Portable OpenSSH, all Win32-OpenSSH releases and wiki are managed at https://github.com/powershell/Win32-OpenSSH
Go to file
djm@openbsd.org 99aa803555 upstream: factor out reading/writing sshbufs to dedicated
functions; feedback and ok markus@

OpenBSD-Commit-ID: dc09e5f1950b7acc91b8fdf8015347782d2ecd3d
2020-01-26 10:18:42 +11:00
contrib Fix typo: 'you' -> 'your'. 2020-01-06 09:02:53 +11:00
openbsd-compat include tunnel device path in error message 2020-01-25 16:30:22 +11:00
regress upstream: Move setting $NC into test-exec since it's now used by 2020-01-25 14:33:53 +11:00
.depend depend 2020-01-21 12:20:05 +11:00
.gitignore Add config.log to .gitignore 2020-01-16 13:27:23 +11:00
.skipped-commit-ids upstream: only clang understands those new -W options 2019-11-15 16:39:31 +11:00
CREDITS convert to UTF-8; from Mike Frysinger 2019-07-29 09:49:23 +10:00
INSTALL zlib is now optional. 2020-01-23 22:17:24 +11:00
LICENCE convert to UTF-8; from Mike Frysinger 2019-07-29 09:49:23 +10:00
Makefile.in upstream: factor out reading/writing sshbufs to dedicated 2020-01-26 10:18:42 +11:00
OVERVIEW upstream: refer to OpenSSL not SSLeay; 2018-10-23 16:57:54 +11:00
PROTOCOL upstream: mention INFO@openssh.com for sending SIGINFO 2018-10-02 22:53:48 +10:00
PROTOCOL.agent update URL again 2017-10-01 10:32:25 +11:00
PROTOCOL.certkeys upstream: document the "no-touch-required" certificate extension; 2019-11-25 12:25:53 +11:00
PROTOCOL.chacha20poly1305 upstream: lots of typos in comments/docs. Patch from Karsten Weiss 2018-04-10 10:17:15 +10:00
PROTOCOL.key
PROTOCOL.krl upstream: allow key revocation by SHA256 hash and allow ssh-keygen 2018-09-12 16:49:21 +10:00
PROTOCOL.mux upstream: Document mux proxy mode; added by Markus in openssh-7.4 2018-09-26 17:35:22 +10:00
PROTOCOL.sshsig upstream: sshsig tweaks and improvements from and suggested by 2019-09-03 18:40:24 +10:00
PROTOCOL.u2f upstream: Extends the SK API to accept a set of key/value options 2020-01-06 13:12:46 +11:00
README prepare for 8.1 release 2019-10-09 11:31:03 +11:00
README.dns
README.md Fix typo in README.md, s/crytpo/crypto/ 2020-01-16 13:26:46 +11:00
README.platform Many typo fixes from Karsten Weiss 2018-04-10 10:19:02 +10:00
README.privsep Privsep is now required. 2019-09-19 15:41:23 +10:00
README.tun
TODO Remove support for S/Key 2018-07-31 12:59:30 +10:00
aclocal.m4 Better detection of unsupported compiler options. 2018-06-08 13:55:59 +10:00
addrmatch.c upstream: fix some memory leaks spotted by Coverity via Jakub Jelen 2018-07-31 13:13:26 +10:00
atomicio.c upstream: Check for both EAGAIN and EWOULDBLOCK. This is a no-op 2019-01-24 14:40:03 +11:00
atomicio.h upstream: move client/server SSH-* banners to buffers under 2018-12-27 14:38:22 +11:00
audit-bsm.c last bits of old packet API / active_state global 2019-01-20 14:55:27 +11:00
audit-linux.c last bits of old packet API / active_state global 2019-01-20 14:55:27 +11:00
audit.c last bits of old packet API / active_state global 2019-01-20 14:55:27 +11:00
audit.h last bits of old packet API / active_state global 2019-01-20 14:55:27 +11:00
auth-bsdauth.c remove duplicate #includes 2019-10-02 10:54:28 +10:00
auth-krb5.c upstream: sshd: switch authentication to sshbuf API; ok djm@ 2018-07-10 15:27:43 +10:00
auth-options.c upstream: add a "no-touch-required" option for authorized_keys and 2019-11-25 12:23:40 +11:00
auth-options.h upstream: add a "no-touch-required" option for authorized_keys and 2019-11-25 12:23:40 +11:00
auth-pam.c Fix a couple of mysig_t leftovers. 2020-01-23 21:06:45 +11:00
auth-pam.h remove PAM dependencies on old packet API 2019-01-20 10:22:18 +11:00
auth-passwd.c check pw_passwd != NULL here too 2018-10-11 11:29:35 +11:00
auth-rhosts.c upstream: remove some duplicate #includes 2019-10-02 10:43:47 +10:00
auth-shadow.c Remove key.h from portable files too. 2018-07-12 14:57:46 +10:00
auth-sia.c Remove key.h from portable files too. 2018-07-12 14:57:46 +10:00
auth-sia.h
auth.c upstream: Replace all calls to signal(2) with a wrapper around 2020-01-23 18:51:25 +11:00
auth.h remove duplicate #includes 2019-10-02 10:54:28 +10:00
auth2-chall.c upstream: stdarg.h required more broadly; ok djm 2019-11-15 08:50:10 +11:00
auth2-gss.c upstream: delay bailout for invalid authentic 2018-07-31 13:13:26 +10:00
auth2-hostbased.c upstream: Add new structure for signature options 2019-11-25 12:23:33 +11:00
auth2-kbdint.c upstream: stdarg.h required more broadly; ok djm 2019-11-15 08:50:10 +11:00
auth2-none.c upstream: sshd: switch authentication to sshbuf API; ok djm@ 2018-07-10 15:27:43 +10:00
auth2-passwd.c upstream: lots of things were relying on libcrypto headers to 2019-09-06 17:54:21 +10:00
auth2-pubkey.c upstream: Replace all calls to signal(2) with a wrapper around 2020-01-23 18:51:25 +11:00
auth2.c remove duplicate #includes 2019-10-02 10:54:28 +10:00
authfd.c upstream: Allow forwarding a different agent socket to the path 2019-12-21 13:22:07 +11:00
authfd.h upstream: Allow forwarding a different agent socket to the path 2019-12-21 13:22:07 +11:00
authfile.c upstream: factor out reading/writing sshbufs to dedicated 2020-01-26 10:18:42 +11:00
authfile.h upstream: factor out reading/writing sshbufs to dedicated 2020-01-26 10:18:42 +11:00
bitmap.c upstream commit 2017-10-20 12:58:35 +11:00
bitmap.h upstream commit 2017-10-20 12:58:35 +11:00
buildpkg.sh.in Update links to https. 2016-10-21 06:55:58 +11:00
canohost.c upstream: When system calls indicate an error they return -1, not 2019-07-05 11:10:39 +10:00
canohost.h upstream commit 2016-03-08 06:20:35 +11:00
chacha.c
chacha.h upstream commit 2016-08-29 11:20:28 +10:00
channels.c upstream: the GatewayPorts vs -R listen address selection logic is 2020-01-25 18:20:01 +11:00
channels.h upstream: add a comment describing the ranges of channel IDs that 2020-01-26 10:15:13 +11:00
cipher-aes.c
cipher-aesctr.c Add includes.h for compatibility stuff. 2015-02-25 13:17:40 +11:00
cipher-aesctr.h - markus@cvs.openbsd.org 2014/04/29 18:01:49 2014-05-15 14:24:09 +10:00
cipher-chachapoly.c upstream commit 2016-08-09 09:06:52 +10:00
cipher-chachapoly.h - djm@cvs.openbsd.org 2014/06/24 01:13:21 2014-07-02 15:28:02 +10:00
cipher-ctr.c support --without-openssl at configure time 2015-01-15 02:28:36 +11:00
cipher.c upstream: Make zlib optional. This adds a "ZLIB" build time option 2020-01-23 21:53:54 +11:00
cipher.h upstream: Make zlib optional. This adds a "ZLIB" build time option 2020-01-23 21:53:54 +11:00
cleanup.c
clientloop.c upstream: allow UpdateKnownHosts=yes to function when multiple 2020-01-25 11:35:56 +11:00
clientloop.h upstream: client: switch to sshbuf API; ok djm@ 2018-07-10 15:14:26 +10:00
compat.c upstream: revert compat.[ch] section of the following change. It 2018-08-13 12:42:13 +10:00
compat.h upstream: revert compat.[ch] section of the following change. It 2018-08-13 12:42:13 +10:00
config.guess update config.guess and config.sub to current 2016-08-02 10:48:04 +10:00
config.sub update config.guess and config.sub to current 2016-08-02 10:48:04 +10:00
configure.ac Plumb WITH_ZLIB into configure. 2020-01-23 22:16:51 +11:00
crypto_api.h upstream: Add support for a PQC KEX/KEM: 2019-01-21 22:07:02 +11:00
defines.h Add SSIZE_MAX when we define ssize_t. 2019-11-15 18:55:13 +11:00
dh.c upstream: typo in previous 2019-09-08 14:49:04 +10:00
dh.h upstream: fixes for !WITH_OPENSSL compilation; ok dtucker@ 2019-09-06 17:54:21 +10:00
digest-libc.c Re-apply portability changes to current sha2.{c,h}. 2019-07-23 22:06:24 +10:00
digest-openssl.c Remove configure test & compat code for ripemd160. 2020-01-14 12:05:00 +11:00
digest.h upstream commit 2017-05-10 11:41:21 +10:00
dispatch.c upstream: allow sshpkt_fatal() to take a varargs format; we'll 2019-01-20 09:02:20 +11:00
dispatch.h upstream: remove last traces of old packet API! 2019-01-20 09:45:18 +11:00
dns.c remove duplicate #includes 2019-10-02 10:54:28 +10:00
dns.h upstream: Add experimental support for PQC XMSS keys (Extended 2018-02-26 11:40:41 +11:00
ed25519.c
entropy.c Fix a couple of mysig_t leftovers. 2020-01-23 21:06:45 +11:00
entropy.h Adapt portable to legacy buffer API removal 2018-07-10 19:39:52 +10:00
fatal.c
fe25519.c
fe25519.h
fixalgorithms
fixpaths
ge25519.c
ge25519.h upstream commit 2015-02-17 09:32:31 +11:00
ge25519_base.data
groupaccess.c upstream: Move checks for lists of users or groups into their own 2019-03-08 15:10:07 +11:00
groupaccess.h
gss-genr.c upstream: kerberos/gssapi fixes for buffer removal 2018-07-10 19:15:35 +10:00
gss-serv-krb5.c upstream: sshd: switch GSSAPI to sshbuf API; ok djm@ 2018-07-10 15:28:30 +10:00
gss-serv.c upstream: sshd: switch GSSAPI to sshbuf API; ok djm@ 2018-07-10 15:28:30 +10:00
hash.c Wrap sha2.h include in ifdef. 2019-11-29 20:21:36 +11:00
hmac.c remove duplicate #includes 2019-10-02 10:54:28 +10:00
hmac.h - djm@cvs.openbsd.org 2014/06/24 01:13:21 2014-07-02 15:28:02 +10:00
hostfile.c upstream: allow UpdateKnownHosts=yes to function when multiple 2020-01-25 11:35:56 +11:00
hostfile.h upstream commit 2015-02-17 09:32:31 +11:00
includes.h portability for sftp globbed ls sort by mtime 2017-06-10 23:41:25 +10:00
install-sh Pull in newer install-sh from autoconf-2.69. 2017-12-01 17:07:08 +11:00
kex.c upstream: Make zlib optional. This adds a "ZLIB" build time option 2020-01-23 21:53:54 +11:00
kex.h remove duplicate #includes 2019-10-02 10:54:28 +10:00
kexc25519.c upstream: rename kex->kem_client_pub -> kex->client_pub now that 2019-01-21 23:13:03 +11:00
kexdh.c typo 2019-01-22 10:50:40 +11:00
kexecdh.c Put ssherr.h back as it's actually needed. 2019-10-02 14:30:55 +10:00
kexgen.c upstream: Add new structure for signature options 2019-11-25 12:23:33 +11:00
kexgex.c upstream: pass most arguments to the KEX hash functions as sshbuf 2019-01-23 13:02:02 +11:00
kexgexc.c upstream: Add new structure for signature options 2019-11-25 12:23:33 +11:00
kexgexs.c upstream: pass most arguments to the KEX hash functions as sshbuf 2019-01-23 13:02:02 +11:00
kexsntrup4591761x25519.c new files need includes.h 2019-01-22 00:02:23 +11:00
krl.c upstream: factor out reading/writing sshbufs to dedicated 2020-01-26 10:18:42 +11:00
krl.h upstream: Add protection for private keys at rest in RAM against 2019-06-21 14:24:35 +10:00
log.c upstream: avoid expensive channel_open_message() calls; ok djm@ 2018-07-31 12:20:13 +10:00
log.h upstream: lots of things were relying on libcrypto headers to 2019-09-06 17:54:21 +10:00
loginrec.c upstream: lots of things were relying on libcrypto headers to 2019-09-06 17:54:21 +10:00
loginrec.h remove vestiges of old packet API from loginrec.c 2019-01-20 09:58:45 +11:00
logintest.c
mac.c remove duplicate #includes 2019-10-02 10:54:28 +10:00
mac.h upstream commit 2016-07-08 13:50:03 +10:00
match.c upstream: stdarg.h required more broadly; ok djm 2019-11-15 08:50:10 +11:00
match.h upstream: Move checks for lists of users or groups into their own 2019-03-08 15:10:07 +11:00
md5crypt.c Remove assigned-to-but-never-used variable. 2018-02-13 16:27:09 +11:00
md5crypt.h Remove obsolete CVS $Id from source files. 2016-08-17 14:08:42 +10:00
mdoc2man.awk Remove remaining now-obsolete cvs $Ids. 2018-02-15 20:06:19 +11:00
misc.c upstream: add xextendf() to extend a string with a format 2020-01-25 11:27:29 +11:00
misc.h upstream: add xextendf() to extend a string with a format 2020-01-25 11:27:29 +11:00
mkinstalldirs Remove remaining now-obsolete cvs $Ids. 2018-02-15 20:06:19 +11:00
moduli Import regenerated moduli file. 2019-10-22 18:09:22 +11:00
moduli.5
moduli.c upstream: remove most uses of BN_CTX 2019-11-17 09:44:43 +11:00
monitor.c upstream: Replace all calls to signal(2) with a wrapper around 2020-01-23 18:51:25 +11:00
monitor.h upstream: remove last references to active_state 2019-01-20 09:45:18 +11:00
monitor_fdpass.c upstream commit 2016-03-04 15:12:17 +11:00
monitor_fdpass.h
monitor_wrap.c upstream: allow security keys to act as host keys as well as user 2019-12-16 14:19:41 +11:00
monitor_wrap.h upstream: Add new structure for signature options 2019-11-25 12:23:33 +11:00
msg.c upstream: some __func__ and strerror(errno) here; no functional 2020-01-22 17:17:51 +11:00
msg.h upstream commit 2015-01-15 21:39:14 +11:00
mux.c upstream: Replace all calls to signal(2) with a wrapper around 2020-01-23 18:51:25 +11:00
myproposal.h upstream: remove ssh-rsa (SHA1) from the list of allowed CA 2020-01-25 11:27:29 +11:00
nchan.c upstream: When system calls indicate an error they return -1, not 2019-07-05 11:10:39 +10:00
nchan.ms
nchan2.ms
openssh.xml.in
opensshd.init.in Remove RSA1 host key generation. 2017-12-01 16:55:35 +11:00
packet.c upstream: Fix typo in comment. 2020-01-23 22:33:18 +11:00
packet.h upstream: fixes for !WITH_OPENSSL compilation; ok dtucker@ 2019-09-06 17:54:21 +10:00
pathnames.h upstream: enable ed25519 support; ok djm 2019-11-13 08:54:09 +11:00
pkcs11.h
platform-misc.c Split platform_sys_dir_uid into its own file 2017-08-25 13:25:01 +10:00
platform-pledge.c Support Illumos/Solaris fine-grained privileges 2016-01-08 14:29:12 +11:00
platform-tracing.c Use ptrace(PT_DENY_ATTACH, ..) on OS X. 2016-11-01 08:12:33 +11:00
platform.c Add headers to prevent warnings w/out OpenSSL. 2019-07-23 22:26:20 +10:00
platform.h Remove obsolete CVS $Id from source files. 2016-08-17 14:08:42 +10:00
poly1305.c
poly1305.h - djm@cvs.openbsd.org 2014/05/02 03:27:54 2014-05-15 14:37:03 +10:00
progressmeter.c upstream: Replace all calls to signal(2) with a wrapper around 2020-01-23 18:51:25 +11:00
progressmeter.h upstream: Have progressmeter force an update at the beginning and 2019-01-25 06:32:14 +11:00
readconf.c upstream: set UpdateKnownHosts=ask by default; bz#2894; ok 2020-01-25 11:36:20 +11:00
readconf.h upstream: Remove unsupported algorithms from list of defaults at run 2020-01-23 14:40:15 +11:00
readpass.c upstream: Replace all calls to signal(2) with a wrapper around 2020-01-23 18:51:25 +11:00
rijndael.c upstream commit 2015-03-23 17:08:12 +11:00
rijndael.h
sandbox-capsicum.c Switch Capsicum header to sys/capsicum.h. 2017-08-28 16:48:27 +10:00
sandbox-darwin.c sandbox-darwin.c: fix missing prototypes. 2020-01-21 10:37:25 +11:00
sandbox-null.c
sandbox-pledge.c s/SANDBOX_TAME/SANDBOX_PLEDGE/g 2015-10-14 09:22:15 -07:00
sandbox-rlimit.c upstream commit 2016-09-12 13:46:29 +10:00
sandbox-seccomp-filter.c Deny (non-fatal) ipc in preauth privsep child. 2020-01-08 21:47:44 +11:00
sandbox-solaris.c drop two more privileges in the Solaris sandbox 2017-06-09 14:44:43 +10:00
sandbox-systrace.c upstream: Replace all calls to signal(2) with a wrapper around 2020-01-23 18:51:25 +11:00
sc25519.c
sc25519.h
scp.1 upstream: tweak the Nd lines for a bit of consistency; ok markus 2019-12-11 19:08:22 +11:00
scp.c upstream: Replace all calls to signal(2) with a wrapper around 2020-01-23 18:51:25 +11:00
servconf.c upstream: Make zlib optional. This adds a "ZLIB" build time option 2020-01-23 21:53:54 +11:00
servconf.h upstream: allow security keys to act as host keys as well as user 2019-12-16 14:19:41 +11:00
serverloop.c upstream: make sshd_config:ClientAliveCountMax=0 disable the 2020-01-26 10:15:13 +11:00
serverloop.h upstream commit 2017-09-12 17:37:02 +10:00
session.c upstream: Replace all calls to signal(2) with a wrapper around 2020-01-23 18:51:25 +11:00
session.h upstream: Add server support for signalling sessions via the SSH 2018-10-02 22:41:01 +10:00
sftp-client.c upstream: fix memory leak in error path; bz#3074 patch from 2019-10-04 14:34:05 +10:00
sftp-client.h upstream: Add "-h" flag to sftp chown/chgrp/chmod commands to 2019-01-17 11:08:13 +11:00
sftp-common.c Include unistd.h for strmode(). 2019-01-24 10:07:03 +11:00
sftp-common.h upstream commit 2015-01-15 02:22:18 +11:00
sftp-glob.c upstream: stdarg.h required more broadly; ok djm 2019-11-15 08:50:10 +11:00
sftp-realpath.c sftp-realpath.c needs includes.h 2019-07-08 13:44:32 +10:00
sftp-server-main.c upstream: Replace calls to ssh_malloc_init() by a static init of 2019-06-08 00:25:42 +10:00
sftp-server.8 upstream: tweak the Nd lines for a bit of consistency; ok markus 2019-12-11 19:08:22 +11:00
sftp-server.c upstream: add a local implementation of BSD realpath() for 2019-07-08 11:44:49 +10:00
sftp.1 upstream: tweak the Nd lines for a bit of consistency; ok markus 2019-12-11 19:08:22 +11:00
sftp.c upstream: Replace all calls to signal(2) with a wrapper around 2020-01-23 18:51:25 +11:00
sftp.h
sk-api.h upstream: Extends the SK API to accept a set of key/value options 2020-01-06 13:12:46 +11:00
sk-usbhid.c upstream: missing else in check_enroll_options() 2020-01-06 13:40:28 +11:00
smult_curve25519_ref.c
sntrup4591761.c Add includes.h for compat layer. 2019-04-01 20:07:23 +11:00
sntrup4591761.sh upstream: Add authors for public domain sntrup4591761 code; 2019-02-01 18:55:11 +11:00
ssh-add.1 upstream: Document loading of resident keys from a FIDO 2020-01-21 18:09:09 +11:00
ssh-add.c upstream: factor out reading/writing sshbufs to dedicated 2020-01-26 10:18:42 +11:00
ssh-agent.1 upstream: Replace the term "security key" with "(FIDO) 2019-12-30 14:31:40 +11:00
ssh-agent.c upstream: process security key provider via realpath() in agent, 2020-01-25 11:35:56 +11:00
ssh-dss.c adapt -portable to OpenSSL 1.1x API 2018-09-13 12:13:50 +10:00
ssh-ecdsa-sk.c Fix building without openssl. 2020-01-20 21:14:46 +11:00
ssh-ecdsa.c upstream: Make sshpkt_get_bignum2() allocate the bignum it is 2019-01-21 21:47:28 +11:00
ssh-ed25519-sk.c Include compat header for definitions. 2020-01-14 14:28:01 +11:00
ssh-ed25519.c upstream commit 2016-04-21 16:30:11 +10:00
ssh-gss.h upstream: kerberos/gssapi fixes for buffer removal 2018-07-10 19:15:35 +10:00
ssh-keygen.1 upstream: ssh-keygen -Y find-principals fixes based on feedback 2020-01-25 11:27:29 +11:00
ssh-keygen.c upstream: factor out reading/writing sshbufs to dedicated 2020-01-26 10:18:42 +11:00
ssh-keyscan.1 upstream: tweak the Nd lines for a bit of consistency; ok markus 2019-12-11 19:08:22 +11:00
ssh-keyscan.c upstream: allow ssh-keyscan to find security key hostkeys 2019-12-16 14:19:41 +11:00
ssh-keysign.8 upstream: tweak the Nd lines for a bit of consistency; ok markus 2019-12-11 19:08:22 +11:00
ssh-keysign.c upstream: additional missing stdarg.h includes when built without 2019-11-20 09:27:29 +11:00
ssh-pkcs11-client.c upstream: expose PKCS#11 key labels/X.509 subjects as comments 2020-01-25 11:35:55 +11:00
ssh-pkcs11-helper.8 upstream: tweak the Nd lines for a bit of consistency; ok markus 2019-12-11 19:08:22 +11:00
ssh-pkcs11-helper.c upstream: expose PKCS#11 key labels/X.509 subjects as comments 2020-01-25 11:35:55 +11:00
ssh-pkcs11.c upstream: expose PKCS#11 key labels/X.509 subjects as comments 2020-01-25 11:35:55 +11:00
ssh-pkcs11.h upstream: expose PKCS#11 key labels/X.509 subjects as comments 2020-01-25 11:35:55 +11:00
ssh-rsa.c adapt -portable to OpenSSL 1.1x API 2018-09-13 12:13:50 +10:00
ssh-sandbox.h
ssh-sk-client.c upstream: Replace all calls to signal(2) with a wrapper around 2020-01-23 18:51:25 +11:00
ssh-sk-helper.8 upstream: Replace the term "security key" with "(FIDO) 2019-12-30 14:31:40 +11:00
ssh-sk-helper.c upstream: pass the log-on-stderr flag and log level through to 2020-01-21 18:09:09 +11:00
ssh-sk.c Wrap stdint.h inside HAVE_STDINT_H. 2020-01-14 14:41:47 +11:00
ssh-sk.h upstream: pass the log-on-stderr flag and log level through to 2020-01-21 18:09:09 +11:00
ssh-xmss.c Add WITH_XMSS, move to prevent conflicts. 2018-02-28 19:59:35 +11:00
ssh.1 upstream: Replace the term "security key" with "(FIDO) 2019-12-30 14:31:40 +11:00
ssh.c upstream: allow UpdateKnownHosts=yes to function when multiple 2020-01-25 11:35:56 +11:00
ssh.h upstream: move client/server SSH-* banners to buffers under 2018-12-27 14:38:22 +11:00
ssh2.h upstream commit 2016-05-19 17:48:34 +10:00
ssh_api.c upstream: Refactor signing - use sshkey_sign for everything, 2019-11-01 09:46:10 +11:00
ssh_api.h upstream: lots of typos in comments/docs. Patch from Karsten Weiss 2018-04-10 10:17:15 +10:00
ssh_config upstream: Remove obsolete "Protocol" from commented out examples. Patch 2019-02-04 15:01:38 +11:00
ssh_config.5 upstream: group14-sha1 is no longer a default algorithm 2020-01-25 18:20:01 +11:00
sshbuf-getput-basic.c upstream: allow sshbuf_put_stringb(buf, NULL); ok markus@ 2019-12-14 07:17:44 +11:00
sshbuf-getput-crypto.c upstream: remove most uses of BN_CTX 2019-11-17 09:44:43 +11:00
sshbuf-io.c upstream: factor out reading/writing sshbufs to dedicated 2020-01-26 10:18:42 +11:00
sshbuf-misc.c upstream: factor out reading/writing sshbufs to dedicated 2020-01-26 10:18:42 +11:00
sshbuf.c upstream: Replace all calls to signal(2) with a wrapper around 2020-01-23 18:51:25 +11:00
sshbuf.h upstream: factor out reading/writing sshbufs to dedicated 2020-01-26 10:18:42 +11:00
sshconnect.c upstream: when AddKeysToAgent=yes is set and the key contains no 2020-01-25 18:20:01 +11:00
sshconnect.h upstream: when AddKeysToAgent=yes is set and the key contains no 2020-01-25 18:20:01 +11:00
sshconnect2.c upstream: Make zlib optional. This adds a "ZLIB" build time option 2020-01-23 21:53:54 +11:00
sshd.8 upstream: mention that permitopen=/PermitOpen do no name to address 2020-01-25 17:04:14 +11:00
sshd.c upstream: tweak proctitle to include sshd arguments, as these are 2020-01-25 11:27:29 +11:00
sshd_config upstream: the UseLogin option was removed, so remove it here too. 2018-04-10 10:16:36 +10:00
sshd_config.5 upstream: make sshd_config:ClientAliveCountMax=0 disable the 2020-01-26 10:15:13 +11:00
ssherr.c upstream: translate and return error codes; retry on bad PIN 2019-12-30 21:01:51 +11:00
ssherr.h upstream: translate and return error codes; retry on bad PIN 2019-12-30 21:01:51 +11:00
sshkey-xmss.c upstream: fix shield/unshield for xmss keys: - in ssh-agent we need 2019-11-15 08:50:10 +11:00
sshkey-xmss.h upstream: Add experimental support for PQC XMSS keys (Extended 2018-02-26 11:40:41 +11:00
sshkey.c upstream: fix ssh-keygen not displaying authenticator touch 2020-01-21 18:09:09 +11:00
sshkey.h upstream: SK API and sk-helper error/PIN passing 2019-12-30 20:59:33 +11:00
sshlogin.c upstream: When system calls indicate an error they return -1, not 2019-07-05 11:10:39 +10:00
sshlogin.h
sshpty.c Do not fatal on failed lookup of group "tty". 2019-07-05 13:23:46 +10:00
sshpty.h upstream commit 2016-11-29 16:51:27 +11:00
sshsig.c upstream: ssh-keygen -Y find-principals fixes based on feedback 2020-01-25 11:27:29 +11:00
sshsig.h upstream: ssh-keygen -Y find-principals fixes based on feedback 2020-01-25 11:27:29 +11:00
sshtty.c
survey.sh.in
ttymodes.c upstream: ttymodes: switch to sshbuf API; ok djm@ 2018-07-10 15:19:12 +10:00
ttymodes.h upstream commit 2017-05-01 10:05:04 +10:00
uidswap.c explicitly test set[ug]id() return values 2019-09-13 13:15:14 +10:00
uidswap.h upstream: Remove support for running ssh(1) setuid and fatal if 2018-07-19 21:41:42 +10:00
umac.c upstream: stdarg.h required more broadly; ok djm 2019-11-15 08:50:10 +11:00
umac.h upstream: Typo and spelling fixes in comments and error messages. 2019-06-08 00:49:26 +10:00
umac128.c upstream commit 2018-02-09 20:00:18 +11:00
utf8.c upstream: AIX reports the CODESET as "ISO8859-1" in the POSIX locale. 2018-08-22 07:52:26 +10:00
utf8.h Force Turkish locales back to C/POSIX; bz#2643 2016-12-12 13:58:59 +11:00
verify.c
version.h upstream: openssh-8.1 2019-10-09 11:12:26 +11:00
xmalloc.c upstream: add xvasprintf() 2019-11-13 10:15:46 +11:00
xmalloc.h upstream: add xvasprintf() 2019-11-13 10:15:46 +11:00
xmss_commons.c wrap stdint.h include in HAVE_STDINT_H 2019-10-09 09:06:35 +11:00
xmss_commons.h Remove extra XMSS #endif 2018-03-05 10:22:32 +11:00
xmss_fast.c wrap stdint.h include in HAVE_STDINT_H 2019-10-09 09:06:35 +11:00
xmss_fast.h upstream: Add $OpenBSD$ markers to xmss files to help keep synced 2018-03-02 14:29:25 +11:00
xmss_hash.c wrap stdint.h include in HAVE_STDINT_H 2019-10-09 09:06:35 +11:00
xmss_hash.h upstream: Add $OpenBSD$ markers to xmss files to help keep synced 2018-03-02 14:29:25 +11:00
xmss_hash_address.c wrap stdint.h include in HAVE_STDINT_H 2019-10-09 09:06:35 +11:00
xmss_hash_address.h upstream: Add $OpenBSD$ markers to xmss files to help keep synced 2018-03-02 14:29:25 +11:00
xmss_wots.c wrap stdint.h include in HAVE_STDINT_H 2019-10-09 09:06:35 +11:00
xmss_wots.h upstream: Remove unneeded (local) include. ok markus@ 2018-03-02 14:30:02 +11:00

README.md

Portable OpenSSH

Fuzzing Status

OpenSSH is a complete implementation of the SSH protocol (version 2) for secure remote login, command execution and file transfer. It includes a client ssh and server sshd, file transfer utilities scp and sftp as well as tools for key generation (ssh-keygen), run-time key storage (ssh-agent) and a number of supporting programs.

This is a port of OpenBSD's OpenSSH to most Unix-like operating systems, including Linux, OS X and Cygwin. Portable OpenSSH polyfills OpenBSD APIs that are not available elsewhere, adds sshd sandboxing for more operating systems and includes support for OS-native authentication and auditing (e.g. using PAM).

Documentation

The official documentation for OpenSSH are the man pages for each tool:

Stable Releases

Stable release tarballs are available from a number of download mirrors. We recommend the use of a stable release for most users. Please read the release notes for details of recent changes and potential incompatibilities.

Building Portable OpenSSH

Dependencies

Portable OpenSSH is built using autoconf and make. It requires a working C compiler, standard library and headers, and zlib. libcrypto from either LibreSSL or OpenSSL may also be used, but OpenSSH may be built without it supporting a subset of crypto algorithms. Certain platforms and build-time options may require additional dependencies, see README.platform for details.

Building a release

Releases include a pre-built copy of the configure script and may be built using:

tar zxvf openssh-X.YpZ.tar.gz
cd openssh
./configure # [options]
make && make tests

See the Build-time Customisation section below for configure options. If you plan on installing OpenSSH to your system, then you will usually want to specify destination paths.

Building from git

If building from git, you'll need autoconf installed to build the configure script. The following commands will check out and build portable OpenSSH from git:

git clone https://github.com/openssh/openssh-portable # or https://anongit.mindrot.org/openssh.git
cd openssh-portable
autoreconf
./configure
make && make tests

Build-time Customisation

There are many build-time customisation options available. All Autoconf destination path flags (e.g. --prefix) are supported (and are usually required if you want to install OpenSSH).

For a full list of available flags, run configure --help but a few of the more frequently-used ones are described below. Some of these flags will require additional libraries and/or headers be installed.

Flag Meaning
--with-pam Enable PAM support. OpenPAM, Linux PAM and Solaris PAM are supported.
--with-libedit Enable libedit support for sftp.
--with-kerberos5 Enable Kerberos/GSSAPI support. Both Heimdal and MIT Kerberos implementations are supported.
--with-selinux Enable SELinux support.
--with-security-key-builtin Include built-in support for U2F/FIDO2 security keys. This requires libfido2 be installed.

Development

Portable OpenSSH development is discussed on the openssh-unix-dev mailing list (archive mirror). Bugs and feature requests are tracked on our Bugzilla.

Reporting bugs

Non-security bugs may be reported to the developers via Bugzilla or via the mailing list above. Security bugs should be reported to openssh@openssh.com.