openssh

openssh-portable

C2015–2026

openssh / openssh-portable

openssh-portable

Portable OpenSSH

Security & Privacy Networking

Explore on GitHub Read Hacker News discussions

64Distinct people

73Mentions

0Explicit recommenders

4.1KGitHub stars

REPOSITORY AT A GLANCE

What to know before exploring

What it is

Portable OpenSSH

GitHub

Where it is used

No documented product use was verified in the last source check.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 8–Nov 15 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/15/2026, 5:05:26 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year73 dated mentions

Observed mentions: 2015-07-22 02:59:34 UTC to 2026-10-10 07:48:53 UTC.

* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges

UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
Period	Start (UTC)	End (exclusive, UTC)	Mentions	Submissions	Comments
2015	2015-01-01 00:00:00 UTC	2016-01-01 00:00:00 UTC	2	0	2
2016	2016-01-01 00:00:00 UTC	2017-01-01 00:00:00 UTC	4	0	4
2017	2017-01-01 00:00:00 UTC	2018-01-01 00:00:00 UTC	0	0	0
2018	2018-01-01 00:00:00 UTC	2019-01-01 00:00:00 UTC	1	0	1
2019	2019-01-01 00:00:00 UTC	2020-01-01 00:00:00 UTC	8	1	7
2020	2020-01-01 00:00:00 UTC	2021-01-01 00:00:00 UTC	7	0	7
2021	2021-01-01 00:00:00 UTC	2022-01-01 00:00:00 UTC	10	4	6
2022	2022-01-01 00:00:00 UTC	2023-01-01 00:00:00 UTC	6	0	6
2023	2023-01-01 00:00:00 UTC	2024-01-01 00:00:00 UTC	9	0	9
2024	2024-01-01 00:00:00 UTC	2025-01-01 00:00:00 UTC	18	0	18
2025	2025-01-01 00:00:00 UTC	2026-01-01 00:00:00 UTC	2	0	2
2026 (partial)	2026-01-01 00:00:00 UTC	2027-01-01 00:00:00 UTC	6	0	6

From the project README

An excerpt from the repository, fetched Nov 13, 2026.

Read the project’s introduction

Portable OpenSSH OpenSSH is a complete implementation of the SSH protocol (version 2) for secure remote login, command execution and file transfer. It includes a client ssh and server sshd, file transfer utilities scp and sftp as well as tools for key generation (ssh-keygen), run-time key storage (ssh-agent) and a number of supporting programs. This is a port of OpenBSD's OpenSSH to most Unix-like operating systems, including Linux, OS X and Cygwin. Portable OpenSSH polyfills OpenBSD APIs that are not available elsewhere, adds sshd sandboxing for more operating systems and includes support for OS-native authentication and auditing (e.g. using PAM). Documentation The official documentation for OpenSSH are the man pages for each tool: ssh(1) sshd(8) ssh-keygen(1) ssh-agent(1) scp(1) sftp(1) ssh-keyscan(8) sftp-server(8) Stable Releases Stable release tarballs are available from a number of download mirrors. We recommend the use of a stable release for most users. Please read the release notes for details of recent changes and potential incompatibilities. Building Portable OpenSSH Dependencies Portable OpenSSH is built using autoconf and make. It requires a working C compiler, standard library and headers. libcrypto from one of LibreSSL, OpenSSL, AWS-LC or BoringSSL may also be used. OpenSSH may be built without any of these, but the resulting binaries will have only a subset of the cryptographic algorithms normally available. zlib is optional; without it transport compression is not supported. FIDO security token support needs libfido2 and its dependencies and will be enabled automatically if they are found. In addition, certain platforms and build-time options may require additional dependencies; see README.platform for details about your platform. Building a release Release tarballs and release branches in git include a pre-built copy of the configure script and may be built using: tar zxvf openssh-X.YpZ.tar.gz cd openssh ./configure # [options] make && make tests See the Build-time Customisation section below for configure options. If you plan on installing OpenSSH to your system, then you will usually want to specify destination paths. Building from git If building from the git master branch, you'll need autoconf installed to build the configure script. The following commands will check out and build portable OpenSSH from git: git clone https://github.com/openssh/openssh-portable # or https://anongit.mindrot.org/openssh.git cd openssh-portable autoreconf ./configure make && make tests Build-time Customisation There are many build-time customisation options available. All Autoconf destination path flags (e.g. --prefix) are supported (and are usually required if you want to install OpenSSH). For a full list of available flags, run ./configure --help but a few of the more frequently-used ones are described below. Some of these flags will require additional libraries and/or headers be installed. Flag Meaning --with-pam Enable PAM support. OpenPAM, Linux PAM and Solaris PAM are supported. --with-libedit Enable libedit support for sftp. --with-kerberos5 Enable Kerberos/GSSAPI support. Both Heimdal and MIT Kerberos implementations are supported. --with-selinux Enable SELinux support. Development Portable OpenSSH development is discussed on the openssh-unix-dev mailing list (archive mirror). Bugs and feature requests are tracked on our Bugzilla. Reporting bugs Non-security bugs may be reported to the developers via Bugzilla or via the mailing list above. Security bugs should be reported to openssh@openssh.com.

Read the full README on GitHub

What Hacker News says

10 sources

hpfr·Dec 15, 2021

You're not getting old; this is a real nuisance. That said, and to add onto the other reply, you're in luck: OpenSSH 8.8p1 includes support¹ for setting TERM in your SSH config with SetEnv². In my experience this works fine with just the client OpenSSH being up-to-date connecting to servers with older SSH versions and terminfo databases. In your case, you might want to use a wildcard host at the end of your file to default to a more compatible TERM variable, and then override to foot's TERM variable value for the hosts you use that do have up-to-date terminfo: Host my-up-to-date-terminfo-host SetEnv TERM=foot Host * SetEnv TERM=xterm-256color I've been using Foot for months now and just came across this issue, so it's nice there's now a path to get the full-fledged Foot experience only where it's supported. I usu

Read the rest

ally stay comfortably inside GUI Doom Emacs for most shell workflows, but it's nice to have a modern, Wayland-native, no-nonsense terminal emulator when I do break my config :P. ¹ https://github.com/openssh/openssh-portable/commit/f64f8c00d... ² https://www.mankier.com/5/ssh_config#SetEnv

In Foot: A fast and minimalistic Wayland terminal emulator

bodyfour·Sep 18, 2021

I've seen several systems that wrap the ssh binary to allow different agents to be forwarded to different hosts. Personally I think this is unwieldy -- it really should be something which is built into ssh directly. Running multiple agents is also a bit ugly, especially if you are trying to consolidate your keys with an agent integrated with your desktop environment, which I think is the most common use case. FWIW my proposal for fixing it is https://github.com/openssh/openssh-portable/pull/233 but it isn't the most elegant solution either I guess. It doesn't seem to have picked up much interest so I don't think it's likely to ever be merged (at least in its current form) which is fine. Hopefully some tamed version of agent forwarding appears directly in openssh someday, either as a simple key filter or something more complicated like

Read the rest

guardian-agent

In The pitfalls of using SSH-agent, or how to use an agent safely

tool4cool·Sep 16, 2021Submission

CVE-2016-20012 – Publickey Information leak

2 points · Open discussion

raimue·Aug 30, 2021Submission

OpenSSH: After years of forewarning, disable RSA/SHA-1

2 points · Open discussion

thunderbong·Jun 25, 2021Submission

OpenSSH switches to using gender-neutral language

25 points · Open discussion

Randor·May 25, 2021

Well, I looked at both patches and didn't like either one of them. The user 'manfred-kaiser' makes a good point and I have confirmed that he is correct. However the fix he is proposing is not a very good fix. So in my opinion both of the proposed fixes are not sufficient. The proposed fix: https://github.com/openssh/openssh-portable/commit/b3855ff05... This proposed fix means OpenSSH is not secure 'by default' and would require HostKeyAlgorithms to be set in the config file. Furthermore... there needs to be an existing public key. Also keep in mind that SSHD refuses to use group/world-accessible keys. So if this patch is accepted CVE-2020-14145 will continue to work on 'misconfigured' servers. "It's not our fault, your OpenSSH was misconfigured!"

In OpenSSH 8.6 is still vulnerable to CVE-2020-14145 and will not be fixed

ralfw90·May 24, 2021Submission

OpenSSH 8.6 is still vulnerable to CVE-2020-14145 and will not be fixed

25 points · Open discussion

viraptor·May 16, 2021

Most init scripts are in that ballpark. See openssh for example (88 lines) https://github.com/openssh/openssh-portable/blob/master/open... And yet, it still tries to use pidfiles (which systemd has a better alternative for), and notes "We really should check if the service is already going" which they don't do because it's an actual non-trivial issue if you're writing a standalone init script.

In Systemd: The Good Parts

ec109685·Mar 31, 2021

That code is 12 years old: https://github.com/openssh/openssh-portable/commit/c8802aac2... So maybe the parent post was remembering a time before then.

In EC2 Serial Console

herpderperator·Mar 31, 2021

You're right that it's not _strictly_ memory consumption and that other criteria and overrides exist, but memory consumption is highly weighted. Regarding SSH, if you enable sshd debug logging you can see that sshd sets its own score to the minimum possible [0] which is why your comment about sshd being targeted still doesn't make sense to me. I actually didn't know it was sshd doing this on its own till I ran this: server ~ # grep oom_score_adj /usr/sbin/sshd grep: /usr/sbin/sshd: binary file matches ...which is fascinating and clever. That's when I checked the source code linked at "[0]". I now finally have an answer as to why I've seen dmesg memory stat dumps display different oom_score_adj values for sshd. I always thought _something_ was smart enough to know that we don't want to risk killing sshd, but I didn't know what that _s

Read the rest

omething_ was. It turns out it was the daemon itself. Oct 13 23:20:38 server kernel: Mem-Info: ... Oct 13 23:20:38 server kernel: [ pid ] uid tgid total_vm rss nr_ptes nr_pmds swapents oom_score_adj name Oct 13 23:20:38 server kernel: [ 2455] 60 2455 1778653 273114 710 10 0 0 mysqld ... Oct 13 23:20:38 server kernel: [12085] 207 12085 22574 673 32 3 0 0 tlsmgr Oct 13 23:20:38 server kernel: [ 4238] 0 4238 9234 518 20 3 0 -1000 systemd-udevd Oct 13 23:20:38 server kernel: [12278] 0 12278 88107 5597 136 4 0 0 apache2 Oct 13 23:20:38 server kernel: [17222] 0 17222 1258983 142035 505 8 0 0 qemu-system-x86 ... Oct 13 23:20:38 server kernel: [21069] 0 21069 5033 487 14 4 0 0 bash Oct 13 23:20:38 server kernel: [15935] 0 15935 7081 487 16 3 0 -1000 sshd ... In retrospect it makes a lot of sense, especially considering sshd runs as root -- it has complete ability to do that. And it's not like anything else would know the importance of sshd except for itself. However I still don't understand your comment about the Linux OOM killer wanting to kill sshd "first" (or _ever_ based on these renewed findings!) Can you elaborate? [0] https://github.com/openssh/openssh-portable/blob/e51dc7fab61...

In EC2 Serial Console