# OpenSSH/Development

It is possible to advance OpenSSH through donations of hardware or
money. See the OpenSSH project web site at
www.openssh.com for details.

OpenSSH is a volunteer project with the goal of making quality software.
In that way it relies upon hardware and cash donations to keep the
project rolling. Funds are needed for daily operation to cover network
line subscriptions and electrical costs. If two dollars were given for
every download of the OpenSSH source code from the master site in 2015,
ignoring the mirrors, or if a penny was donated for every instance of PF
or OpenSSH installed with a mainstream operating system or phone in
2015[^1], then funding goals for the year would be met. Hardware is
needed for development and porting to new architectures and platforms
always requires new hardware.

OpenSSH is currently developed by two teams. The first team works to
provide code that is as clean, simple and secure as possible. It is part
of the OpenBSD project. The second team works using this core version
and ports it to a great many other operating systems. Thus there are two
development tracks, the OpenBSD core and the portable version. All the
work is done in countries that permit export of cryptography.


## Use the Source, Luke

The main development branch of OpenSSH is part of the OpenBSD project.
So the source code for the \"-current\" branch of OpenBSD is where to
look for latest activity. Nightly, bleeding-edge snapshots of OpenSSH
itself are thus publicly available from OpenBSD\'s CVS
tree. Use a mirror when possible.

The source code for the portable releases of OpenSSH are published using
anonymous Git, so no password is needed to download source from the
read-only repository. The repository is provided and maintained by
Damien Miller.

    git://anongit.mindrot.org/openssh.git

We ask anyone wishing to report security bugs in OpenSSH to please use
the contact address given in the source and to practice responsible
disclosure.

## libssh

**libssh** is an independent project that provides a multiplatform C
library implementing the SSHv2 and SSHv1 protocols for client and server
implementations. With libssh, developers can remotely execute programs,
transfer files and use a secure and transparent tunnel for your remote
applications.

**libssh** is available under LGPL 2.1 license, on the web page
<https://www.libssh.org/>

Features:

-   Key Exchange Methods: curve25519-sha256@libssh.org,
    ecdh-sha2-nistp256, diffie-hellman-group1-sha1,
    diffie-hellman-group14-sha1
-   Hostkey Types: ecdsa-sha2-nistp256, ssh-dss, ssh-rsa
-   Ciphers: aes256-ctr, aes192-ctr, aes128-ctr, aes256-cbc, aes192-cbc,
    aes128-cbc, 3des-cbc, des-cbc-ssh1, blowfish-cbc
-   Compression Schemes: zlib, zlib@openssh.com, none
-   MAC hashes: hmac-sha1, none
-   Authentication: none, password, public-key, hostbased,
    keyboard-interactive, gssapi-with-mic
-   Channels: shell, exec (incl. SCP wrapper), direct-tcpip, subsystem,
    auth-agent-req@openssh.com
-   Global Requests: tcpip-forward, forwarded-tcpip
-   Channel Requests: x11, pty, exit-status, signal, exit-signal,
    keepalive@openssh.com, auth-agent-req@openssh.com
-   Subsystems: sftp(version 3), publickey(version 2), OpenSSH
    Extensions
-   SFTP: statvfs@openssh.com, fstatvfs@openssh.com
-   Thread-safe: Just don't share sessions
-   Non-blocking: it can be used both blocking and non-blocking
-   Your sockets: the app hands over the socket, or uses libssh sockets
-   OpenSSL or gcrypt: builds with either

Additional Features:

-   Client and server support
-   SSHv2 and SSHv1 protocol support
-   Supports Linux, UNIX, BSD, Solaris, OS/2 and Windows
-   Full API documentation and a tutorial
-   Automated test cases with nightly tests
-   Event model based on poll(2), or a poll(2)-emulation.

## libssh2

**libssh2** is another independent project providing a lean C library
implementing the SSH2 protocol for embedding specific SSH capabilities
into other tools. It has a stable, well-documented API for working on
the client side with the different SSH subsystems: Session, Userauth,
Channel, SFTP, and Public Key. The API can be set to either blocking or
non-blocking. The code uses strict name spaces, is C89-compatible and
builds using regular GNU Autotools.

**libssh2** is available under a modified BSD license. The functions are
each documented in their own manual pages. The project web site contains
the documentation, source code and examples:

`   ``http://www.libssh2.org/`` `

There is a mailing list for **libssh2** in addition to an IRC channel.
The project is small, low-key and, as true to the spirit of the
Internet, a meritocracy. Hundreds of specific functions allow specific
activities and components to be cherry-picked and added to an
application:

-   Shell and SFTP sessions
-   Port forwarding
-   Password, public-key, host-based keys, and keyboard-interactive
    authentication methods.
-   Key Exchange Methods diffie-hellman-group1-sha1,
    diffie-hellman-group14-sha1, diffie-hellman-group-exchange-sha1
-   Host Key Types: ssh-rsa and ssh-dss
-   Ciphers: aes256-ctr, aes192-ctr, aes128-ctr, aes256-cbc
    (rijndael-cbc@lysator.liu.se), aes192-cbc, aes128-cbc, 3des-cbc,
    blowfish-cbc, cast128-cbc, arcfour, arcfour128, or without a cipher.
-   Compression Scheme zlib or without compression
-   Message Authentication Code (MAC) algorithms for hashes: hmac-sha1,
    hmac-sha1-96, hmac-md5, hmac-md5-96, hmac-ripemd160
    (hmac-ripemd160@openssh.com), or none at all
-   Channels: Shell, Exec -- including the SCP wrapper, direct TCP/IP,
    subsystem
    -   Channel Requests: x11, pty
-   Subsystems: sftp version 3, public-key version 2
-   Thread-safe, blocking or non-blocking API
-   Your sockets: the app hands over the socket, calls select() etc.
-   Builds with either OpenSSL or gcrypt

See also the library **libcurl** which supports SFTP and SCP URLs.

## Thrussh

**Thrussh** is an SSH library written in Rust and available under the
Apache License version 2.0. It is a full implementation of the SSH 2
protocol. The only non-Rust part is the crypto back end, which uses
ring instead. It is designed to
work on any platform and to use asynchronous I/O. The project web site
contains the documentation, source code, and examples. The code is
accessible using **darcs**:

`darcs get ``https://pijul.org/thrussh`

It is not an implementation of an actual server or client, but instead
contains all the elements needed to write custom clients and servers
using Rust.

## Other language bindings for the SSH protocols

What follows is a list of additional independent resources by
programming language:

### Perl

-   \[<http://search.cpan.org/perldoc?Net>::SSH2 Net::SSH2\]: a wrapper
    module for **libssh2**.
-   \[<http://search.cpan.org/perldoc?Net>::<SSH::Perl>
    Net::<SSH::Perl>\]: a full SSH/SFTP implementation in pure Perl.
    Unfortunately this module is not being maintained any more and has
    several open bugs. Also, installing it can be a daunting task due to
    some of its dependencies.
-   \[<http://search.cpan.org/perldoc?Net>::OpenSSH Net::OpenSSH\]: a
    wrapper for OpenSSH binaries and other handy programs (**scp**,
    **rsync**, **sshfs**). It uses OpenSSH multiplexing feature in order
    to reuse connections.
-   \[<http://search.cpan.org/perldoc?Net>::OpenSSH::Parallel
    Net::OpenSSH::Parallel\] a module build on top of **Net::OpenSSH**
    that allows to transfer files and run programs on several machines
    in parallel efficiently.
-   \[<http://search.cpan.org/perldoc?SSH>::Batch <SSH::Batch>\] another
    module build on top of **Net::OpenSSH** that allows to run programs
    on several hosts in parallel.
-   \[<http://search.cpan.org/perldoc?Net>::<SSH::Expect>
    Net::<SSH::Expect>\]: this module uses
    Expect to drive
    interactive shell sessions run on top of SSH.
-   \[<http://search.cpan.org/perldoc?Net>::SSH Net::SSH\]: a simple
    wrapper around any SSH client. It does not support password
    authentication and is very slow as it establishes a new SSH
    connection for every remote program invoked.
-   \[<http://search.cpan.org/perldoc?Net>::SCP Net::SCP\] and
    \[<http://search.cpan.org/perldoc?Net>::SCP::Expect
    Net::SCP::Expect\]: modules wrapping the **scp** program. Note that
    **Net::SSH2**, **Net::<SSH::Perl>** and **Net::OpenSSH** already
    support file transfers via **scp** natively.
-   \[<http://search.cpan.org/perldoc?Net>::<SFTP::Foreign>
    Net::<SFTP::Foreign>\]: a full SFTP client written in Perl with lots
    of bells and whistles. By default is uses **ssh** to connect to the
    remote machines but it can also run on top of **Net::SSH2** and
    **Net::OpenSSH**.
-   \[<http://search.cpan.org/perldoc?GRID>::Machine GRID::Machine\],
    \[<http://search.cpan.org/perldoc?IPC>::PerlSSH IPC::PerlSSH\] and
    \[<http://search.cpan.org/perldoc?SSH>::RPC <SSH::RPC>\]: these
    modules allow to distribute and run Perl code on remote machines
    through SSH.

### Python

Paramiko

-   <http://www.lag.net/paramiko/>

Fabric

-   <http://docs.fabfile.org/>

libssh2

-   <http://www.no-ack.org/2010/11/python-bindings-for-libssh2.html>

TwistedConch

-   <https://twistedmatrix.com/trac/wiki/TwistedConch>

### Ruby

Net::SSH

-   <https://github.com/net-ssh>

Capistrano

-   <https://github.com/capistrano/capistrano>

### Java

Jaramiko

-   <http://www.lag.net/jaramiko/>

JSch - a pure Java implementation of
SSH2.

-   <http://www.jcraft.com/jsch/>


## References



[^1]: 
