Secure Shell is a set of programs for logging into a remote machine and for
executing commands on a remote machine. It is intended to replace rlogin,
rsh, rcp, etc. and provide secure encrypted communications between two
untrusted hosts over an insecure network. X11 connections and arbitrary
TCP/IP ports can also be forwarded over the secure channel.
OpenSSH is a version of Secure Shell based upon a much less encumbered
SSH version 1.2.12, which has a BSD-style license. Maintained by the
OpenBSD project, this is the most free and secure SSH implementation
in the world. OpenSSH supports SSH protocol version 1.5 and 2.0.
If you don't need SKEY/OPIE you like to use openssh-portable
WWW: http://www.openssh.com/
- Brian Feldman
green@FreeBSD.org
===> The following configuration options are available for openssh-3.6.1_6:
AFS=off (default) "With AFC Support"
KERBEROS=off (default) "With Kerberos Support"
SKEY=off (default) "With SKEY Support"
===> Use 'make config' to modify these settings
'PermitRootLogin no' is the new default for the OpenSSH port.
This now matches the PermitRootLogin configuration of OpenSSH in
the base system. Please be aware of this when upgrading your
OpenSSH port, and if truly necessary, re-enable remote root login
by readjusting this option in your sshd_config.
Users are encouraged to create single-purpose users with ssh keys
and very narrowly defined sudo privileges instead of using root
for automated tasks.
Defaults changed: (Gregory Sutter)
ChallengeResponseAuthentication no
UseLogin no
SSH_PRIVSEP_USER=sshd, distributioin patch set it to nobodyh. (Jan Srzednicki)
#undef USE_PIPES, problems with ppp over ssh. (Kugimoto Takeshi)
fix missing includes for "canohost.h"
Security FIX, Please update to this Version.
Options for both:
USE_OPENSSL_BASE=yes
uses an older opensssl in the base system.
Options for portable:
OPENSSH_OVERWRITE_BASE=yes
includes USE_OPENSSL_BASE=yes
installls in the paths of the base system
Merge PAM-changes from openssh currrent
Fix build with SKEY=yes, pr# 36119
Cleanup pw_expire handling.
Add missing includes
Changes defaults to: PermitRootLogin=no, UsePrivilegeSeparation=no
Use $PREFIX/etc/ssh for config, updating manpages too.
Update to openssh-3.3
- New program ssh-keysign
- New manpages for ssh_config and sshd_config
- Merge Pathes to new files
- Fix GCC problem with unsupported __func__ in older Releases
Update to OpenSSH 3.2.3
- patch openssh-3.1-adv.token.patch is now obsolete.
- remerged PAM changes form previous port
- declare CMSG_* macros.
- fixed bad type in function input_userauth_passwd_changereq
Update to OpenSSH-portable-3.2.3p1
- patch openssh-3.1p1-adv.token.patch is now obsolete
- keep previously declared CONFIGURE_ARGS
- remove openssh-mit-krb5-20020326.diff (should be in the distribution now)
- patch patch-readpassphrase.c is now in teh distribution
- merged previous patches.
- extend CONFIGURE_ARGS so it find OPENSSL again.
- new patches for GSSAPI, not fully tested.
If you have the patch applied:
http://www.freebsd.org/cgi/query-pr.cgi?pr=ports/36080
Builds with openssl-0.9.6d under:
2.2.8-RELEASE
3.2-RELEASE
4.2-RELEASE
4.6-RC
openssl:
- some configure scripts check the version of the lib
so we need to update SHLIBVER
- bump PORTREVISION
openssh:
- build ports with local openssl, if it exists
create ssh_config-dist and sshd_config-dist
make sure that package install and deinstall
don't temper existing configuration files.
install sshd.sh now as sample.
Package changed, but no need to update
if you have PORTREVISION=2
- Drop modifier L in makefile, all options have to be set in lowercase "yes"
- Tested build with FreeBSD 4.1 openssl-0.9.6a needs to be installed form
ports. "FORBIDDEN" must be removed by hand.
- Update from OpenSSH 2.2.0 to OpenSSH 2.9 - Features: Possible use of
sftp/sftp-server with older FreeBSD releases. Use a newer version
independently from the Base system. Easier to test and fix possible security
bugs. - Bugs: build of pam_ssm.so isn't be supported any more Any file
named "cookie" can be deleted by this and any older "sshd" with X11
Forwarding.
Add patch to deal with possible remote root exploit found by Michal Zalewski
of the Bindview RAZOR Team, and some patches to hopefully deal with
compilation on older versions of FreeBSD.
