OpenSSH Install

http://www.openssh.com/
설치버전 : openssh-4.2p1.tar.gz

1. 준비할것들
----------------
설치작업을 위해서 Zlib와 OpenSSL이 필요합니다.
Zlib 1.1.4 혹은 1.2.1.2 혹은 그 이후 버전 (1.2.x 이전 버전은 문제가 발생합니다): http://www.gzip.org/zlib/

OpenSSL 0.9.6 혹은 그 이후버전: http://www.openssl.org/
(OpenSSL 0.9.5a는 일부 지원합니다만 몇몇 암호는(SSH protocol 1 Blowfish) 제대로 작동하지 않을수 있습니다.)
OpenSSH는 서버에서 지원하는 PAM(Pluggable Authentication Modules)을 사용할수 있습니다. PAM은 레드헷과 데비안 리눅스, 솔라리스 그리고 HP-UX 11에서 기본으로 지원합니다.

2. 빌드 / 설치
--------------------------
OpenSSH를 설치하기 위한 기본 옵션입니다:

./configure
make
make install

OpenSSH 바이너리 파일들은 /usr/local/bin, 설정파일들은 /usr/local/etc에 서버는 /usr/local/sbin에 설치됩니다. 다른곳에 설치하기 위한 prefix는 --prefix 옵션을 사용해 설정합니다:

./configure --prefix=/opt
make
make install

OpenSSH를 /opt/{bin,etc,lib,sbin}에 설치하려고 한다면 다음과 같이 경로를 명시해 줄 수 있습니다:

./configure --prefix=/opt --sysconfdir=/etc/ssh
make
make install

/opt/{bin,lib,sbin}에 바이너리를 설치하지만 설정파일은 /etc/ssh에 둡니다.

나머지 옵션들:
--with-pam
enables PAM support. If PAM support is compiled in, it must also be enabled in sshd_config (refer to the UsePAM directive).

--with-prngd-socket=/some/file
allows you to enable EGD or PRNGD support and to specify a PRNGd socket. Use this if your Unix lacks /dev/random and you don't want to use OpenSSH's builtin entropy collection support.

--with-prngd-port=portnum
allows you to enable EGD or PRNGD support and to specify a EGD localhost TCP port. Use this if your Unix lacks /dev/random and you don't want to use OpenSSH's builtin entropy collection support.

--with-lastlog=FILE
will specify the location of the lastlog file. ./configure searches a few locations for lastlog, but may not find it if lastlog is installed in a different place.

--without-lastlog
will disable lastlog support entirely.

--with-osfsia, --without-osfsia
will enable or disable OSF1's Security Integration Architecture.The default for OSF1 machines is enable.

--with-skey=PATH
will enable S/Key one time password support. You will need the S/Key libraries and header files installed for this to work.

--with-tcp-wrappers
will enable TCP Wrappers (/etc/hosts.allow|deny) support. You will need libwrap.a and tcpd.h installed.

--with-md5-passwords
will enable the use of MD5 passwords. Enable this if your operating system uses MD5 passwords and the system crypt() does not support them directly (see the crypt(3/3c) man page). If enabled, the resulting binary will support both MD5 and traditional crypt passwords.

--with-utmpx
enables utmpx support. utmpx support is automatic for
some platforms.

--without-shadow
disables shadow password support.

--with-ipaddr-display
forces the use of a numeric IP address in the $DISPLAY environment variable. Some broken systems need this.

--with-default-path=PATH
allows you to specify a default $PATH for sessions started by sshd. This replaces the standard path entirely.

--with-pid-dir=PATH
specifies the directory in which the ssh.pid file is created.

--with-xauth=PATH
specifies the location of the xauth binary

--with-ssl-dir=DIR
allows you to specify where your OpenSSL libraries are installed.

--with-4in6
Check for IPv4 in IPv6 mapped addresses and convert them to real (AF_INET) IPv4 addresses. Works around some quirks on Linux.

--with-opensc=DIR

--with-sectok=DIR
allows for OpenSC or sectok smartcard libraries to be used with OpenSSH. See 'README.smartcard' for more details.

If you need to pass special options to the compiler or linker, you
can specify these as environment variables before running ./configure.

For example:
CFLAGS="-O -m486" LDFLAGS="-s" LIBS="-lrubbish" LD="/usr/foo/ld" ./configure

3. 설정
----------------
The runtime configuration files are installed by in ${prefix}/etc or whatever you specified as your --sysconfdir (/usr/local/etc by default). The default configuration should be instantly usable, though you should review it to ensure that it matches your security requirements. To generate a host key, run "make host-key". Alternately you can do so manually using the following commands:

ssh-keygen -t rsa1 -f /etc/ssh/ssh_host_key -N ""
ssh-keygen -t rsa -f /etc/ssh/ssh_host_rsa_key -N ""
ssh-keygen -t dsa -f /etc/ssh/ssh_host_dsa_key -N ""

Replacing /etc/ssh with the correct path to the configuration directory.
(${prefix}/etc or whatever you specified with --sysconfdir during configuration)

If you have configured OpenSSH with EGD support, ensure that EGD is running and has collected some Entropy. For more information on configuration, please refer to the manual pages for sshd, ssh and ssh-agent.

설치시 --prefix=/usr/local/openssh 옵션 사용. 부팅시 자동실행을 위해서 /etc/rc.d/rc.local 에 다음 줄 추가

/usr/local/openssh/sbin/sshd &

실제설치는...

./configure --prefix=/usr/local/openssh
make
make install
cp /root/openssh-x.x.1p1/contrib/sshd.pam.generic /etc/pam.d/sshd
/usr/local/openssh/sbin/sshd (실행)
vi /etc/rc.d/rc.local
/usr/local/openssh/sbin/sshd & (부팅시 자동실행)