| | 1 | This file contains notes about OpenSSH on specific platforms. |
| | 2 | |
| | 3 | AIX |
| | 4 | --- |
| | 5 | As of OpenSSH 3.8p1, sshd will now honour an accounts password expiry |
| | 6 | settings, where previously it did not. Because of this, it's possible for |
| | 7 | sites that have used OpenSSH's sshd exclusively to have accounts which |
| | 8 | have passwords expired longer than the inactive time (ie the "Weeks between |
| | 9 | password EXPIRATION and LOCKOUT" setting in SMIT or the maxexpired |
| | 10 | chuser attribute). |
| | 11 | |
| | 12 | Accounts in this state must have their passwords reset manually by the |
| | 13 | administrator. As a precaution, it is recommended that the administrative |
| | 14 | passwords be reset before upgrading from OpenSSH <3.8. |
| | 15 | |
| | 16 | As of OpenSSH 4.0, configure will attempt to detect if your version |
| | 17 | and maintenance level of AIX has a working getaddrinfo, and will use it |
| | 18 | if found. This will enable IPv6 support. If for some reason configure |
| | 19 | gets it wrong, or if you want to build binaries to work on earlier MLs |
| | 20 | than the build host then you can add "-DBROKEN_GETADDRINFO" to CFLAGS |
| | 21 | to force the previous IPv4-only behaviour. |
| | 22 | |
| | 23 | IPv6 known to work: 5.1ML7 5.2ML2 5.2ML5 |
| | 24 | IPv6 known broken: 4.3.3ML11 5.1ML4 |
| | 25 | |
| | 26 | If you wish to use dynamic libraries that aren't in the normal system |
| | 27 | locations (eg IBM's OpenSSL and zlib packages) then you will need to |
| | 28 | define the environment variable blibpath before running configure, eg |
| | 29 | |
| | 30 | blibpath=/lib:/usr/lib:/opt/freeware/lib ./configure \ |
| | 31 | --with-ssl-dir=/opt/freeware --with-zlib=/opt/freeware |
| | 32 | |
| | 33 | |
| | 34 | Cygwin |
| | 35 | ------ |
| | 36 | To build on Cygwin, OpenSSH requires the following packages: |
| | 37 | gcc, gcc-mingw-core, mingw-runtime, binutils, make, openssl, |
| | 38 | openssl-devel, zlib, minres, minires-devel. |
| | 39 | |
| | 40 | |
| | 41 | Darwin and MacOS X |
| | 42 | ------------------ |
| | 43 | Darwin does not provide a tun(4) driver required for OpenSSH-based |
| | 44 | virtual private networks. The BSD manpage still exists, but the driver |
| | 45 | has been removed in recent releases of Darwin and MacOS X. |
| | 46 | |
| | 47 | Nevertheless, tunnel support is known to work with Darwin 8 and |
| | 48 | MacOS X 10.4 in Point-to-Point (Layer 3) and Ethernet (Layer 2) mode |
| | 49 | using a third party driver. More information is available at: |
| | 50 | http://www-user.rhrk.uni-kl.de/~nissler/tuntap/ |
| | 51 | |
| | 52 | |
| | 53 | Solaris |
| | 54 | ------- |
| | 55 | If you enable BSM auditing on Solaris, you need to update audit_event(4) |
| | 56 | for praudit(1m) to give sensible output. The following line needs to be |
| | 57 | added to /etc/security/audit_event: |
| | 58 | |
| | 59 | 32800:AUE_openssh:OpenSSH login:lo |
| | 60 | |
| | 61 | The BSM audit event range available for third party TCB applications is |
| | 62 | 32768 - 65535. Event number 32800 has been choosen for AUE_openssh. |
| | 63 | There is no official registry of 3rd party event numbers, so if this |
| | 64 | number is already in use on your system, you may change it at build time |
| | 65 | by configure'ing --with-cflags=-DAUE_openssh=32801 then rebuilding. |
| | 66 | |
| | 67 | |
| | 68 | Platforms using PAM |
| | 69 | ------------------- |
| | 70 | As of OpenSSH 4.3p1, sshd will no longer check /etc/nologin itself when |
| | 71 | PAM is enabled. To maintain existing behaviour, pam_nologin should be |
| | 72 | added to sshd's session stack which will prevent users from starting shell |
| | 73 | sessions. Alternatively, pam_nologin can be added to either the auth or |
| | 74 | account stacks which will prevent authentication entirely, but will still |
| | 75 | return the output from pam_nologin to the client. |
| | 76 | |
| | 77 | |
| | 78 | $Id$ |
andersk / openssh.git / blame_incremental