- (dtucker) [INSTALL] Update the systems that have PAM as standard. Link

[openssh.git] / INSTALL

diff --git a/INSTALL b/INSTALL
index c953fb968a9d7e1e023bb4217f05d07a123c95d2..348b5453b451f14114c284478b50ca5014f5a454 100644 (file)
--- a/INSTALL
+++ b/INSTALL
@@ -3,7 +3,7 @@
 
 You will need working installations of Zlib and OpenSSL.
 
 
 You will need working installations of Zlib and OpenSSL.
 

-Zlib 1.1.4 or greater:
+Zlib 1.1.4 or 1.2.1.2 or greater (ealier 1.2.x versions have problems):

 http://www.gzip.org/zlib/
 
 OpenSSL 0.9.6 or greater:
 http://www.gzip.org/zlib/
 
 OpenSSL 0.9.6 or greater:


@@ -12,18 +12,23 @@ http://www.openssl.org/
 (OpenSSL 0.9.5a is partially supported, but some ciphers (SSH protocol 1
 Blowfish) do not work correctly.)
 
 (OpenSSL 0.9.5a is partially supported, but some ciphers (SSH protocol 1
 Blowfish) do not work correctly.)
 

-OpenSSH can utilise Pluggable Authentication Modules (PAM) if your system
-supports it. PAM is standard on Redhat and Debian Linux, Solaris and
-HP-UX 11.
+The remaining items are optional.
+
+OpenSSH can utilise Pluggable Authentication Modules (PAM) if your
+system supports it. PAM is standard most Linux distributions, Solaris,
+HP-UX 11 and AIX >= 5.2.

 
 NB. If you operating system supports /dev/random, you should configure
 OpenSSL to use it. OpenSSH relies on OpenSSL's direct support of
 /dev/random. If you don't you will have to rely on ssh-rand-helper, which
 is inferior to a good kernel-based solution.
 
 
 NB. If you operating system supports /dev/random, you should configure
 OpenSSL to use it. OpenSSH relies on OpenSSL's direct support of
 /dev/random. If you don't you will have to rely on ssh-rand-helper, which
 is inferior to a good kernel-based solution.
 

-PAM:
+Linux PAM:

 http://www.kernel.org/pub/linux/libs/pam/
 
 http://www.kernel.org/pub/linux/libs/pam/
 

+OpenPAM:
+http://www.openpam.org/
+

 If you wish to build the GNOME passphrase requester, you will need the GNOME
 libraries and headers.
 
 If you wish to build the GNOME passphrase requester, you will need the GNOME
 libraries and headers.
 


@@ -50,19 +55,36 @@ lacks /dev/random and don't want to use OpenSSH's internal entropy collection.
 http://www.lothar.com/tech/crypto/
 
 S/Key Libraries:
 http://www.lothar.com/tech/crypto/
 
 S/Key Libraries:

+
+If you wish to use --with-skey then you will need the library below
+installed.  No other S/Key library is currently known to be supported.
+

 http://www.sparc.spb.su/solaris/skey/
 
 LibEdit:
 
 http://www.sparc.spb.su/solaris/skey/
 
 LibEdit:
 

-sftp now supports command-line editing via NetBSD's libedit.  If your
-platform has it available natively you can use that, alternatively
-you might try these multi-platform ports:
+sftp supports command-line editing via NetBSD's libedit.  If your platform
+has it available natively you can use that, alternatively you might try
+these multi-platform ports:
+

 http://www.thrysoee.dk/editline/
 http://sourceforge.net/projects/libedit/
 
 http://www.thrysoee.dk/editline/
 http://sourceforge.net/projects/libedit/
 

-If you wish to use --with-skey then you will need the above library
-installed.  No other current S/Key library is currently known to be
-supported.
+Autoconf:
+
+If you modify configure.ac or configure doesn't exist (eg if you checked
+the code out of CVS yourself) then you will need autoconf-2.61 to rebuild
+the automatically generated files by running "autoreconf".  Earlier
+version may also work but this is not guaranteed.
+
+http://www.gnu.org/software/autoconf/
+
+Basic Security Module (BSM):
+
+Native BSM support is know to exist in Solaris from at least 2.5.1,
+FreeBSD 6.1 and OS X.  Alternatively, you may use the OpenBSM
+implementation (http://www.openbsm.org).
+

 
 2. Building / Installation
 --------------------------
 
 2. Building / Installation
 --------------------------


@@ -91,6 +113,10 @@ make install
 This will install the binaries in /opt/{bin,lib,sbin}, but will place the
 configuration files in /etc/ssh.
 
 This will install the binaries in /opt/{bin,lib,sbin}, but will place the
 configuration files in /etc/ssh.
 

+If you are using Privilege Separation (which is enabled by default)
+then you will also need to create the user, group and directory used by
+sshd for privilege separation.  See README.privsep for details.
+

 If you are using PAM, you may need to manually install a PAM control
 file as "/etc/pam.d/sshd" (or wherever your system prefers to keep
 them).  Note that the service name used to start PAM is __progname,
 If you are using PAM, you may need to manually install a PAM control
 file as "/etc/pam.d/sshd" (or wherever your system prefers to keep
 them).  Note that the service name used to start PAM is __progname,


@@ -109,6 +135,10 @@ name).
 
 There are a few other options to the configure script:
 
 
 There are a few other options to the configure script:
 

+--with-audit=[module] enable additional auditing via the specified module.
+Currently, drivers for "debug" (additional info via syslog) and "bsm"
+(Sun's Basic Security Module) are supported.
+

 --with-pam enables PAM support. If PAM support is compiled in, it must
 also be enabled in sshd_config (refer to the UsePAM directive).
 
 --with-pam enables PAM support. If PAM support is compiled in, it must
 also be enabled in sshd_config (refer to the UsePAM directive).
 


@@ -161,6 +191,8 @@ created.
 --with-ssl-dir=DIR allows you to specify where your OpenSSL libraries
 are installed.
 
 --with-ssl-dir=DIR allows you to specify where your OpenSSL libraries
 are installed.
 

+--with-ssl-engine enables OpenSSL's (hardware) ENGINE support
+

 --with-4in6 Check for IPv4 in IPv6 mapped addresses and convert them to
 real (AF_INET) IPv4 addresses. Works around some quirks on Linux.
 
 --with-4in6 Check for IPv4 in IPv6 mapped addresses and convert them to
 real (AF_INET) IPv4 addresses. Works around some quirks on Linux.
 


@@ -204,7 +236,8 @@ for sshd, ssh and ssh-agent.
 -------------------------
 
 $ make survey
 -------------------------
 
 $ make survey

-[check the contents and make sure there's no sensitive information]
+[check the contents of the file "survey" to ensure there's no information
+that you consider sensitive]

 $ make send-survey
 
 This will send configuration information for the currently configured
 $ make send-survey
 
 This will send configuration information for the currently configured