BSD Ports

security/openssh-portable 10.5.p1,1 MidnightBSD

The portable version of OpenBSD's OpenSSH

System
MidnightBSD
Repository
mports
Maintainer
[email protected]
Last update
Commit
0ab13bc0c3
License
OPENSSH
Categories
security

Description

OpenBSD's OpenSSH portable version

Normal OpenSSH development produces a very small, secure, and easy to maintain version for the OpenBSD project. The OpenSSH Portability Team takes that pure version and adds portability code so that OpenSSH can run on many other operating systems (Unfortunately, in particular since OpenSSH does authentication, it runs into a *lot* of differences between Unix operating systems).

The portable OpenSSH follows development of the official version, but releases are not synchronized. Portable releases are marked with a 'p' (e.g. 3.1p1). The official OpenBSD source will never use the 'p' suffix, but will instead increment the version number when they hit 'stable spots' in their development.

In the other systems

SystemPortVersion
MidnightBSDsecurity/openssh-portable10.5.p1,1
FreeBSDsecurity/openssh-portable10.6.p1,1
HardenedBSDsecurity/openssh-portable10.5.p1_1,1
GhostBSDsecurity/openssh-portable10.5.p1_1,1
OPNsensesecurity/openssh-portable10.3.p1,1

Install

Binary package:

mport install openssh-portable

From mports:

cd /usr/mports/security/openssh-portable && make install clean

To depend on this port in another port's Makefile:

RUN_DEPENDS=	openssh-portable>0:security/openssh-portable

Dependencies

No port depends on this one.

Configuration

Options name: security_openssh

OptionDefaultDescription
BLACKLISTDonFreeBSD blacklistd(8) support
BSMoffOpenBSM Auditing
DOCSoff
FIDO_U2FonFIDO/U2F support (security/libfido2)
HEIMDALoffHeimdal Kerberos (security/heimdal)
HEIMDAL_BASEoffHeimdal Kerberos (base)
HPNoffHPN-SSH patch
KERB_GSSAPIoffKerberos/GSSAPI patch (req: GSSAPI)
LDNSonSSHFP/LDNS support
LIBEDITon
MIToffMIT Kerberos (security/krb5)
NONECIPHERoffNONE Cipher support
PAMon
TCP_WRAPPERSontcp_wrappers support
USES
autoreconf compiler:c11 cpe localbase ncurses pkgconfig ssl
Service scripts
openssh
Conflicts with
openssh-3.* ssh-1.* ssh2-3.* openssh-portable-devel

Files

Manual pages 15
  • moduli(5)
  • scp(1)
  • sftp(1)
  • sftp-server(8)
  • ssh(1)
  • ssh-add(1)
  • ssh-agent(1)
  • ssh-keygen(1)
  • ssh-keyscan(1)
  • ssh-keysign(8)
  • ssh-pkcs11-helper(8)
  • ssh-sk-helper(8)
  • ssh_config(5)
  • sshd(8)
  • sshd_config(5)
pkg-plist 35
  • bin/scp
  • bin/sftp
  • bin/ssh
  • bin/ssh-add
  • bin/ssh-agent
  • bin/ssh-keygen
  • bin/ssh-keyscan
  • @sample etc/openssh-portable/moduli.sample
  • @sample etc/openssh-portable/ssh_config.sample
  • @sample etc/openssh-portable/sshd_config.sample
  • @dir etc/openssh-portable/ssh_config.d
  • @dir etc/openssh-portable/sshd_config.d
  • @postexec if [ -f %D/etc/openssh-portable/ssh_host_ecdsa_key ] && grep -q DSA %D/etc/openssh-portable/ssh_host_ecdsa_key; then echo; echo "\!/ Warning \!/"; echo; echo "Your %D/etc/openssh-portable/ssh_host_ecdsa_key is not a valid ECDSA key. It is incorrectly"; echo "a DSA key due to a bug fixed in 2012 in the security/openssh-portable port."; echo; echo "Regenerate a proper one with: rm -f %D/etc/openssh-portable/ssh_host_ecdsa_key*; service openssh restart"; echo; echo "Clients should not see any key change warning since the ECDSA was not valid and was not actually"; echo "used by the server."; echo; echo "\!/ Warning \!/"; fi
  • sbin/sshd
  • libexec/sftp-server
  • libexec/ssh-keysign
  • libexec/ssh-pkcs11-helper
  • libexec/ssh-sk-helper
  • libexec/sshd-auth
  • libexec/sshd-session
  • share/man/man1/sftp.1.gz
  • share/man/man1/ssh-add.1.gz
  • share/man/man1/ssh-agent.1.gz
  • share/man/man1/ssh-keygen.1.gz
  • share/man/man1/ssh-keyscan.1.gz
  • share/man/man1/scp.1.gz
  • share/man/man1/ssh.1.gz
  • share/man/man5/moduli.5.gz
  • share/man/man5/ssh_config.5.gz
  • share/man/man5/sshd_config.5.gz
  • share/man/man8/sftp-server.8.gz
  • share/man/man8/ssh-keysign.8.gz
  • share/man/man8/ssh-pkcs11-helper.8.gz
  • share/man/man8/ssh-sk-helper.8.gz
  • share/man/man8/sshd.8.gz
distinfo 1
FileSizeSHA256
openssh-10.5p1.tar.gz2.333659e+06d44d28a839ea9daf969cc69150fde59910b2b39361dad81a3bd6cbd19218db11
Master sites 1
  • OPENBSD/OpenSSH/portable

Commit history 2

DateCommitCreditsLog message
0ab13bc0c3 Lucas Holt security/openssh-portable: update to 10.5p1 (#741)
## Summary - update `security/openssh-portable` from 10.3p1 to 10.5p1 - refresh the blacklistd, server-default, and ssh-agent patches for upstream changes - retain MidnightBSD defaults for PAM, password authentication, and root login - mark the HPN and GSSAPI flavors broken until their external patch sets support 10.5 OpenSSH 10.5 includes security fixes for ssh-agent destination constraints, a multiplexed remote-forwarding use-after-free, and `authorized_keys` tunnel restrictions. Release notes: https://www.openssh.com/txt/release-10.5 ## Validation - `BATCH=yes bmake clean makesum patch build fake package` - package created: `openssh-portable-10.5.p1,1.mport` - built `ssh -V`: `OpenSSH_10.5p1, OpenSSL 3.0.20 7 Apr 2026` - built `sshd -T`: `UsePAM yes`, `PermitRootLogin no`, …
7ae82ffa97 Lucas Holt security/openssh-portable: add GSSAPI patch checksum
AI-Assisted-by: OpenAI Codex <[email protected]> Signed-off-by: Lucas Holt <[email protected]>