security/opkssh 0.17.0_1 FreeBSD

Tool which enables SSH to be used with OpenID Connect

System: FreeBSD
Repository: FreeBSD ports
Maintainer: [email protected]
Last update: 2026-10-20
Commit: d81b7ba3c3
License: APACHE20
Categories: security
Package size: 4287.0 KiB, 13913.0 KiB installed

Description

opkssh is a tool which enables ssh to be used with OpenID Connect allowing SSH access to be managed via identities like [email protected] instead of long-lived SSH keys. It does not replace SSH, but instead generates SSH public keys containing PK Tokens and configures sshd to verify them. These PK Tokens contain standard OpenID Connect ID Tokens. This protocol builds on the OpenPubkey which adds user public keys to OpenID Connect without breaking compatibility with existing OpenID Provider.

Install

Binary package:

pkg install opkssh

From the ports tree:

cd /usr/ports/security/opkssh/ && make install clean

To depend on this port in another port's Makefile:

RUN_DEPENDS=	opkssh>0:security/opkssh

Packages

The version each package repository carries. “-” means the repository builds no package of it, “n/a” that there is no such repository.

Repository	aarch64	amd64	armv6	armv7	i386
FreeBSD:14:latest	0.17.0	0.17.0	-	-	0.17.0
FreeBSD:14:quarterly	0.17.0	0.17.0	n/a	-	0.17.0
FreeBSD:15:latest	0.17.0	0.17.0	n/a	-	-
FreeBSD:15:quarterly	0.17.0	0.17.0	n/a	n/a	n/a
FreeBSD:16:latest	0.16.0	0.17.0	n/a	n/a	n/a
FreeBSD:16:quarterly	n/a	n/a	n/a	n/a	n/a

Dependencies

The Makefile names none itself; they come from USES and USE_*.

The full lists below include those, and their dependencies in turn.

Build dependencies 1

lang/go127

No port depends on this one.

Configuration

No options to configure.

USES: go:modules
Service scripts: none

Message after installing

Configure your sshd_config(5) with the following to use opkssh for authorization:

  AuthorizedKeysCommand /usr/local/bin/opkssh verify %u %k %t
  AuthorizedKeysCommandUser opksshuser

opkssh uses the '/usr/local/etc/opk' directory, where providers and identities are stored.
Neither the directory nor the files are created automatically, so you must create them
yourself. After creating the 'auth_id' and 'providers' files, they must have the
following permissions:

  chown root:opksshuser /usr/local/etc/opk/auth_id
  chmod 640 /usr/local/etc/opk/auth_id
  chown root:opksshuser /usr/local/etc/opk/providers
  chmod 640 /usr/local/etc/opk/providers

Users attempting to use opkssh from jails, please add "allow.mlock" or it will not run.

Files

distinfo 2

File

Size

SHA256

opkssh-v0.17.0.vendor.tar.gz

5.598463e+06

b6eabecd9b05ba6a7f9e112520af01a6787112e5d66839e6ab413ed4659f6234

openpubkey-opkssh-v0.17.0_GH0.tar.gz

3.161396e+06

b38b6ca60cb97fe9064dfc6aa6fe1969e76d54e0d996114824b5633d6285ee18

Master sites 1

LOCAL/dtxdf/opkssh/:assets

Commit history 8

Date Commit Credits Log message

2026-10-20 d81b7ba3c3 Dag-Erling Smørgrav various: Bump Go ports for Go 1.26.10 / 1.27.3

2026-10-09

5227e08723

Jesús Daniel Colmenares Oviedo

security/opkssh: Update to 0.17.0

ChangeLog: https://github.com/openpubkey/opkssh/releases/tag/v0.17.0 MFH: 2026Q4

2026-10-08 031fc6bfbf Dag-Erling Smørgrav various: Bump Go ports

2026-09-26

d79050a091

Jesús Daniel Colmenares Oviedo

security/opkssh: Update to 0.16.0

ChangeLogs: - https://github.com/openpubkey/opkssh/releases/tag/v0.11.0 - https://github.com/openpubkey/opkssh/releases/tag/v0.12.0 - https://github.com/openpubkey/opkssh/releases/tag/v0.13.0 - https://github.com/openpubkey/opkssh/releases/tag/v0.14.0 - https://github.com/openpubkey/opkssh/releases/tag/v0.15.0 - https://github.com/openpubkey/opkssh/releases/tag/v0.16.0

2026-09-03 dd0905142a Adam Weinberger many: Bump go ports for 1.26.8 and 1.27.1

The latest 5 of 8 in the history this site was built from.