blob: f5ab0dbd335264e399c7c2ce3cc03323d47a55cb [file] [log] [blame]
Damien Millerb5f89271999-11-12 14:35:58 +110011. Prerequisites
2----------------
3
4You will need working installations of Zlib and OpenSSL.
5
6Zlib:
Ben Lindstrom1cd6fef2001-06-29 12:39:23 +00007http://www.gzip.org/zlib/
Damien Millerb5f89271999-11-12 14:35:58 +11008
Ben Lindstromdc163542002-03-07 17:49:39 +00009OpenSSL 0.9.6 or greater:
Damien Millerb5f89271999-11-12 14:35:58 +110010http://www.openssl.org/
11
Damien Miller05720352002-05-13 15:22:21 +100012(OpenSSL 0.9.5a is partially supported, but some ciphers (SSH protocol 1
Damien Miller6d8d7882002-07-25 14:36:24 +100013Blowfish) do not work correctly.)
Damien Millere71eb912000-04-13 12:19:32 +100014
Damien Millerb5f89271999-11-12 14:35:58 +110015OpenSSH can utilise Pluggable Authentication Modules (PAM) if your system
Kevin Stevesdf4a7ae2000-11-07 14:47:51 +000016supports it. PAM is standard on Redhat and Debian Linux, Solaris and
17HP-UX 11.
Damien Millerb5f89271999-11-12 14:35:58 +110018
Damien Millerbd638742002-04-17 12:22:58 +100019NB. If you operating system supports /dev/random, you should configure
20OpenSSL to use it. OpenSSH relies on OpenSSL's direct support of
21/dev/random. If you don't you will have to rely on ssh-rand-helper, which
22is inferior to a good kernel-based solution.
23
Damien Millerb5f89271999-11-12 14:35:58 +110024PAM:
25http://www.kernel.org/pub/linux/libs/pam/
26
Damien Miller780b3761999-12-26 13:36:11 +110027If you wish to build the GNOME passphrase requester, you will need the GNOME
Damien Millerb5f89271999-11-12 14:35:58 +110028libraries and headers.
29
30GNOME:
31http://www.gnome.org/
32
Damien Millerf1aa21f2001-01-05 09:30:32 +110033Alternatively, Jim Knoble <jmknoble@jmknoble.cx> has written an excellent X11
Damien Miller7d7c60d2000-01-26 14:37:48 +110034passphrase requester. This is maintained separately at:
Damien Miller780b3761999-12-26 13:36:11 +110035
Damien Miller0e1cf7c2000-01-26 12:15:30 +110036http://www.ntrnet.net/~jmknoble/software/x11-ssh-askpass/index.html
Damien Miller780b3761999-12-26 13:36:11 +110037
Damien Miller0736c4d2001-01-25 10:51:46 +110038PRNGD:
39
40If your system lacks Kernel based random collection, the use of Lutz
41Jaenicke's PRNGd is recommended.
42
43http://www.aet.tu-cottbus.de/personen/jaenicke/postfix_tls/prngd.html
44
45EGD:
46
Damien Miller54057c22000-05-09 15:03:37 +100047The Entropy Gathering Daemon (EGD) is supported if you have a system which
48lacks /dev/random and don't want to use OpenSSH's internal entropy collection.
Damien Millerb5f89271999-11-12 14:35:58 +110049
Damien Millerb5f89271999-11-12 14:35:58 +110050http://www.lothar.com/tech/crypto/
51
Ben Lindstrom305fb002000-11-10 02:41:30 +000052S/Key Libraries:
53http://www.sparc.spb.su/solaris/skey/
54
55If you wish to use --with-skey then you will need the above library
56installed. No other current S/Key library is currently known to be
Ben Lindstromdcca9812000-11-10 03:28:31 +000057supported.
Ben Lindstromca1c2a02000-10-14 21:33:19 +000058
Damien Millerb5f89271999-11-12 14:35:58 +1100592. Building / Installation
60--------------------------
61
62To install OpenSSH with default options:
63
64./configure
65make
66make install
67
68This will install the OpenSSH binaries in /usr/local/bin, configuration files
69in /usr/local/etc, the server in /usr/local/sbin, etc. To specify a different
70installation prefix, use the --prefix option to configure:
71
72./configure --prefix=/opt
73make
74make install
75
76Will install OpenSSH in /opt/{bin,etc,lib,sbin}. You can also override
77specific paths, for example:
78
79./configure --prefix=/opt --sysconfdir=/etc/ssh
80make
81make install
82
83This will install the binaries in /opt/{bin,lib,sbin}, but will place the
84configuration files in /etc/ssh.
85
Kevin Steves32c97c32001-04-20 20:56:21 +000086If you are using PAM, you may need to manually install a PAM control
87file as "/etc/pam.d/sshd" (or wherever your system prefers to keep
88them). Note that the service name used to start PAM is __progname,
89which is the basename of the path of your sshd (e.g., the service name
90for /usr/sbin/osshd will be osshd). If you have renamed your sshd
91executable, your PAM configuration may need to be modified.
92
93A generic PAM configuration is included as "contrib/sshd.pam.generic",
94you may need to edit it before using it on your system. If you are
95using a recent version of Red Hat Linux, the config file in
96contrib/redhat/sshd.pam should be more useful. Failure to install a
97valid PAM file may result in an inability to use password
98authentication. On HP-UX 11 and Solaris, the standard /etc/pam.conf
99configuration will work with sshd (sshd will match the other service
Kevin Stevesdf4a7ae2000-11-07 14:47:51 +0000100name).
Damien Miller755c90c1999-11-22 16:12:31 +1100101
Damien Millerb5f89271999-11-12 14:35:58 +1100102There are a few other options to the configure script:
103
Damien Miller86093322001-02-18 12:58:24 +1100104--with-pam enables PAM support.
Damien Miller8bdeee21999-12-30 15:50:54 +1100105
Damien Millerc0967271999-11-19 15:53:50 +1100106--enable-gnome-askpass will build the GNOME passphrase dialog. You
107need a working installation of GNOME, including the development
108headers, for this to work.
Damien Millerb5f89271999-11-12 14:35:58 +1100109
Damien Millerd0ccb982001-03-04 00:29:20 +1100110--with-prngd-socket=/some/file allows you to enable EGD or PRNGD
111support and to specify a PRNGd socket. Use this if your Unix lacks
112/dev/random and you don't want to use OpenSSH's builtin entropy
113collection support.
114
115--with-prngd-port=portnum allows you to enable EGD or PRNGD support
116and to specify a EGD localhost TCP port. Use this if your Unix lacks
Damien Miller0736c4d2001-01-25 10:51:46 +1100117/dev/random and you don't want to use OpenSSH's builtin entropy
118collection support.
Damien Millerb5f89271999-11-12 14:35:58 +1100119
Damien Miller8bdeee21999-12-30 15:50:54 +1100120--with-lastlog=FILE will specify the location of the lastlog file.
121./configure searches a few locations for lastlog, but may not find
122it if lastlog is installed in a different place.
123
124--without-lastlog will disable lastlog support entirely.
125
Ben Lindstrom72af2ef2001-05-08 20:42:28 +0000126--with-sia, --without-sia will enable or disable OSF1's Security
127Integration Architecture. The default for OSF1 machines is enable.
128
Damien Miller105b7f02000-01-07 08:45:55 +1100129--with-kerberos4=PATH will enable Kerberos IV support. You will need
130to have the Kerberos libraries and header files installed for this
131to work. Use the optional PATH argument to specify the root of your
132Kerberos installation.
Damien Millerc0967271999-11-19 15:53:50 +1100133
Damien Miller105b7f02000-01-07 08:45:55 +1100134--with-afs=PATH will enable AFS support. You will need to have the
135Kerberos IV and the AFS libraries and header files installed for this
136to work. Use the optional PATH argument to specify the root of your
137AFS installation. AFS requires Kerberos support to be enabled.
Damien Millerc0967271999-11-19 15:53:50 +1100138
Ben Lindstrom305fb002000-11-10 02:41:30 +0000139--with-skey=PATH will enable S/Key one time password support. You will
140need the S/Key libraries and header files installed for this to work.
Damien Millerc0967271999-11-19 15:53:50 +1100141
142--with-tcp-wrappers will enable TCP Wrappers (/etc/hosts.allow|deny)
143support. You will need libwrap.a and tcpd.h installed.
144
145--with-md5-passwords will enable the use of MD5 passwords. Enable this
146if your operating system uses MD5 passwords without using PAM.
Damien Miller3d1b22c1999-11-12 15:46:08 +1100147
Damien Miller8bdeee21999-12-30 15:50:54 +1100148--with-utmpx enables utmpx support. utmpx support is automatic for
149some platforms.
150
151--without-shadow disables shadow password support.
152
153--with-ipaddr-display forces the use of a numeric IP address in the
154$DISPLAY environment variable. Some broken systems need this.
155
156--with-default-path=PATH allows you to specify a default $PATH for sessions
Damien Miller29ea30d2000-03-17 10:54:15 +1100157started by sshd. This replaces the standard path entirely.
Damien Miller8bdeee21999-12-30 15:50:54 +1100158
Damien Miller5eed6a22000-01-16 12:05:18 +1100159--with-pid-dir=PATH specifies the directory in which the ssh.pid file is
160created.
161
162--with-xauth=PATH specifies the location of the xauth binary
163
Damien Miller7d80e342000-01-19 14:36:49 +1100164--with-ipv4-default instructs OpenSSH to use IPv4 by default for new
165connections. Normally OpenSSH will try attempt to lookup both IPv6 and
166IPv4 addresses. On Linux/glibc-2.1.2 this causes long delays in name
167resolution. If this option is specified, you can still attempt to
168connect to IPv6 addresses using the command line option '-6'.
169
Damien Miller0c0e4bf2000-02-03 13:58:51 +1100170--with-ssl-dir=DIR allows you to specify where your OpenSSL libraries
171are installed.
172
Damien Millerfd263682000-03-16 11:51:09 +1100173--with-4in6 Check for IPv4 in IPv6 mapped addresses and convert them to
174real (AF_INET) IPv4 addresses. Works around some quirks on Linux.
175
Ben Lindstroma42694f2002-04-05 16:11:45 +0000176--with-opensc=DIR
177--with-sectok=DIR allows for OpenSC or sectok smartcard libraries to
178be used with OpenSSH. See 'README.smartcard' for more details.
179
Damien Millerbeb4ba51999-12-28 15:09:35 +1100180If you need to pass special options to the compiler or linker, you
Damien Miller615f9392000-05-17 22:53:33 +1000181can specify these as environment variables before running ./configure.
Damien Millerbeb4ba51999-12-28 15:09:35 +1100182For example:
183
Damien Millerb5c42d92000-08-31 11:13:10 +1100184CFLAGS="-O -m486" LDFLAGS="-s" LIBS="-lrubbish" LD="/usr/foo/ld" ./configure
Damien Millerb5f89271999-11-12 14:35:58 +1100185
1863. Configuration
187----------------
188
189The runtime configuration files are installed by in ${prefix}/etc or
190whatever you specified as your --sysconfdir (/usr/local/etc by default).
191
192The default configuration should be instantly usable, though you should
193review it to ensure that it matches your security requirements.
194
Damien Miller4095f892000-03-03 22:13:52 +1100195To generate a host key, run "make host-key". Alternately you can do so
Damien Millerc601a752000-06-10 08:33:38 +1000196manually using the following commands:
Damien Miller2a9d9f61999-11-15 23:34:11 +1100197
Damien Miller86093322001-02-18 12:58:24 +1100198 ssh-keygen -t rsa1 -f /etc/ssh/ssh_host_key -N ""
199 ssh-keygen -t rsa -f /etc/ssh/ssh_host_rsa_key -N ""
200 ssh-keygen -t dsa -f /etc/ssh/ssh_host_dsa_key -N ""
Damien Miller2a9d9f61999-11-15 23:34:11 +1100201
Damien Miller6ae00d61999-12-14 15:43:03 +1100202Replacing /etc/ssh with the correct path to the configuration directory.
203(${prefix}/etc or whatever you specified with --sysconfdir during
204configuration)
205
Damien Millerab8a4da1999-12-16 13:05:30 +1100206If you have configured OpenSSH with EGD support, ensure that EGD is
207running and has collected some Entropy.
208
Damien Millerb5f89271999-11-12 14:35:58 +1100209For more information on configuration, please refer to the manual pages
210for sshd, ssh and ssh-agent.
211
Damien Miller6ae00d61999-12-14 15:43:03 +11002124. Problems?
213------------
214
215If you experience problems compiling, installing or running OpenSSH.
216Please refer to the "reporting bugs" section of the webpage at
Damien Miller615f9392000-05-17 22:53:33 +1000217http://www.openssh.com/
Damien Miller6ae00d61999-12-14 15:43:03 +1100218
Damien Millere9cf3572001-02-09 12:55:35 +1100219
Damien Miller6d8d7882002-07-25 14:36:24 +1000220$Id: INSTALL,v 1.55 2002/07/25 04:36:25 djm Exp $