Home | History | Annotate | only in /external/openssh
Up to higher level directory
NameDateSize
aclocal.m405-Oct-20175.3K
addrmatch.c05-Oct-201710.9K
Android.mk05-Oct-20176.3K
atomicio.c05-Oct-20174.4K
atomicio.h05-Oct-20172.1K
audit-bsm.c05-Oct-201711.9K
audit-linux.c05-Oct-20173.5K
audit.c05-Oct-20175.7K
audit.h05-Oct-20172.3K
auth-bsdauth.c05-Oct-20173.6K
auth-chall.c05-Oct-20173.6K
auth-krb5.c05-Oct-20176.9K
auth-options.c05-Oct-201715.5K
auth-options.h05-Oct-20171.2K
auth-pam.c05-Oct-201730.8K
auth-pam.h05-Oct-20172K
auth-passwd.c05-Oct-20176.2K
auth-rh-rsa.c05-Oct-20173K
auth-rhosts.c05-Oct-20179.3K
auth-rsa.c05-Oct-20179.1K
auth-shadow.c05-Oct-20174.2K
auth-sia.c05-Oct-20173.1K
auth-sia.h05-Oct-20171.4K
auth-skey.c05-Oct-20172.8K
auth.c05-Oct-201719.9K
auth.h05-Oct-20177.4K
auth1.c05-Oct-201710.1K
auth2-chall.c05-Oct-20179.2K
auth2-gss.c05-Oct-20178K
auth2-hostbased.c05-Oct-20177.2K
auth2-kbdint.c05-Oct-20172.1K
auth2-none.c05-Oct-20172.3K
auth2-passwd.c05-Oct-20172.5K
auth2-pubkey.c05-Oct-201728.4K
auth2.c05-Oct-201715.9K
authfd.c05-Oct-201717.5K
authfd.h05-Oct-20173K
authfile.c05-Oct-201713.8K
authfile.h05-Oct-20172.3K
bitmap.c05-Oct-20174.4K
bitmap.h05-Oct-20171.8K
blocks.c05-Oct-20176.5K
bufaux.c05-Oct-20175.1K
bufbn.c05-Oct-20172.5K
bufec.c05-Oct-20171.9K
buffer.c05-Oct-20172.6K
buffer.h05-Oct-20173.5K
buildpkg.sh.in05-Oct-201717.6K
canohost.c05-Oct-201711.2K
canohost.h05-Oct-20171,000
chacha.c05-Oct-20175.3K
chacha.h05-Oct-2017975
ChangeLog05-Oct-2017241.9K
channels.c05-Oct-2017112.9K
channels.h05-Oct-201711.6K
cipher-3des1.c05-Oct-20174.2K
cipher-aes.c05-Oct-20174.5K
cipher-aesctr.c05-Oct-20172.1K
cipher-aesctr.h05-Oct-20171.3K
cipher-bf1.c05-Oct-20172.7K
cipher-chachapoly.c05-Oct-20173.7K
cipher-chachapoly.h05-Oct-20171.6K
cipher-ctr.c05-Oct-20173.6K
cipher.c05-Oct-201717K
cipher.h05-Oct-20174.4K
cleanup.c05-Oct-20171K
clientloop.c05-Oct-201773.4K
clientloop.h05-Oct-20173.5K
compat.c05-Oct-20179.1K
compat.h05-Oct-20172.9K
config.guess05-Oct-201744K
config.h05-Oct-201743.5K
config.h.in05-Oct-201744.1K
config.sub05-Oct-201734.9K
configure05-Oct-2017942.4K
configure.ac05-Oct-2017135.2K
contrib/05-Oct-2017
crc32.c05-Oct-20174.9K
crc32.h05-Oct-20171.4K
CREDITS05-Oct-20175.4K
crypto_api.h05-Oct-20171.3K
deattack.c05-Oct-20174.1K
deattack.h05-Oct-20171K
defines.h05-Oct-201720.9K
dh.c05-Oct-201711.3K
dh.h05-Oct-20172.5K
digest-libc.c05-Oct-20175.9K
digest-openssl.c05-Oct-20175K
digest.h05-Oct-20172.5K
dispatch.c05-Oct-20173.7K
dispatch.h05-Oct-20172.3K
dns.c05-Oct-20179.2K
dns.h05-Oct-20172K
ed25519.c05-Oct-20173.1K
entropy.c05-Oct-20176.1K
entropy.h05-Oct-20171.5K
fatal.c05-Oct-20171.6K
fe25519.c05-Oct-20178.1K
fe25519.h05-Oct-20172.3K
fixalgorithms05-Oct-2017422
fixpaths05-Oct-2017499
fixprogs05-Oct-20171.6K
ge25519.c05-Oct-201711K
ge25519.h05-Oct-20171.4K
ge25519_base.data05-Oct-2017164.6K
groupaccess.c05-Oct-20173.4K
groupaccess.h05-Oct-20171.5K
gss-genr.c05-Oct-20177.3K
gss-serv-krb5.c05-Oct-20175.6K
gss-serv.c05-Oct-201710.1K
hash.c05-Oct-20171.8K
hmac.c05-Oct-20175.1K
hmac.h05-Oct-20171.6K
hostfile.c05-Oct-201722.3K
hostfile.h05-Oct-20173.8K
includes.h05-Oct-20174K
INSTALL05-Oct-20178.9K
install-sh05-Oct-20175.5K
kex.c05-Oct-201722.6K
kex.h05-Oct-20176.9K
kexc25519.c05-Oct-20174.6K
kexc25519c.c05-Oct-20175.1K
kexc25519s.c05-Oct-20175K
kexdh.c05-Oct-20173.2K
kexdhc.c05-Oct-20175.8K
kexdhs.c05-Oct-20175.9K
kexecdh.c05-Oct-20173.5K
kexecdhc.c05-Oct-20176.3K
kexecdhs.c05-Oct-20176K
kexgex.c05-Oct-20173.6K
kexgexc.c05-Oct-20177.6K
kexgexs.c05-Oct-20177.2K
key.c05-Oct-20178.4K
key.h05-Oct-20174K
krl.c05-Oct-201734K
krl.h05-Oct-20172.6K
LICENCE05-Oct-201715.7K
log.c05-Oct-201710.4K
log.h05-Oct-20172.5K
loginrec.c05-Oct-201741.9K
loginrec.h05-Oct-20174.6K
logintest.c05-Oct-20178.6K
mac.c05-Oct-20177.1K
mac.h05-Oct-20171.9K
Makefile.in05-Oct-201723.6K
match.c05-Oct-20177.2K
match.h05-Oct-20171K
md-sha256.c05-Oct-20172.2K
md5crypt.c05-Oct-20174K
md5crypt.h05-Oct-2017803
mdoc2man.awk05-Oct-20178.4K
misc.c05-Oct-201723K
misc.h05-Oct-20174.4K
mkinstalldirs05-Oct-2017691
moduli05-Oct-2017293.3K
moduli.005-Oct-20173.4K
moduli.505-Oct-20173.6K
moduli.c05-Oct-201720.5K
monitor.c05-Oct-201750.2K
monitor.h05-Oct-20174K
monitor_fdpass.c05-Oct-20174.7K
monitor_fdpass.h05-Oct-20171.5K
monitor_mm.c05-Oct-20178.5K
monitor_mm.h05-Oct-20172.2K
monitor_wrap.c05-Oct-201724.7K
monitor_wrap.h05-Oct-20174K
msg.c05-Oct-20172.8K
msg.h05-Oct-20171.5K
mux.c05-Oct-201757.9K
myproposal.h05-Oct-20175.4K
nchan.c05-Oct-201712.8K
nchan.ms05-Oct-20173.9K
nchan2.ms05-Oct-20173.4K
opacket.c05-Oct-20176K
opacket.h05-Oct-20176.6K
openbsd-compat/05-Oct-2017
openssh.xml.in05-Oct-20172.8K
opensshd.init.in05-Oct-20172K
OVERVIEW05-Oct-20176.5K
packet.c05-Oct-201779.3K
packet.h05-Oct-20177K
pathnames.h05-Oct-20176K
pkcs11.h05-Oct-201741.4K
platform.c05-Oct-20174.9K
platform.h05-Oct-20171.3K
poly1305.c05-Oct-20174.5K
poly1305.h05-Oct-2017645
progressmeter.c05-Oct-20177.4K
progressmeter.h05-Oct-20171.4K
PROTOCOL05-Oct-201716.4K
PROTOCOL.agent05-Oct-201717.6K
PROTOCOL.certkeys05-Oct-201710.4K
PROTOCOL.chacha20poly130505-Oct-20174.4K
PROTOCOL.key05-Oct-20171.5K
PROTOCOL.krl05-Oct-20175K
PROTOCOL.mux05-Oct-20176.1K
readconf.c05-Oct-201768.8K
readconf.h05-Oct-20177.1K
README05-Oct-20172.8K
README.dns05-Oct-20171.6K
README.platform05-Oct-20173.9K
README.privsep05-Oct-20172.6K
README.tun05-Oct-20174.8K
README.version05-Oct-2017150
readpass.c05-Oct-20175K
rijndael.c05-Oct-201751.6K
rijndael.h05-Oct-20172.1K
roaming.h05-Oct-20171.7K
roaming_client.c05-Oct-20177K
roaming_common.c05-Oct-20175.4K
roaming_dummy.c05-Oct-20171.5K
roaming_serv.c05-Oct-20171K
rsa.c05-Oct-20175K
rsa.h05-Oct-2017864
sandbox-capsicum.c05-Oct-20173.3K
sandbox-darwin.c05-Oct-20172.5K
sandbox-null.c05-Oct-20171.6K
sandbox-rlimit.c05-Oct-20172.4K
sandbox-seccomp-filter.c05-Oct-20178.1K
sandbox-systrace.c05-Oct-20176.2K
sc25519.c05-Oct-20177.2K
sc25519.h05-Oct-20172.8K
scp.005-Oct-20176K
scp.105-Oct-20175K
scp.c05-Oct-201731.3K
servconf.c05-Oct-201770.3K
servconf.h05-Oct-20179.9K
serverloop.c05-Oct-201739.5K
serverloop.h05-Oct-20171,016
session.c05-Oct-201766.5K
session.h05-Oct-20172.5K
sftp-client.c05-Oct-201748.8K
sftp-client.h05-Oct-20174.2K
sftp-common.c05-Oct-20176.8K
sftp-common.h05-Oct-20172K
sftp-glob.c05-Oct-20173.4K
sftp-server-main.c05-Oct-20171.4K
sftp-server.005-Oct-20174.2K
sftp-server.805-Oct-20175K
sftp-server.c05-Oct-201742.3K
sftp.005-Oct-201715.2K
sftp.105-Oct-201714.4K
sftp.c05-Oct-201756.6K
sftp.h05-Oct-20173.3K
smult_curve25519_ref.c05-Oct-20176.7K
ssh-add.005-Oct-20175.3K
ssh-add.105-Oct-20176.6K
ssh-add.c05-Oct-201715.8K
ssh-agent.005-Oct-20175.1K
ssh-agent.105-Oct-20176.6K
ssh-agent.c05-Oct-201735K
ssh-dss.c05-Oct-20175.8K
ssh-ecdsa.c05-Oct-20175.2K
ssh-ed25519.c05-Oct-20174.2K
ssh-gss.h05-Oct-20174.6K
ssh-keygen.005-Oct-201727.1K
ssh-keygen.105-Oct-201725.8K
ssh-keygen.c05-Oct-201771K
ssh-keyscan.005-Oct-20174.5K
ssh-keyscan.105-Oct-20174.2K
ssh-keyscan.c05-Oct-201717.8K
ssh-keysign.005-Oct-20171.8K
ssh-keysign.805-Oct-20173K
ssh-keysign.c05-Oct-20178K
ssh-pkcs11-client.c05-Oct-20175.2K
ssh-pkcs11-helper.005-Oct-2017642
ssh-pkcs11-helper.805-Oct-20171.3K
ssh-pkcs11-helper.c05-Oct-20177.9K
ssh-pkcs11.c05-Oct-201718.3K
ssh-pkcs11.h05-Oct-20171.1K
ssh-rsa.c05-Oct-20176.8K
ssh-sandbox.h05-Oct-20171.1K
ssh.005-Oct-201748K
ssh.105-Oct-201744.2K
ssh.c05-Oct-201758K
ssh.h05-Oct-20172.7K
ssh1.h05-Oct-20174.1K
ssh2.h05-Oct-20175.8K
ssh_api.c05-Oct-201713.5K
ssh_api.h05-Oct-20174.3K
ssh_config05-Oct-20171.5K
ssh_config.005-Oct-201758.2K
ssh_config.505-Oct-201747.5K
sshbuf-getput-basic.c05-Oct-20179.2K
sshbuf-getput-crypto.c05-Oct-20175.6K
sshbuf-misc.c05-Oct-20173.1K
sshbuf.c05-Oct-20179.2K
sshbuf.h05-Oct-201711.3K
sshconnect.c05-Oct-201740.7K
sshconnect.h05-Oct-20172.6K
sshconnect1.c05-Oct-201722.1K
sshconnect2.c05-Oct-201747.6K
sshd.005-Oct-201732.9K
sshd.805-Oct-201730.6K
sshd.c05-Oct-201770.4K
sshd_config05-Oct-20173.6K
sshd_config.005-Oct-201757.2K
sshd_config.505-Oct-201747.9K
sshd_config.android05-Oct-20173.3K
ssherr.c05-Oct-20174.8K
ssherr.h05-Oct-20173.2K
sshkey.c05-Oct-201795.7K
sshkey.h05-Oct-20178K
sshlogin.c05-Oct-20175.1K
sshlogin.h05-Oct-2017935
sshpty.c05-Oct-20176.1K
sshpty.h05-Oct-20171,009
sshtty.c05-Oct-20172.9K
start-ssh05-Oct-2017998
survey.sh.in05-Oct-20171.7K
TODO05-Oct-20172.7K
ttymodes.c05-Oct-201710.4K
ttymodes.h05-Oct-20175.2K
uidswap.c05-Oct-20179K
uidswap.h05-Oct-2017716
umac.c05-Oct-201745.8K
umac.h05-Oct-20174.6K
umac128.c05-Oct-2017522
uuencode.c05-Oct-20172.9K
uuencode.h05-Oct-20171.5K
verify.c05-Oct-2017668
version.h05-Oct-2017170
xmalloc.c05-Oct-20172K
xmalloc.h05-Oct-20171K

README

      1 See http://www.openssh.com/txt/release-7.1p2 for the release notes.
      2 
      3 Please read http://www.openssh.com/report.html for bug reporting
      4 instructions and note that we do not use Github for bug reporting or
      5 patch/pull-request management.
      6 
      7 - A Japanese translation of this document and of the OpenSSH FAQ is
      8 - available at http://www.unixuser.org/~haruyama/security/openssh/index.html
      9 - Thanks to HARUYAMA Seigo <haruyama (a] unixuser.org>
     10 
     11 This is the port of OpenBSD's excellent OpenSSH[0] to Linux and other
     12 Unices.
     13 
     14 OpenSSH is based on the last free version of Tatu Ylonen's sample
     15 implementation with all patent-encumbered algorithms removed (to
     16 external libraries), all known security bugs fixed, new features
     17 reintroduced and many other clean-ups.  OpenSSH has been created by
     18 Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos, Theo de Raadt,
     19 and Dug Song. It has a homepage at http://www.openssh.com/
     20 
     21 This port consists of the re-introduction of autoconf support, PAM
     22 support, EGD[1]/PRNGD[2] support and replacements for OpenBSD library
     23 functions that are (regrettably) absent from other unices. This port
     24 has been best tested on AIX, Cygwin, HP-UX, Linux, MacOS/X,
     25 NetBSD, OpenBSD, OpenServer, Solaris, Unicos, and UnixWare.
     26 
     27 This version actively tracks changes in the OpenBSD CVS repository.
     28 
     29 The PAM support is now more functional than the popular packages of
     30 commercial ssh-1.2.x. It checks "account" and "session" modules for
     31 all logins, not just when using password authentication.
     32 
     33 OpenSSH depends on Zlib[3], OpenSSL[4] and optionally PAM[5].
     34 
     35 There is now several mailing lists for this port of OpenSSH. Please
     36 refer to http://www.openssh.com/list.html for details on how to join.
     37 
     38 Please send bug reports and patches to the mailing list
     39 openssh-unix-dev (a] mindrot.org. The list is open to posting by
     40 unsubscribed users.Code contribution are welcomed, but please follow the 
     41 OpenBSD style guidelines[6].
     42 
     43 Please refer to the INSTALL document for information on how to install
     44 OpenSSH on your system. There are a number of differences between this
     45 port of OpenSSH and F-Secure SSH 1.x, please refer to the OpenSSH FAQ[7]
     46 for details and general tips.
     47 
     48 Damien Miller <djm (a] mindrot.org>
     49 
     50 Miscellania -
     51 
     52 This version of OpenSSH is based upon code retrieved from the OpenBSD
     53 CVS repository which in turn was based on the last free sample
     54 implementation released by Tatu Ylonen.
     55 
     56 References -
     57 
     58 [0] http://www.openssh.com/faq.html
     59 [1] http://www.lothar.com/tech/crypto/
     60 [2] http://www.aet.tu-cottbus.de/personen/jaenicke/postfix_tls/prngd.html
     61 [3] http://www.gzip.org/zlib/
     62 [4] http://www.openssl.org/
     63 [5] http://www.openpam.org
     64     http://www.kernel.org/pub/linux/libs/pam/ 
     65     (PAM also is standard on Solaris and HP-UX 11)
     66 [6] http://www.openbsd.org/cgi-bin/man.cgi?query=style&sektion=9
     67 [7] http://www.openssh.com/faq.html
     68 
     69 $Id: README,v 1.87 2014/08/10 01:35:06 djm Exp $
     70 

README.dns

      1 How to verify host keys using OpenSSH and DNS
      2 ---------------------------------------------
      3 
      4 OpenSSH contains support for verifying host keys using DNS as described in
      5 draft-ietf-secsh-dns-05.txt. The document contains very brief instructions
      6 on how to use this feature. Configuring DNS is out of the scope of this
      7 document.
      8 
      9 
     10 (1) Server: Generate and publish the DNS RR
     11 
     12 To create a DNS resource record (RR) containing a fingerprint of the
     13 public host key, use the following command:
     14 
     15 	ssh-keygen -r hostname -f keyfile -g
     16 
     17 where "hostname" is your fully qualified hostname and "keyfile" is the
     18 file containing the public host key file. If you have multiple keys,
     19 you should generate one RR for each key.
     20 
     21 In the example above, ssh-keygen will print the fingerprint in a
     22 generic DNS RR format parsable by most modern name server
     23 implementations. If your nameserver has support for the SSHFP RR
     24 you can omit the -g flag and ssh-keygen will print a standard SSHFP RR.
     25 
     26 To publish the fingerprint using the DNS you must add the generated RR
     27 to your DNS zone file and sign your zone.
     28 
     29 
     30 (2) Client: Enable ssh to verify host keys using DNS
     31 
     32 To enable the ssh client to verify host keys using DNS, you have to
     33 add the following option to the ssh configuration file
     34 ($HOME/.ssh/config or /etc/ssh/ssh_config):
     35 
     36     VerifyHostKeyDNS yes
     37 
     38 Upon connection the client will try to look up the fingerprint RR
     39 using DNS. If the fingerprint received from the DNS server matches
     40 the remote host key, the user will be notified.
     41 
     42 
     43 	Jakob Schlyter
     44 	Wesley Griffin
     45 
     46 
     47 $OpenBSD: README.dns,v 1.2 2003/10/14 19:43:23 jakob Exp $
     48 

README.platform

      1 This file contains notes about OpenSSH on specific platforms.
      2 
      3 AIX
      4 ---
      5 As of OpenSSH 3.8p1, sshd will now honour an accounts password expiry
      6 settings, where previously it did not.  Because of this, it's possible for
      7 sites that have used OpenSSH's sshd exclusively to have accounts which
      8 have passwords expired longer than the inactive time (ie the "Weeks between
      9 password EXPIRATION and LOCKOUT" setting in SMIT or the maxexpired
     10 chuser attribute).
     11 
     12 Accounts in this state must have their passwords reset manually by the
     13 administrator.  As a precaution, it is recommended that the administrative
     14 passwords be reset before upgrading from OpenSSH <3.8.
     15 
     16 As of OpenSSH 4.0, configure will attempt to detect if your version
     17 and maintenance level of AIX has a working getaddrinfo, and will use it
     18 if found.  This will enable IPv6 support.  If for some reason configure
     19 gets it wrong, or if you want to build binaries to work on earlier MLs
     20 than the build host then you can add "-DBROKEN_GETADDRINFO" to CFLAGS
     21 to force the previous IPv4-only behaviour.
     22 
     23 IPv6 known to work: 5.1ML7 5.2ML2 5.2ML5
     24 IPv6 known broken: 4.3.3ML11 5.1ML4
     25 
     26 If you wish to use dynamic libraries that aren't in the normal system
     27 locations (eg IBM's OpenSSL and zlib packages) then you will need to
     28 define the environment variable blibpath before running configure, eg
     29 
     30 blibpath=/lib:/usr/lib:/opt/freeware/lib ./configure \
     31   --with-ssl-dir=/opt/freeware --with-zlib=/opt/freeware
     32 
     33 If sshd is built with the WITH_AIXAUTHENTICATE option (which is enabled
     34 by default) then sshd checks that users are permitted via the
     35 loginrestrictions() function, in particular that the user has the
     36 "rlogin" attribute set.  This check is not done for the root account,
     37 instead the PermitRootLogin setting in sshd_config is used.
     38 
     39 
     40 Cygwin
     41 ------
     42 To build on Cygwin, OpenSSH requires the following packages:
     43 gcc, gcc-mingw-core, mingw-runtime, binutils, make, openssl,
     44 openssl-devel, zlib, minres, minires-devel.
     45 
     46 
     47 Darwin and MacOS X
     48 ------------------
     49 Darwin does not provide a tun(4) driver required for OpenSSH-based
     50 virtual private networks. The BSD manpage still exists, but the driver
     51 has been removed in recent releases of Darwin and MacOS X.
     52 
     53 Nevertheless, tunnel support is known to work with Darwin 8 and
     54 MacOS X 10.4 in Point-to-Point (Layer 3) and Ethernet (Layer 2) mode
     55 using a third party driver. More information is available at:
     56 	http://www-user.rhrk.uni-kl.de/~nissler/tuntap/
     57 
     58 
     59 Linux
     60 -----
     61 
     62 Some Linux distributions (including Red Hat/Fedora/CentOS) include
     63 headers and library links in the -devel RPMs rather than the main
     64 binary RPMs. If you get an error about headers, or complaining about a
     65 missing prerequisite then you may need to install the equivalent
     66 development packages.  On Redhat based distros these may be openssl-devel,
     67 zlib-devel and pam-devel, on Debian based distros these may be
     68 libssl-dev, libz-dev and libpam-dev.
     69 
     70 
     71 Solaris
     72 -------
     73 If you enable BSM auditing on Solaris, you need to update audit_event(4)
     74 for praudit(1m) to give sensible output.  The following line needs to be
     75 added to /etc/security/audit_event:
     76 
     77 	32800:AUE_openssh:OpenSSH login:lo
     78 
     79 The BSM audit event range available for third party TCB applications is
     80 32768 - 65535.  Event number 32800 has been choosen for AUE_openssh.
     81 There is no official registry of 3rd party event numbers, so if this
     82 number is already in use on your system, you may change it at build time
     83 by configure'ing --with-cflags=-DAUE_openssh=32801 then rebuilding.
     84 
     85 
     86 Platforms using PAM
     87 -------------------
     88 As of OpenSSH 4.3p1, sshd will no longer check /etc/nologin itself when
     89 PAM is enabled.  To maintain existing behaviour, pam_nologin should be
     90 added to sshd's session stack which will prevent users from starting shell
     91 sessions.  Alternatively, pam_nologin can be added to either the auth or
     92 account stacks which will prevent authentication entirely, but will still
     93 return the output from pam_nologin to the client.
     94 
     95 
     96 $Id: README.platform,v 1.10 2009/08/28 23:14:48 dtucker Exp $
     97 

README.privsep

      1 Privilege separation, or privsep, is method in OpenSSH by which
      2 operations that require root privilege are performed by a separate
      3 privileged monitor process.  Its purpose is to prevent privilege
      4 escalation by containing corruption to an unprivileged process.
      5 More information is available at:
      6 	http://www.citi.umich.edu/u/provos/ssh/privsep.html
      7 
      8 Privilege separation is now enabled by default; see the
      9 UsePrivilegeSeparation option in sshd_config(5).
     10 
     11 On systems which lack mmap or anonymous (MAP_ANON) memory mapping,
     12 compression must be disabled in order for privilege separation to
     13 function.
     14 
     15 When privsep is enabled, during the pre-authentication phase sshd will
     16 chroot(2) to "/var/empty" and change its privileges to the "sshd" user
     17 and its primary group.  sshd is a pseudo-account that should not be
     18 used by other daemons, and must be locked and should contain a
     19 "nologin" or invalid shell.
     20 
     21 You should do something like the following to prepare the privsep
     22 preauth environment:
     23 
     24 	# mkdir /var/empty
     25 	# chown root:sys /var/empty
     26 	# chmod 755 /var/empty
     27 	# groupadd sshd
     28 	# useradd -g sshd -c 'sshd privsep' -d /var/empty -s /bin/false sshd
     29 
     30 /var/empty should not contain any files.
     31 
     32 configure supports the following options to change the default
     33 privsep user and chroot directory:
     34 
     35   --with-privsep-path=xxx Path for privilege separation chroot
     36   --with-privsep-user=user Specify non-privileged user for privilege separation
     37 
     38 Privsep requires operating system support for file descriptor passing.
     39 Compression will be disabled on systems without a working mmap MAP_ANON.
     40 
     41 PAM-enabled OpenSSH is known to function with privsep on AIX, FreeBSD, 
     42 HP-UX (including Trusted Mode), Linux, NetBSD and Solaris.
     43 
     44 On Cygwin, Tru64 Unix, OpenServer, and Unicos only the pre-authentication
     45 part of privsep is supported.  Post-authentication privsep is disabled
     46 automatically (so you won't see the additional process mentioned below).
     47 
     48 Note that for a normal interactive login with a shell, enabling privsep
     49 will require 1 additional process per login session.
     50 
     51 Given the following process listing (from HP-UX):
     52 
     53      UID   PID  PPID  C    STIME TTY       TIME COMMAND
     54     root  1005     1  0 10:45:17 ?         0:08 /opt/openssh/sbin/sshd -u0
     55     root  6917  1005  0 15:19:16 ?         0:00 sshd: stevesk [priv]
     56  stevesk  6919  6917  0 15:19:17 ?         0:03 sshd: stevesk@2
     57  stevesk  6921  6919  0 15:19:17 pts/2     0:00 -bash
     58 
     59 process 1005 is the sshd process listening for new connections.
     60 process 6917 is the privileged monitor process, 6919 is the user owned
     61 sshd process and 6921 is the shell process.
     62 
     63 $Id: README.privsep,v 1.16 2005/06/04 23:21:41 djm Exp $
     64 

README.tun

      1 How to use OpenSSH-based virtual private networks
      2 -------------------------------------------------
      3 
      4 OpenSSH contains support for VPN tunneling using the tun(4) network
      5 tunnel pseudo-device which is available on most platforms, either for
      6 layer 2 or 3 traffic.
      7 
      8 The following brief instructions on how to use this feature use
      9 a network configuration specific to the OpenBSD operating system.
     10 
     11 (1) Server: Enable support for SSH tunneling
     12 
     13 To enable the ssh server to accept tunnel requests from the client, you
     14 have to add the following option to the ssh server configuration file
     15 (/etc/ssh/sshd_config):
     16 
     17 	PermitTunnel yes
     18 
     19 Restart the server or send the hangup signal (SIGHUP) to let the server
     20 reread it's configuration.
     21 
     22 (2) Server: Restrict client access and assign the tunnel
     23 
     24 The OpenSSH server simply uses the file /root/.ssh/authorized_keys to
     25 restrict the client to connect to a specified tunnel and to
     26 automatically start the related interface configuration command. These
     27 settings are optional but recommended:
     28 
     29 	tunnel="1",command="sh /etc/netstart tun1" ssh-rsa ... reyk (a] openbsd.org
     30 
     31 (3) Client: Configure the local network tunnel interface
     32 
     33 Use the hostname.if(5) interface-specific configuration file to set up
     34 the network tunnel configuration with OpenBSD. For example, use the
     35 following configuration in /etc/hostname.tun0 to set up the layer 3
     36 tunnel on the client:
     37 
     38 	inet 192.168.5.1 255.255.255.252 192.168.5.2
     39 
     40 OpenBSD also supports layer 2 tunneling over the tun device by adding
     41 the link0 flag:
     42 
     43 	inet 192.168.1.78 255.255.255.0 192.168.1.255 link0
     44 
     45 Layer 2 tunnels can be used in combination with an Ethernet bridge(4)
     46 interface, like the following example for /etc/bridgename.bridge0:
     47 
     48 	add tun0
     49 	add sis0
     50 	up
     51 
     52 (4) Client: Configure the OpenSSH client
     53 
     54 To establish tunnel forwarding for connections to a specified
     55 remote host by default, use the following ssh client configuration for
     56 the privileged user (in /root/.ssh/config):
     57 
     58 	Host sshgateway
     59 		Tunnel yes
     60 		TunnelDevice 0:any
     61 		PermitLocalCommand yes
     62 	        LocalCommand sh /etc/netstart tun0
     63 
     64 A more complicated configuration is possible to establish a tunnel to
     65 a remote host which is not directly accessible by the client.
     66 The following example describes a client configuration to connect to
     67 the remote host over two ssh hops in between. It uses the OpenSSH
     68 ProxyCommand in combination with the nc(1) program to forward the final
     69 ssh tunnel destination over multiple ssh sessions.
     70 
     71 	Host access.somewhere.net
     72 	        User puffy
     73 	Host dmzgw
     74 	        User puffy
     75 	        ProxyCommand ssh access.somewhere.net nc dmzgw 22
     76 	Host sshgateway
     77 	        Tunnel Ethernet
     78 	        TunnelDevice 0:any
     79 	        PermitLocalCommand yes
     80 	        LocalCommand sh /etc/netstart tun0
     81 	        ProxyCommand ssh dmzgw nc sshgateway 22
     82 
     83 The following network plan illustrates the previous configuration in
     84 combination with layer 2 tunneling and Ethernet bridging.
     85 
     86 +--------+       (          )      +----------------------+
     87 | Client |------(  Internet  )-----| access.somewhere.net |
     88 +--------+       (          )      +----------------------+
     89     : 192.168.1.78                             |
     90     :.............................         +-------+
     91      Forwarded ssh connection    :         | dmzgw |
     92      Layer 2 tunnel              :         +-------+
     93                                  :             |
     94                                  :             |
     95                                  :      +------------+
     96                                  :......| sshgateway |
     97                                       | +------------+
     98 --- real connection                 Bridge ->  |          +----------+
     99 ... "virtual connection"                     [ X ]--------| somehost |
    100 [X] switch                                                +----------+
    101                                                           192.168.1.25
    102 
    103 (5) Client: Connect to the server and establish the tunnel
    104 
    105 Finally connect to the OpenSSH server to establish the tunnel by using
    106 the following command:
    107 
    108 	ssh sshgateway
    109 
    110 It is also possible to tell the client to fork into the background after
    111 the connection has been successfully established:
    112 
    113 	ssh -f sshgateway true
    114 
    115 Without the ssh configuration done in step (4), it is also possible
    116 to use the following command lines:
    117 
    118 	ssh -fw 0:1 sshgateway true
    119 	ifconfig tun0 192.168.5.1 192.168.5.2 netmask 255.255.255.252
    120 
    121 Using OpenSSH tunnel forwarding is a simple way to establish secure
    122 and ad hoc virtual private networks. Possible fields of application
    123 could be wireless networks or administrative VPN tunnels.
    124 
    125 Nevertheless, ssh tunneling requires some packet header overhead and
    126 runs on top of TCP. It is still suggested to use the IP Security
    127 Protocol (IPSec) for robust and permanent VPN connections and to
    128 interconnect corporate networks.
    129 
    130 	Reyk Floeter
    131 
    132 $OpenBSD: README.tun,v 1.4 2006/03/28 00:12:31 deraadt Exp $
    133 

README.version

      1 URL: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-7.1p2.tar.gz
      2 Version: 7.1p2
      3 BugComponent: 180238
      4 Owners: ghartman, cloud-android-devs
      5