Skip to content

Instantly share code, notes, and snippets.

@eruffaldi

eruffaldi/openssh-build-static.sh

Forked from fumiyas/openssh-build-static.sh
Last active January 4, 2024 07:23
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save eruffaldi/85254616dc14071f02dd8d43554a50a1 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save eruffaldi/85254616dc14071f02dd8d43554a50a1 to your computer and use it in GitHub Desktop.
Download ZIP
Build OpenSSH with static linked zlib and OpenSSL libraries
Raw
openssh-build-static.sh
#!/bin/sh
set -u
set -e
umask 0077
prefix="/opt/openssh"
top="$(pwd)"
root="$top/root"
build="$top/build"
export CPPFLAGS="-I$root/include -L."
rm -rf "$root" "$build"
mkdir -p "$root" "$build"
gzip -dc dist/zlib-*.tar.gz |(cd "$build" && tar xf -)
cd "$build"/zlib-*
./configure --prefix="$root" --static
make
make install
cd "$top"
gzip -dc dist/openssl-*.tar.gz |(cd "$build" && tar xf -)
cd "$build"/openssl-*
./config --prefix="$root" no-shared
make
make install
cd "$top"
gzip -dc dist/openssh-*.tar.gz |(cd "$build" && tar xf -)
cd "$build"/openssh-*
cp -p "$root"/lib/*.a .
[ -f sshd_config.orig ] || cp -p sshd_config sshd_config.orig
sed \
-e 's/^#\(PubkeyAuthentication\) .*/\1 yes/' \
-e '/^# *Kerberos/d' \
-e '/^# *GSSAPI/d' \
-e 's/^#\([A-Za-z]*Authentication\) .*/\1 no/' \
sshd_config.orig \
>sshd_config \
;
./configure --prefix="$prefix" --with-privsep-user=nobody --with-privsep-path="$prefix/var/empty"
make
#make install
cd "$top"
@eruffaldi
Copy link
Author

eruffaldi commented Jan 4, 2024

Tested on Ubuntu 22.04 the ldd on sshd provides the dependencies on libc and libcrypt:

linux-vdso.so.1 (0x00007ffe74d60000)
libcrypt.so.1 => /lib/x86_64-linux-gnu/libcrypt.so.1 (0x00007f330d960000)
libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f330d738000)
/lib64/ld-linux-x86-64.so.2 (0x00007f330dff4000)
'''

The libc dependency can be removed by using ulibc, while libcrypt could be sourced by Debian.

For debian, the libcrypt is provided by the libxcrypt upstream (https://packages.debian.org/source/sid/libxcrypt) with source here: https://salsa.debian.org/md/libxcrypt/

@eruffaldi
Copy link
Author

eruffaldi commented Jan 4, 2024

Thanks to the original gist. The use case of this gist is for a system in which OpenSSH needs to be updated but the rest of the OS libraries cannot be updated.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment