OpenSSH

OpenSSH

File:OpenSSH logo.png "Don't tell anyone that I'm free"
Developer(s)	The OpenBSD Project
Stable release	5.3 / October 1, 2009
Operating system	Cross-platform
Development status	Active
Type	Remote access
License	BSD license
Website	www.openssh.com

OpenSSH (OpenBSD Secure Shell) is a set of computer programs providing encrypted communication sessions over a computer network using the ssh protocol. It was created as an open source alternative to the proprietary Secure Shell software suite offered by SSH Communications Security. OpenSSH is developed as part of the OpenBSD project, which is led by Theo de Raadt The project's development is funded via donations.

History

OpenSSH was created by the OpenBSD team as an alternative to the original SSH software by Tatu Ylönen, which is now proprietary software. The OpenSSH developers claim that it is more secure than the original, due to their policy of producing clean and audited code and the fact, to which the word open in the name refers, that it is released under the open source BSD license. Although source code is available for the original SSH, various restrictions are imposed on its use and distribution.

OpenSSH first appeared in OpenBSD 2.6 and the first portable release was made in October 1999.

Release History:

• OpenSSH 5.3: October 1, 2009
• OpenSSH 5.2: February 23, 2009
• OpenSSH 5.1: July 21, 2008
• OpenSSH 5.0: April 3, 2008
• OpenSSH 4.9: March 30, 2008
  • Added chroot support for sshd
• OpenSSH 4.7: September 4, 2007
• OpenSSH 4.6: March 9, 2007
• OpenSSH 4.5: November 7, 2006
• OpenSSH 4.4: September 27, 2006
• OpenSSH 4.3: February 1, 2006
• OpenSSH 4.2: September 1, 2005
• OpenSSH 4.1: May 26, 2005
• OpenSSH 4.0: March 9, 2005
• OpenSSH 3.9: August 17, 2004
• OpenSSH 3.8: February 24, 2004
• OpenSSH 3.7.1: September 16, 2003
• OpenSSH 3.7: September 16, 2003
• OpenSSH 3.6.1: April 1, 2003
• OpenSSH 3.6: March 31, 2003
• OpenSSH 3.5: October 14, 2002
• OpenSSH 3.4: June 26, 2002

Development and structure

File:OpenSSH CLI.png

OpenSSH remotely controlling a server through Linux command line.

OpenSSH is developed as part of the OpenBSD operating system. Rather than including changes for other operating systems directly into OpenSSH, a separate portability infrastructure is maintained by the OpenSSH Portability Team and "portable releases" are made periodically. This infrastructure is substantial, partly because OpenSSH is required to perform authentication, a capability that has many varying implementations. This model is also used for other OpenBSD projects such as OpenNTPD.

The OpenSSH suite includes the following tools:

• ssh, a replacement for rlogin and telnet to allow shell access to a remote machine.
• scp, a replacement for rcp, and sftp, a replacement for ftp to copy files between computers.
• sshd, the SSH server daemon.
• ssh-keygen a tool to inspect and generate the RSA and DSA keys that are used for user and host authentication.
• ssh-agent and ssh-add, utilities to ease authentication by holding keys ready and avoid the need to enter passphrases every time they are used.
• ssh-keyscan, which scans a list of hosts and collects their public keys.

The OpenSSH server can authenticate users using the standard methods supported by the ssh protocol: with a password; public-key authentication, using per-user keys; host-based authentication, which is a secure version of rlogin's host trust relationships using public keys; keyboard-interactive, a generic challenge-response mechanism that is often used for simple password authentication but which can also make use of stronger authenticators such as tokens; and Kerberos/GSSAPI. The server makes use of authentication methods native to the host operating system; this can include using the BSD authentication system (bsd auth) or PAM to enable additional authentication through methods such as one time passwords. However, this occasionally has side-effects: when using PAM with OpenSSH it must be run as root, as root privileges are typically required to operate PAM. OpenSSH versions after 3.7 (September 16, 2003) allow PAM to be disabled at run-time, so regular users can run sshd instances.

Features

OpenSSH includes the ability to forward remote TCP ports over a secure tunnel. This is used to multiplex additional TCP connections over a single ssh connection, concealing connections and encrypting protocols which are otherwise unsecured, and for circumventing firewalls. An X Window System tunnel may be created automatically when using OpenSSH to connect to a remote host, and other protocols, such as http and VNC, may be forwarded easily.

In addition, some third-party software includes support for tunneling over SSH. These include DistCC, CVS, rsync, and fetchmail. On some operating systems, remote filesystems can be mounted over SSH using tools such as sshfs (using FUSE), shfs, lufs, and podfuk.

It is possible to pipe nearly any input device on a host computer directly to a client computer's output devices to allow, for example, a spare and otherwise unused computer to become a Baby monitor.

An ad hoc SOCKS proxy server may be created using OpenSSH. This allows more flexible proxying than is possible with ordinary port forwarding.

Beginning with version 4.3, OpenSSH implements an OSI layer 2/3 tun-based VPN. This is the most flexible of OpenSSH's tunnelling capabilities, allowing applications to transparently access remote network resources without modifications to make use of SOCKS.

Trademark

In February 2001, Tatu Ylönen, Chairman and CTO of SSH Communications Security informed the OpenSSH development mailing list, that after speaking with key OpenSSH developers Markus Friedl, Theo de Raadt, and Niels Provos, the company would be asserting its ownership of the "SSH" and "Secure Shell" trademarks. Ylönen commented that the trademark "is a significant asset ... SSH Communications Security has made a substantial investment in time and money in its SSH mark" and sought to change references to the protocol to "SecSH" or "secsh", in order to maintain control of the "SSH" name. He proposed that OpenSSH change its name in order to avoid a lawsuit, a suggestion that developers resisted. OpenSSH developer Damien Miller replied that "SSH has been a generic term to describe the protocol well before your [Ylönen's] attempt to trademark it" and urged Ylönen to reconsider, commenting: "I think that the antipathy generated by pursuing a free software project will cost your company a lot more than a trademark."

At the time, "SSH," "Secure Shell" and "ssh" had appeared in documents proposing the protocol as an open standard and it was hypothesised that by doing so, without marking these within the proposal as registered trademarks, Ylönen was relinquishing all exclusive rights to the name as a means of describing the protocol. Improper use of a trademark, or allowing others to use a trademark incorrectly, results in the trademark becoming a generic term, like Kleenex or Aspirin, which opens the mark to use by others. After study of the USPTO trademark database, many online pundits opined that the term "ssh" was not trademarked, merely the logo using the lower case letters "ssh." In addition, the six years between the company's creation and the time when it began to defend its trademark, and that only OpenSSH was receiving threats of legal repercussions, weighed against the trademark's validity.

Both developers of OpenSSH and Ylönen himself were members of the IETF working group developing the new standard; after several meetings this group denied Ylönen's request to rename the protocol, citing concerns that it would set a bad precedent for other trademark claims against the IETF. The participants argued that both "Secure Shell" and "SSH" were generic terms and could not be trademarks.

See also

• CopSSH (OpenSSH for Windows)

• Secure Shell
  • Comparison of SSH clients
  • Comparison of SSH servers
• FTP over SSH
• BSD Authentication
• POSSE project
• TCP Wrapper

Notes

Books

• Stahnke, Michael. Pro OpenSSH. ISBN 1-59059-476-2. http://www.apress.com/book/bookDisplay.html?bID=427. 
• Barrett, Daniel J.; Richard E. Silverman; Robert G. Byrnes. SSH, The Secure Shell: The Definitive Guide (2 ed.). ISBN 0-596-00895-3. http://www.oreilly.com/catalog/sshtdg2/.  (First edition ISBN 0-596-00011-1).

Further reading

• The 101 Uses of OpenSSH: Part 1
• The 101 Uses of OpenSSH: Part 2
• ssh - OpenBSD OpenSSH man page http://www.openbsd.org/cgi-bin/man.cgi?query=ssh
• Template:Man
• Template:Man

External links

• Official website
• Portable releases
• Darren Tucker's OpenSSH Page (mirror available here)
• Privilege Separation of OpenSSH
• PKCS#11 patch for OpenSSH
• X.509 patch for OpenSSH
• Template:Freshmeat
• All about OpenSSH on one page - a page covering OpenSSH, starting with theory and ending with many practical examples about its usage.