OpenBSD's OpenSSH portable version
Normal OpenSSH development produces a very small, secure, and easy to maintain
version for the OpenBSD project. The OpenSSH Portability Team takes that pure
version and adds portability code so that OpenSSH can run on many other
operating systems (Unfortunately, in particular since OpenSSH does
authentication, it runs into a *lot* of differences between Unix operating
systems).
The portable OpenSSH follows development of the official version, but releases
are not synchronized. Portable releases are marked with a 'p' (e.g. 3.1p1).
The official OpenBSD source will never use the 'p' suffix, but will instead
increment the version number when they hit 'stable spots' in their development.
===> The following configuration options are available for openssh-portable-10.6.p2,1:
BLOCKLISTD=on: FreeBSD blocklistd(8) support
BSM=off: OpenBSM Auditing
DOCS=on: Build and/or install documentation
FIDO_U2F=on: FIDO/U2F support (security/libfido2)
HPN=off: HPN-SSH patch
KERB_GSSAPI=off: Kerberos/GSSAPI patch (req: GSSAPI)
LDNS=on: SSHFP/LDNS support
LIBEDIT=on: Command line editing via libedit
NONECIPHER=off: NONE Cipher support
PAM=on: Pluggable authentication module support
TCP_WRAPPERS=on: tcp_wrappers support
====> Kerberos support: you can only select none or one of them
MIT=off: MIT Kerberos (security/krb5)
HEIMDAL=off: Heimdal Kerberos (security/heimdal)
HEIMDAL_BASE=off: Heimdal Kerberos (base)
===> Use 'make config' to modify these settings
To enable this port, add openssh_enable="YES" in your rc.conf. To
prevent conflict with openssh in the base system add sshd_enable="NO"
in your rc.conf. Also you can configure openssh at another TCP port (via
sshd_config 'Port' and 'Listen' options or via 'openssh_flags'
variable in rc.conf) and run it in same time with base sshd.
'PermitRootLogin no' is the default for the OpenSSH port.
This now matches the PermitRootLogin configuration of OpenSSH in
the base system. Please be aware of this when upgrading your
OpenSSH port, and if truly necessary, re-enable remote root login
by readjusting this option in your sshd_config.
Users are encouraged to create single-purpose users with ssh keys, disable
Password authentication by setting 'PasswordAuthentication no' and
'ChallengeResponseAuthentication no', and to define very narrow sudo
privileges instead of using root for automated tasks.
Reason:
For FreeBSD 15+, the option BLACKLISTD has been renamed to BLOCKLISTD.
The option is enabled by default. If you had this option disabled you
will need to disable the new spelling as well.
The ssh config file supports both UseBlacklist and UseBlocklist.
Reason:
The OpenSSH HPN option and flavor are deprecated and will be removed.
Base removed the patch in 2016, and the patch has not matched upstream
in many years. The new upstream is named "hpn-ssh". It may be revived
as a separate package/port in the future.
To switch the package:
# pkg set -n openssh-portable-hpn:openssh-portable
Remove these options:
sshd_config:
- NoneEnabled
- HPNDisabled
- HPNBufferSize
- TcpRcvBufPoll
ssh_config:
- NoneEnabled
- NoneSwitch
- TcpRcvBufPoll
- TcpRcvBuf
- HPNDisabled
- HPNBufferSize
2026-04-25
Affects: users of security/openssh-portable
Author: bdrewery@FreeBSD.org
Reason:
Some defaults have changed to match src.
- X11Forwarding default has changed from "yes" to "no".
- PermitRootLogin default has changed from "prohibit-password" to "no".
2022-06-07
Affects: users of security/openssh-portable
Author: bdrewery@FreeBSD.org
Reason:
OpenSSH has been updated to 9.0p1 with incompatible changes.
See https://www.openssh.com/txt/release-9.0 for details.
security/openssh-portable: Use blocklist
Starting from FreeBSD version 1500000, prefer the new blocklist
nomenclature.
Once older versions are no longer supported, we should use blocklist
exclusively.
This also fixes a regression with UseBlacklist not being properly
read from the config in commit 516c0db3f73b for the 10.4 update.
PR: 294082
security/openssh-portable: Update to 10.4p1
Deprecate the HPN patch. It was removed in base in 2016. It has not
matched the upstream patch in many years, which has been renamed
to "hpn-ssh". Bringing it back as a separate port could make sense
but won't be done in this port.
Release notes: https://www.openssh.org/txt/release-10.4
security/openssh-portable: Sync some files with src.
Namely this updates some LIBWRAP behavior and updates a few incorrect
docs.
Submitted by: jlduran
Differential Revision: https://reviews.freebsd.org/D53273
security/openssh-portable: Disable X11Forwarding by default.
This syncs with src and upstream.
Submitted by: jlduran
Differential Revision: https://reviews.freebsd.org/D53268
security/openssh-portable: XMSS has been removed. Tidy up options
XMSS key support was removed in 10.1 https://www.openssh.com/txt/release-10.1
Remove option from port Makefile
PR: 290220
*/*: Bump consumers of dns/ldns after update to 1.9.0
Force rebuild comsumers - upstream changed ABI without bump soname.
ldns 1.9.0 inserted LDNS_RDF_TYPE_INT64 at enum position 5, shifting
every subsequent value by +1. But port kept the shared library as
libldns.so.3.6.0 - no SONAME bump - so consumers wasn't flagged for
rebuild and still has the old 1.8.x enum constants baked in.
Example of error for opendnssec:
[adapter] error parsing RR at line 2 (Syntax error, could not parse
the RR's rdata)
PR: 291573
Sponsored by: UNIS Labs
*/*: De-orbit alias.mk
Mk/Uses/alias.mk was an attempt for compat with DPorts, but has rotted.
This feature was never documented in the PHB, so there is no work to
be done by the docs@ team.
Nothing against DragonFly, but if DPorts still needs FreeBSD 9
support, they really should work that out with upstream projects.
Ultimately, we don't need to keep carrying this outdated feature that
doesn't affect us.
security/openssh-portable: Remove blocklist probe
Our version of blocklist is not async-signal safe.
Remove the probe for now.
Reviewed by: bdrewery
Differential Revision: https://reviews.freebsd.org/D53266
security/openssh-portable: Sync blocklist with base, include by default.
The patch is included by default in base as well. It remains
off by default though.
Added glue for HPN patch to apply.
Reviewed By: bdrewery
Differential Revision: https://reviews.freebsd.org/D52880
PR: 280203
security/openssh-portable: fix uidswap behavior on FreeBSD
This adds base commit 239e8c98636a757 as a patch to avoid losing our
real GID inside temporarily_use_uid()/restore_uid() blocks. This is
scoped to the specific __FreeBSD_version along 15.0 where we re-aligned
our setgroups(2)/getgroups(2) with other platforms (no egid touching;
just supplemental groups).
Approved by: bdrewery (maintainer, without version check)
Differential Revision: https://reviews.freebsd.org/D51846
security/openssh-portable: Update to 9.9p2
Changes: https://www.openssh.com/releasenotes.html
Security:
* Fix CVE-2025-26465 - ssh(1) in OpenSSH versions 6.8p1 to 9.9p1
(inclusive) contained a logic error that allowed an on-path
attacker (a.k.a MITM) to impersonate any server when the
VerifyHostKeyDNS option is enabled. This option is off by default.
* Fix CVE-2025-26466 - sshd(8) in OpenSSH versions 9.5p1 to 9.9p1
(inclusive) is vulnerable to a memory/CPU denial-of-service related
to the handling of SSH2_MSG_PING packets. This condition may be
security/openssh-portable: Add KERB_GSSAPI patch for 9.8p1
This patch unbreaks the gssapi flavor.
- Update the distfile location.
- Remove files/extra-patch-gssapi-auth2-gss.c. The change is already
present in the code so there is no need to carry this extra patch any
further.
- Add -lgssapi_krb5 to CONFIGURE_LIBS. It fixes the following build errors:
ld: error: undefined symbol: gss_indicate_mechs
>>> referenced by sshd.c
>>> sshd.o:(main)
ld: error: undefined symbol: gss_release_oid_set
>>> referenced by sshd.c
>>> sshd.o:(main)
PR: 279437
Approved by: maintainer timeout
Sponsored by: Klara, Inc.
security/openssh-portable: fix missing include for sshd.c
This patch adds a missing include for `channels.h`. It is needed, as
later in the file there is a call to `channel_set_hpn`, which is
declared in `channels.h`.
Some ISO C99 compilers may complain about implicit function declaration.
security/openssh-portable: Remove blacklistd chunk for FreeBSD-SA-24:08.openssh
The blacklistd patch currently is broken. Remove the chunk from
FreeBSD-SA-24:08.openssh to be sure it does not linger once the
patch is fixed.
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
(Only the first 15 lines of the commit message are shown above )
security/openssh-portable: Fix some capsicum issues
- Brings in latest changes from base. See patches for details.
- Version 9.0 is being worked on but I wanted to fix this issue
before proceeding with bigger changes.
PR: 263753
security/openssh-portable: Add comment in openssh.in about host keys
Commit ae66cffc19f added some rc vars to allow disabling host keys.
The naming caused some confusion. Attempt to address that with a
comment since these are not documented anywhere else.
PR: 202169
security/openssh-portable: Again fix procctl(2) usage
The 8.9p1 update was supposed to have a fix for incorrect
use of procctl(2) but was left out for some reason. A wrong
assumption missed keeping it in ae66cffc19f357cbd5.
PR: 262352
security/openssh-portable: fix docs when built without PAM support
The defaults documented in sshd_config and sshd_config.5 are incorrect
if OpenSSH was built without PAM support and can be misleading to the
user whether or not password authentication is enabled.
- Moved PAM specific changes out of patch-sshd_config and into
extra-patch-pam-sshd_config
- sshd_config.5 PasswordAuthentication: added a new line before the note
to make it easier to read.
- sshd_config.5 UsePAM: noted the default value depends on whether
sshd was built with or without PAM support.
PR: 261342
security/openssh-portable: Tweak new rc var names
Commit ae66cffc19f357cbd5 added new rc vars to control generating of
host keys [1]. Rename these to more closely match the base version
before it becomes widely adopted.
PR: 202169 [1]
PR: 209948 [FYI]
security/openssh-portable: Fix subtle rc script problem.
Invoking 'run_rc_command' taints '$rc_var' with 'keygen' which blocks further
processing for something like openssh_oomprotect. Note that openssh_oomprotect
is broken in rc.subr until it learns to read a pidfile.
*/*: Remove redundant '-*' from CONFLICTS definitions
The conflict checks compare the patterns first against the package
names without version (as reported by "pkg query "%n"), then - if
there was no match - agsinst the full package names including the
version (as reported by "pkg query "%n-%v").
Approved by: portmgr (blanket)
security/openssh-portable: Fix sftp crash
This fixes an error trying to disabling process tracing.
It has been sent upstream.
PR: 259174
Submitted by: mike at sentex dot net
security/openssh-portable@gssapi: fix build on GCC architectures
gss-genr.c: In function 'ssh_gssapi_kex_mechs':
gss-genr.c:175:9: error: 'strncpy' specified bound depends on the length of the
source argument [-Werror=stringop-overflow=]
175 | cp = strncpy(s, kex, strlen(kex));
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
- Add pkg-config dependency which avoids some maintainer testing errors
and also removes a few unneeded library links such as -lcurses.
- libfido2 package is broken with pkg-config and base ssl. Workaround this
by not using pkg-config for that library for now.
- Add USES=localbase to simplify some options
- Make crypt(3) MD5 password support optional but still on-by-default. The
default in FreeBSD changed in 10.0 but that does not mean
- Enable -Werror
- Remove some old baggage from the port build
o The zlib version check has not been needed for a while.
o sshd.8 has not had %%PREFIX%% or %$RC_SCRIPT_NAME%% since 2011
and is not worth more patches/complexity.
o The strnvis(3) problem noted in r311891 was fixed in OpenSSH 7.4.
o autoreconf is run so it makes no sense to patch configure for -ldes
o --with-md5-passwords is not needed as our crypt(3) supports it
natively. This is only relevant without PAM.
- Add blacklistd(8) support.
This differs slightly from base as it uses the current NetBSD
hook points.
This is off-by-default as it needs testing and has issues that may cause
crashes. One such issue is the use of private bl_create() symbol from
libblacklist. It is also unclear if the hook points are sufficient
or proper after the libssh refactoring in 8.x.
PR: 223628 (patch rewritten as it no longer applied)
- Add and enable FIDO/U2F support for security keys by default.
This feature came in 8.2, is enabled by default on OpenBSD,
and suggested to be enabled by default for packages.
security/openssh-portable: Set LICENSE
In the past, the ports framework did not support handling situations
where a port contained a multitude of licenses. In case of OpenSSH
the list is/was: BSD2, BSD3, MIT, public domain, BSD-Style, BEER-WARE,
"any purpose with notice intact", and ISC-Style.
Instead of having to keep track of all the involved licenses which all
are very similar, let's use LICENSE_PERMS.
I am not bumping PORTREVISION as it is not a vital change from the
perspective of package users.
Approved by: bdrewery (maintainer)
Differential Revision: https://reviews.freebsd.org/D27133
