mirror of
https://github.com/freebsd/freebsd-src
synced 2024-07-22 02:37:15 +00:00
4d3fc8b057
This release fixes a number of security bugs and has minor new features and bug fixes. Security fixes, from the release notes (https://www.openssh.com/txt/release-9.3): This release contains fixes for a security problem and a memory safety problem. The memory safety problem is not believed to be exploitable, but we report most network-reachable memory faults as security bugs. * ssh-add(1): when adding smartcard keys to ssh-agent(1) with the per-hop destination constraints (ssh-add -h ...) added in OpenSSH 8.9, a logic error prevented the constraints from being communicated to the agent. This resulted in the keys being added without constraints. The common cases of non-smartcard keys and keys without destination constraints are unaffected. This problem was reported by Luci Stanescu. * ssh(1): Portable OpenSSH provides an implementation of the getrrsetbyname(3) function if the standard library does not provide it, for use by the VerifyHostKeyDNS feature. A specifically crafted DNS response could cause this function to perform an out-of-bounds read of adjacent stack data, but this condition does not appear to be exploitable beyond denial-of- service to the ssh(1) client. The getrrsetbyname(3) replacement is only included if the system's standard library lacks this function and portable OpenSSH was not compiled with the ldns library (--with-ldns). getrrsetbyname(3) is only invoked if using VerifyHostKeyDNS to fetch SSHFP records. This problem was found by the Coverity static analyzer. Sponsored by: The FreeBSD Foundation
87 lines
5.1 KiB
Markdown
87 lines
5.1 KiB
Markdown
# Portable OpenSSH
|
|
|
|
[](https://github.com/openssh/openssh-portable/actions/workflows/c-cpp.yml)
|
|
[](https://bugs.chromium.org/p/oss-fuzz/issues/list?sort=-opened&can=1&q=proj:openssh)
|
|
[](https://scan.coverity.com/projects/openssh-portable)
|
|
|
|
OpenSSH is a complete implementation of the SSH protocol (version 2) for secure remote login, command execution and file transfer. It includes a client ``ssh`` and server ``sshd``, file transfer utilities ``scp`` and ``sftp`` as well as tools for key generation (``ssh-keygen``), run-time key storage (``ssh-agent``) and a number of supporting programs.
|
|
|
|
This is a port of OpenBSD's [OpenSSH](https://openssh.com) to most Unix-like operating systems, including Linux, OS X and Cygwin. Portable OpenSSH polyfills OpenBSD APIs that are not available elsewhere, adds sshd sandboxing for more operating systems and includes support for OS-native authentication and auditing (e.g. using PAM).
|
|
|
|
## Documentation
|
|
|
|
The official documentation for OpenSSH are the man pages for each tool:
|
|
|
|
* [ssh(1)](https://man.openbsd.org/ssh.1)
|
|
* [sshd(8)](https://man.openbsd.org/sshd.8)
|
|
* [ssh-keygen(1)](https://man.openbsd.org/ssh-keygen.1)
|
|
* [ssh-agent(1)](https://man.openbsd.org/ssh-agent.1)
|
|
* [scp(1)](https://man.openbsd.org/scp.1)
|
|
* [sftp(1)](https://man.openbsd.org/sftp.1)
|
|
* [ssh-keyscan(8)](https://man.openbsd.org/ssh-keyscan.8)
|
|
* [sftp-server(8)](https://man.openbsd.org/sftp-server.8)
|
|
|
|
## Stable Releases
|
|
|
|
Stable release tarballs are available from a number of [download mirrors](https://www.openssh.com/portable.html#downloads). We recommend the use of a stable release for most users. Please read the [release notes](https://www.openssh.com/releasenotes.html) for details of recent changes and potential incompatibilities.
|
|
|
|
## Building Portable OpenSSH
|
|
|
|
### Dependencies
|
|
|
|
Portable OpenSSH is built using autoconf and make. It requires a working C compiler, standard library and headers.
|
|
|
|
``libcrypto`` from either [LibreSSL](https://www.libressl.org/) or [OpenSSL](https://www.openssl.org) may also be used. OpenSSH may be built without either of these, but the resulting binaries will have only a subset of the cryptographic algorithms normally available.
|
|
|
|
[zlib](https://www.zlib.net/) is optional; without it transport compression is not supported.
|
|
|
|
FIDO security token support needs [libfido2](https://github.com/Yubico/libfido2) and its dependencies and will be enabled automatically if they are found.
|
|
|
|
In addition, certain platforms and build-time options may require additional dependencies; see README.platform for details about your platform.
|
|
|
|
### Building a release
|
|
|
|
Releases include a pre-built copy of the ``configure`` script and may be built using:
|
|
|
|
```
|
|
tar zxvf openssh-X.YpZ.tar.gz
|
|
cd openssh
|
|
./configure # [options]
|
|
make && make tests
|
|
```
|
|
|
|
See the [Build-time Customisation](#build-time-customisation) section below for configure options. If you plan on installing OpenSSH to your system, then you will usually want to specify destination paths.
|
|
|
|
### Building from git
|
|
|
|
If building from git, you'll need [autoconf](https://www.gnu.org/software/autoconf/) installed to build the ``configure`` script. The following commands will check out and build portable OpenSSH from git:
|
|
|
|
```
|
|
git clone https://github.com/openssh/openssh-portable # or https://anongit.mindrot.org/openssh.git
|
|
cd openssh-portable
|
|
autoreconf
|
|
./configure
|
|
make && make tests
|
|
```
|
|
|
|
### Build-time Customisation
|
|
|
|
There are many build-time customisation options available. All Autoconf destination path flags (e.g. ``--prefix``) are supported (and are usually required if you want to install OpenSSH).
|
|
|
|
For a full list of available flags, run ``./configure --help`` but a few of the more frequently-used ones are described below. Some of these flags will require additional libraries and/or headers be installed.
|
|
|
|
Flag | Meaning
|
|
--- | ---
|
|
``--with-pam`` | Enable [PAM](https://en.wikipedia.org/wiki/Pluggable_authentication_module) support. [OpenPAM](https://www.openpam.org/), [Linux PAM](http://www.linux-pam.org/) and Solaris PAM are supported.
|
|
``--with-libedit`` | Enable [libedit](https://www.thrysoee.dk/editline/) support for sftp.
|
|
``--with-kerberos5`` | Enable Kerberos/GSSAPI support. Both [Heimdal](https://www.h5l.org/) and [MIT](https://web.mit.edu/kerberos/) Kerberos implementations are supported.
|
|
``--with-selinux`` | Enable [SELinux](https://en.wikipedia.org/wiki/Security-Enhanced_Linux) support.
|
|
|
|
## Development
|
|
|
|
Portable OpenSSH development is discussed on the [openssh-unix-dev mailing list](https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev) ([archive mirror](https://marc.info/?l=openssh-unix-dev)). Bugs and feature requests are tracked on our [Bugzilla](https://bugzilla.mindrot.org/).
|
|
|
|
## Reporting bugs
|
|
|
|
_Non-security_ bugs may be reported to the developers via [Bugzilla](https://bugzilla.mindrot.org/) or via the mailing list above. Security bugs should be reported to [openssh@openssh.com](mailto:openssh.openssh.com).
|