• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1This file contains notes about OpenSSH on specific platforms.
2
3AIX
4---
5As of OpenSSH 3.8p1, sshd will now honour an accounts password expiry
6settings, where previously it did not.  Because of this, it's possible for
7sites that have used OpenSSH's sshd exclusively to have accounts which
8have passwords expired longer than the inactive time (ie the "Weeks between
9password EXPIRATION and LOCKOUT" setting in SMIT or the maxexpired
10chuser attribute).
11
12Accounts in this state must have their passwords reset manually by the
13administrator.  As a precaution, it is recommended that the administrative
14passwords be reset before upgrading from OpenSSH <3.8.
15
16As of OpenSSH 4.0, configure will attempt to detect if your version
17and maintenance level of AIX has a working getaddrinfo, and will use it
18if found.  This will enable IPv6 support.  If for some reason configure
19gets it wrong, or if you want to build binaries to work on earlier MLs
20than the build host then you can add "-DBROKEN_GETADDRINFO" to CFLAGS
21to force the previous IPv4-only behaviour.
22
23IPv6 known to work: 5.1ML7 5.2ML2 5.2ML5
24IPv6 known broken: 4.3.3ML11 5.1ML4
25
26If you wish to use dynamic libraries that aren't in the normal system
27locations (eg IBM's OpenSSL and zlib packages) then you will need to
28define the environment variable blibpath before running configure, eg
29
30blibpath=/lib:/usr/lib:/opt/freeware/lib ./configure \
31  --with-ssl-dir=/opt/freeware --with-zlib=/opt/freeware
32
33If sshd is built with the WITH_AIXAUTHENTICATE option (which is enabled
34by default) then sshd checks that users are permitted via the
35loginrestrictions() function, in particular that the user has the
36"rlogin" attribute set.  This check is not done for the root account,
37instead the PermitRootLogin setting in sshd_config is used.
38
39If you are using the IBM compiler you probably want to use CC=xlc rather
40than the default of cc.
41
42
43Cygwin
44------
45To build on Cygwin, OpenSSH requires the following packages:
46gcc, gcc-mingw-core, mingw-runtime, binutils, make, openssl,
47openssl-devel, zlib, minres, minires-devel.
48
49
50Darwin and MacOS X
51------------------
52Darwin does not provide a tun(4) driver required for OpenSSH-based
53virtual private networks. The BSD manpage still exists, but the driver
54has been removed in recent releases of Darwin and MacOS X.
55
56Nevertheless, tunnel support is known to work with Darwin 8 and
57MacOS X 10.4 in Point-to-Point (Layer 3) and Ethernet (Layer 2) mode
58using a third party driver. More information is available at:
59	http://www-user.rhrk.uni-kl.de/~nissler/tuntap/
60
61
62Linux
63-----
64
65Some Linux distributions (including Red Hat/Fedora/CentOS) include
66headers and library links in the -devel RPMs rather than the main
67binary RPMs. If you get an error about headers, or complaining about a
68missing prerequisite then you may need to install the equivalent
69development packages.  On Redhat based distros these may be openssl-devel,
70zlib-devel and pam-devel, on Debian based distros these may be
71libssl-dev, libz-dev and libpam-dev.
72
73
74Solaris
75-------
76If you enable BSM auditing on Solaris, you need to update audit_event(4)
77for praudit(1m) to give sensible output.  The following line needs to be
78added to /etc/security/audit_event:
79
80	32800:AUE_openssh:OpenSSH login:lo
81
82The BSM audit event range available for third party TCB applications is
8332768 - 65535.  Event number 32800 has been choosen for AUE_openssh.
84There is no official registry of 3rd party event numbers, so if this
85number is already in use on your system, you may change it at build time
86by configure'ing --with-cflags=-DAUE_openssh=32801 then rebuilding.
87
88
89Platforms using PAM
90-------------------
91As of OpenSSH 4.3p1, sshd will no longer check /etc/nologin itself when
92PAM is enabled.  To maintain existing behaviour, pam_nologin should be
93added to sshd's session stack which will prevent users from starting shell
94sessions.  Alternatively, pam_nologin can be added to either the auth or
95account stacks which will prevent authentication entirely, but will still
96return the output from pam_nologin to the client.
97