OpenSSH Installation

Installing openssh-2.1

Check

make sure PAM (Linux-PAM-0.72) is installed (come with RH6.2)
make sure zlib (zlib-1.1.3) is installed (come with RH6.2)

OpenSSL

Comments

Should not install the damn rpm file, 'cause the include files are not within the package so none of the packages that depends on it can build from source. Openssh is an example.

Source

http://www.openssl.org/source/

ver OpenSSL (openssl-0.9.6)

./config --prefix=/opt
make

make test
make report

pkg=ssl
make -n install | tee /export/pub/installs/logs/$pkg.log.0
make install | tee /export/pub/installs/logs/$pkg.log.1

shared libs

can simply use
./config --prefix=/opt shared
to produce the shared libs but the installation is not very good:
creating 3 different files instead of 1 file & 2 links.

make linux-shared
cd /opt/lib
rm libcrypto.so* libssl.so*

cdd /export/expand/ssh/openssl-0.9.6
cp -d libcrypto.so* libssl.so* ~+1

pkg:OpenSSH (Secure Shell)

Info

OpenSSH is primarily developed by the OpenBSD Project, and its first inclusion into an operating system was in OpenBSD 2.6. The software is developed outside the USA, using code from roughly 10 countries, and is freely useable and re-useable by everyone under a BSD license.

OpenSSH is based on the last free version of Tatu Ylonen's SSH with all patent-encumbered algorithms removed (to external libraries), all known security bugs fixed, new features reintroduced and many other clean-ups. More information about SSH itself can be found in the file README.Ylonen.

OpenSSH depends on Zlib[2], OpenSSL[3] and optionally PAM[4].

Source

OpenSSH for linux http://www.openssh.com/portable.html

Linux RPMs, from Alberta, Canada ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/rpm/

OpenSSH installation guide http://www.openssh.com/install.html

SSH Frequently Asked Questions http://snailbook.oankali.net/faq/

OpenSSH 2.2.0

Info

released August 31, 2000

Comments

these RPMs have been built with the rpm-3.0.5 release of RPM and may not install cleanly on systems which use earlier versions.

mine is rpm-3.0.3, which need many upgrades before I can make use of the packages.

After upgrading my rpm to 3.0.5, and installed the damn rpm package, I found what is installed is just scp and ssh-kengen. Where the heck is ssh, sshd?

OpenSSH 2.1.1p3

Info

Source

ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/old/openssh-2.1.1p3.tar.gz

Build, Test run & Installation

Steps

./configure --with-tcp-wrappers
make

pkg=ssh
make -n install | tee ../../logs/$pkg.log.0
make install | tee ../../logs/$pkg.log.1

— "make install" has included "make host-key"

Help

--with-ssl-dir=PATH     Specify path to OpenSSL installation

—with-tcp-wrappers: will enable TCP Wrappers (/etc/hosts.allow|deny) support. You will need libwrap.a and tcpd.h installed.
—with-md5-passwords: will enable the use of MD5 passwords. Enable this if your operating system uses MD5 passwords without using PAM.
—enable-group-writeability: yes|no (no)

Normally sshd verifies that the user authentication files are only modifiable by the owner. Setting this option allows group write access to the files. This should be used with caution as it is a systemwide change.

Generating RSA keys:  ...................ooooooO.........ooooooO
Key generation complete.
Your identification has been saved in /usr/local/etc/ssh_host_key.
Your public key has been saved in /usr/local/etc/ssh_host_key.pub.
The key fingerprint is:
49:e0:e5:37:de:6c:10:0f:22:2c:1e:e8:5d:b5:ae:ef root@sunny
Generating DSA parameter and key.
Your identification has been saved in /usr/local/etc/ssh_host_dsa_key.
Your public key has been saved in /usr/local/etc/ssh_host_dsa_key.pub.
The key fingerprint is:
c2:49:74:eb:b3:92:fd:e4:32:92:e4:14:bc:6b:de:3f root@sunny

Configuration

generate server key: done in
```
make install
```
deliberate setting:
```
make host-key
```
SSH does password authentication via PAM, which means that you must configure PAM on your system to know about SSH.
```
cp openssh-2.1.1p3/contrib/redhat/sshd.pam /etc/pam.d/sshd
```

Working History

# ./configure
[...]
checking for OpenSSL directory... configure: error: Could not find working SSLeay / OpenSSL libraries, please install

./configure --with-ssl-dir=/usr & ./configure --with-ssl-dir=/usr/lib
won't work, has to install openssl-devel-0.9.5a-3.i386.rpm instead of
openssl-0.9.5a-3.i386.rpm beforehand.

OpenSSH configured has been configured with the following options.
                 User binaries: /usr/local/bin
               System binaries: /usr/local/sbin
           Configuration files: /usr/local/etc
               Askpass program: /usr/local/libexec/ssh/ssh-askpass
                  Manual pages: /usr/local/man/manX
                      PID file: /var/run
      Random number collection: Device (/dev/urandom)
                Manpage format: man
                   PAM support: yes
            KerberosIV support: no
                   AFS support: no
                 S/KEY support: no
          TCP Wrappers support: no
          MD5 password support: no
   IP address in $DISPLAY hack: no
      Use IPv4 by default hack: no
       Translate v4 in v6 hack: yes

OpenSsh: what causes the delay?

Newsgroups: comp.security.ssh

> I installed openssh 2.1.1 a while ago, but recently I noticed an
> unacceptable delay while connecting to other hosts:

Run the client under strace and see what it's doing during the delay. One possibility is a DNS timeout; is there any trouble reverse-mapping the server IP addresses in these cases?

Richard Silverman

OpenSsh: what causes the delay?

> socket(PF_INET, SOCK_DGRAM, IPPROTO_IP) = 3 sendto(3,
> "t\32\1\0\0\1\0\0\0\0\0\0\nmyserver\7mydomain\2"..., 39, 0,
> {sin_family=AF_INET, sin_port=htons(53),
> sin_addr=inet_addr("131.1xx.xx.xx")}}, 16) = 39 time(NULL) =
> 971578662 poll( <unfinished ...>

> It looped to do the 'poll' and waited there. Can somebody
> interpret the above to me in English? What does it imply? What
> next should I look into? Thanks!

This is the SSH client attempting to query the DNS about the name "myserver.mydomain", probably to look up an address. It's sending the DNS queries to a nameserver on "131.1xx.xx.xx", and apparently not getting a response. Check that this makes sense — are there nameservers on that/those address(es)? If not, check your /etc/resolv.conf file. If you intend to be using them, perhaps they're not running, or you have a firewall blocking the queries or responses.

You can use "tcpdump -s1024 port 53" (run as root) to capture the DNS traffic as you run the client, along with responses and a basic interpretation of their contents; this may help understand what's going on.

Richard Silverman