FBOpenSSH is a fork of OpenSSH with a set of patches developed at Facebook which have been used in production for the past few years.
Facebook operates a large fleet of hosts and to support this the majority of patches fall into two areas:
- Logging enhancements. These patches output extra logging to syslog which is consumed downstream. The structured log allow aggregated statistics of all aspects of SSH sessions.
- Certificate handling. Facebook uses SSH certificates extensively and some changes to OpenSSH have been made to allow this.
This fork of OpenSSH is currently only built and deployed on Linux.
The official documentation for OpenSSH are the man pages for each tool:
Portable OpenSSH is built using autoconf and make. It requires a working C compiler, standard library and headers, as well as zlib and libcrypto from either LibreSSL or OpenSSL to build. Certain platforms and build-time options may require additional dependencies.
Releases include a pre-built copy of the configure script and may be built using:
tar zxvf openssh-X.Y.tar.gz
cd openssh
./configure # [options]
make && make tests
See the Build-time Customisation section below for configure options. If you plan on installing OpenSSH to your system, then you will usually want to specify destination paths.
If building from git, you'll need autoconf installed to build the configure script. The following commands will check out and build portable OpenSSH from git:
git clone https://github.com/openssh/openssh-portable # or https://anongit.mindrot.org/openssh.git
cd openssh-portable
autoreconf
./configure
make && make tests
There are many build-time customisation options available. All Autoconf destination path flags (e.g. --prefix) are supported (and are usually required if you want to install OpenSSH).
For a full list of available flags, run configure --help but a few of the more frequently-used ones are described below. Some of these flags will require additional libraries and/or headers be installed.
| Flag | Meaning |
|---|---|
--with-pam |
Enable PAM support. OpenPAM, Linux PAM and Solaris PAM are supported. |
--with-libedit |
Enable libedit support for sftp. |
--with-kerberos5 |
Enable Kerberos/GSSAPI support. Both Heimdal and MIT Kerberos implementations are supported. |
--with-selinux |
Enable SELinux support. |
See the CODE_OF_CONDUCT file for details.
See the CONTRIBUTING file for how to help out.
FBOpenSSH is BSD licensed. The original OpenSSH license can be found in the LICENSE file.
Bugs can be reported in the Github issue tracker for this repository.