11. Prerequisites 2---------------- 3 4You will need working installations of Zlib and OpenSSL. 5 6Zlib: 7http://www.freesoftware.com/pub/infozip/zlib/ 8 9OpenSSL 0.9.5a or greater: 10http://www.openssl.org/ 11 12RPMs of OpenSSL are available at http://violet.ibs.com.au/openssh/files/support 13 14OpenSSH can utilise Pluggable Authentication Modules (PAM) if your system 15supports it. PAM is standard on Redhat and Debian Linux and on Solaris. 16 17PAM: 18http://www.kernel.org/pub/linux/libs/pam/ 19 20If you wish to build the GNOME passphrase requester, you will need the GNOME 21libraries and headers. 22 23GNOME: 24http://www.gnome.org/ 25 26Alternatively, Jim Knoble <jmknoble@pobox.com> has written an excellent X11 27passphrase requester. This is maintained separately at: 28 29http://www.ntrnet.net/~jmknoble/software/x11-ssh-askpass/index.html 30 31The Entropy Gathering Daemon (EGD) is supported if you have a system which 32lacks /dev/random and don't want to use OpenSSH's internal entropy collection. 33 34EGD: 35http://www.lothar.com/tech/crypto/ 36 37GNU Make: 38ftp://ftp.gnu.org/gnu/make/ 39 40OpenSSH has only been tested with GNU make. It may work with other 41'make' programs, but you are on your own. 42 43pcre (POSIX Regular Expression library): 44ftp://ftp.cus.cam.ac.uk/pub/software/programs/pcre/ 45 46Most platforms do not required this. However older 4.3 BSD do not 47have a posix regex library. 48 49 502. Building / Installation 51-------------------------- 52 53To install OpenSSH with default options: 54 55./configure 56make 57make install 58 59This will install the OpenSSH binaries in /usr/local/bin, configuration files 60in /usr/local/etc, the server in /usr/local/sbin, etc. To specify a different 61installation prefix, use the --prefix option to configure: 62 63./configure --prefix=/opt 64make 65make install 66 67Will install OpenSSH in /opt/{bin,etc,lib,sbin}. You can also override 68specific paths, for example: 69 70./configure --prefix=/opt --sysconfdir=/etc/ssh 71make 72make install 73 74This will install the binaries in /opt/{bin,lib,sbin}, but will place the 75configuration files in /etc/ssh. 76 77If you are using PAM, you will need to manually install a PAM 78control file as "/etc/pam.d/sshd" (or wherever your system 79prefers to keep them). A generic PAM configuration is included as 80"contrib/sshd.pam.generic", you may need to edit it before using it on 81your system. If you are using a recent version of Redhat Linux, the 82config file in contrib/redhat/sshd.pam should be more useful. 83Failure to install a valid PAM file may result in an inability to 84use password authentication. 85 86There are a few other options to the configure script: 87 88--with-rsh=PATH allows you to specify the path to your rsh program. 89Normally ./configure will search the current $PATH for 'rsh'. You 90may need to specify this option if rsh is not in your path or has a 91different name. 92 93--without-pam will disable PAM support. PAM is automatically detected 94and switched on if found. 95 96--enable-gnome-askpass will build the GNOME passphrase dialog. You 97need a working installation of GNOME, including the development 98headers, for this to work. 99 100--with-random=/some/file allows you to specify an alternate source of 101random numbers (the default is /dev/urandom). Unless you are absolutely 102sure of what you are doing, it is best to leave this alone. 103 104--with-egd-pool=/some/file allows you to enable Entropy Gathering 105Daemon support and to specify a EGD pool socket. Use this if your 106Unix lacks /dev/random and you don't want to use OpenSSH's builtin 107entropy collection support. 108 109--with-lastlog=FILE will specify the location of the lastlog file. 110./configure searches a few locations for lastlog, but may not find 111it if lastlog is installed in a different place. 112 113--without-lastlog will disable lastlog support entirely. 114 115--with-kerberos4=PATH will enable Kerberos IV support. You will need 116to have the Kerberos libraries and header files installed for this 117to work. Use the optional PATH argument to specify the root of your 118Kerberos installation. 119 120--with-afs=PATH will enable AFS support. You will need to have the 121Kerberos IV and the AFS libraries and header files installed for this 122to work. Use the optional PATH argument to specify the root of your 123AFS installation. AFS requires Kerberos support to be enabled. 124 125--with-skey will enable S/Key one time password support. You will need 126the S/Key libraries and header files installed for this to work. 127 128--with-tcp-wrappers will enable TCP Wrappers (/etc/hosts.allow|deny) 129support. You will need libwrap.a and tcpd.h installed. 130 131--with-md5-passwords will enable the use of MD5 passwords. Enable this 132if your operating system uses MD5 passwords without using PAM. 133 134--with-utmpx enables utmpx support. utmpx support is automatic for 135some platforms. 136 137--without-shadow disables shadow password support. 138 139--with-ipaddr-display forces the use of a numeric IP address in the 140$DISPLAY environment variable. Some broken systems need this. 141 142--with-default-path=PATH allows you to specify a default $PATH for sessions 143started by sshd. This replaces the standard path entirely. 144 145--with-pid-dir=PATH specifies the directory in which the ssh.pid file is 146created. 147 148--with-xauth=PATH specifies the location of the xauth binary 149 150--with-ipv4-default instructs OpenSSH to use IPv4 by default for new 151connections. Normally OpenSSH will try attempt to lookup both IPv6 and 152IPv4 addresses. On Linux/glibc-2.1.2 this causes long delays in name 153resolution. If this option is specified, you can still attempt to 154connect to IPv6 addresses using the command line option '-6'. 155 156--with-ssl-dir=DIR allows you to specify where your OpenSSL libraries 157are installed. 158 159--with-4in6 Check for IPv4 in IPv6 mapped addresses and convert them to 160real (AF_INET) IPv4 addresses. Works around some quirks on Linux. 161 162If you need to pass special options to the compiler or linker, you 163can specify these as environment variables before running ./configure. 164For example: 165 166CFLAGS="-O -m486" LDFLAGS="-s" LIBS="-lrubbish" LD="/usr/foo/ld" ./configure 167 1683. Configuration 169---------------- 170 171The runtime configuration files are installed by in ${prefix}/etc or 172whatever you specified as your --sysconfdir (/usr/local/etc by default). 173 174The default configuration should be instantly usable, though you should 175review it to ensure that it matches your security requirements. 176 177To generate a host key, run "make host-key". Alternately you can do so 178manually using the following commands: 179 180 ssh-keygen -b 1024 -f /etc/ssh/ssh_host_key -N "" 181 ssh-keygen -d -f /etc/ssh/ssh_host_dsa_key -N "" 182 183Replacing /etc/ssh with the correct path to the configuration directory. 184(${prefix}/etc or whatever you specified with --sysconfdir during 185configuration) 186 187If you have configured OpenSSH with EGD support, ensure that EGD is 188running and has collected some Entropy. 189 190For more information on configuration, please refer to the manual pages 191for sshd, ssh and ssh-agent. 192 1934. Problems? 194------------ 195 196If you experience problems compiling, installing or running OpenSSH. 197Please refer to the "reporting bugs" section of the webpage at 198http://www.openssh.com/ 199 200