \ 200 --datadir='$(prefix)/share' \ 201 --mandir='$(datadir)/man' \ 202 --with-tcp-wrappers 203 204If you want to create a Cygwin package, equivalent to the one 205in the Cygwin binary distribution, install like this: 206 207 mkdir /tmp/cygwin-ssh 208 cd $(builddir) 209 make install DESTDIR=/tmp/cygwin-ssh 210 cd $(srcdir)/contrib/cygwin 211 make cygwin-postinstall DESTDIR=/tmp/cygwin-ssh 212 cd /tmp/cygwin-ssh 213 find * \! -type d | tar cvjfT my-openssh.tar.bz2 - 214 215You must have installed the zlib and openssl-devel packages to be able to 216build OpenSSH! 217 218Please send requests, error reports etc. to cygwin@cygwin.com. 219 220Have fun, 221 222Corinna Vinschen 223Cygwin Developer 224Red Hat Inc. 225