What is it (from www.openssh.org):
OpenSSH is a FREE version of the SSH suite of network connectivity tools
that increasing numbers of people on the Internet are coming to rely on.
Many users of telnet, rlogin, ftp, and other such programs might not
realize that their password is transmitted across the Internet unencrypted,
but it is. OpenSSH encrypts all traffic (including passwords) to
effectively eliminate eavesdropping, connection hijacking, and other
network-level attacks. Additionally, OpenSSH provides a myriad of secure
tunnelling capabilities.
The OpenSSH suite includes the ssh program which replaces rlogin and
telnet, and scp which replaces rcp and ftp. Also included is sshd which
is the server side of the package, and the other basic utilities like
ssh-add, ssh-agent, and ssh-keygen. OpenSSH supports protocol versions
1.3, 1.5, and 2.0.
OpenSSH is primarily developed by the OpenBSD Project, The software is
developed outside the USA, using code from roughly 10 countries, and is
freely useable and re-useable by everyone under a BSD license.
The main site for OpenSSH is
http://www.openssh.com/.
Email To
openssh@openssh.com
Solaris Issues
OpenSSH and the shipped Solaris SSH can co-exist ok, i.e. leaving the packages on the host. You do need to ensure the OpenSSH version is the one running. There are two ways of doing this.
Firstly you can set up your own /etc/init.d/openssh script to start up the daemon. This should be linked from /etc/rc2.d/S74openssh. Then you can svcadmin disable ssh.
Alternatively you can edit A COPY OF file /lib/svc/method/sshd and substitute in the /usr/local paths so that the OpenSSH software gets invoked. Check your desired keylengths in the create_key() function.
I personally think it is a good idea to upgrade to OpenSSH. Firstly compatibility; it just works with everything else. You can get key compatibility issues with the shipped SSH and remote non-Sun SSH machines, especially if you are setting up a tunnel. Secondly the Sun SSH as shipped often has issues disconnecting from remote servers and often has zombie processes laying around if simple operations, such as an scp, fails for some reason.
Source Code
You can download the source code from
ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/. Pick the latest version if this one has been superceeded.
Special Issues
You should also install openssl.0.9.8e and zlib.1.2.3 when you install this software.
You also need to run these commands after installing the packages but before running the software:
mkdir /var/run
mkdir /var/empty
useradd -c "SSHD User" -s /bin/false -d / sshd
passwd -l sshd
And either: (For a totally new install)
/usr/local/bin/ssh-keygen -b 2048 -t rsa1 -f /usr/local/etc/ssh_host_key -N ""
/usr/local/bin/ssh-keygen -b 2048 -t dsa -f /usr/local/etc/ssh_host_dsa_key -N ""
/usr/local/bin/ssh-keygen -b 2048 -t rsa -f /usr/local/etc/ssh_host_rsa_key -N ""
Or: (to keep the current SSH identity of your host)
/usr/local/bin/ssh-keygen -b 2048 -t rsa1 -f /usr/local/etc/ssh_host_key -N ""
/bin/cp /etc/ssh/ssh_host*key* /usr/local/etc/.
The second method above prevents "host key has changed" messages which usually require you to edit the clients known_host file.
See the main packages README for installation information.