SSH 2.1.0 README
================

        Timo J. Rinne <tri@ssh.com>
	Sami Lehtinen <sjl@ssh.com>
        March 22, 2000.
	
	See the file LICENSING for licensing terms.


   What has changed since SSH1?
   ----------------------------

      - SSH has been 98% rewritten.

      - SSH now supports other key-exchange methods besides double-
        encrypting RSA key exchange. The current distribution comes with 
        Diffie-Hellman key exchange.

      - SSH now has support for DSA and other public key algorithms 
        besides RSA.

      - The protocol is more secure and allows future integration into
        public key infrastructures.

      - The protocol complies with the upcoming 'secsh' internet standard.

      - SSH now supports "subsystems", platform-independent modules that
        implement particular functions such as file transfers.

      - SSH now has built-in SOCKS support.

      - A new feature has been added: sftp, the secure file transfer 
        protocol.


   Feedback
   --------

      You can report any bugs either by a web form or by email.
      Web form: http://www.ssh.com/support/bug-report.html
      Email:    ssh-support@ssh.com

      Feature requests can also be submitted via
      http://www.ssh.fi/support/feature-request.html

      On other feeback issues, please email ssh2@ssh.com.


   Commercial Inquries
   -------------------

      For any queries concerning commercial use (such as availability 
      and different versions), please email ssh-sales@ssh.com.


SSH2 Binaries
=============

      ssh2            The SSH2 client.

      sshd2           The SSH2 daemon.

      sftp2           The SFTP client (needs ssh2). Type "?" in the 
                      command line for help.

      sftp-server2    The SFTP server (executed by sshd2).

      scp2            The SCP client.

      ssh-keygen2     The utility for generating keys. Use -h for help.

      ssh-add2        Add identities to the authentication agent.

      ssh-agent2      The authentication agent.

      ssh-askpass2    X11 utility for querying passwords.

      ssh-signer2     A small program that signs "hostbased" authentication 
                      packets. Executed by ssh2, and for proper function, 
                      must be suid root. (This is done by 'make install'.)


Installation
============

   1. uncompress the distribution
   ------------------------------

      > zcat ssh-2.0.x.tar.gz | tar xf -

      This should create a subdirectory ssh-2.0.x.

      > cd ssh-2.0.x


   2. compile ssh2
   ---------------

      Read the NOTES-section found in the end of this file.


      > ./configure
      > make

      If this fails, find and fix the problem. Report it to 
      ssh-support@ssh.com. Then try again. :-) Please see the 
      section REPORTING BUGS for more information before submitting 
      a bug report. 
      
      It is a good idea to use "--enable-debug" when configuring. 
      When needed, you can get out much more verbose debugging messages.
      It does not slow the execution, and you can still use 
      'CFLAGS="-g -O2"' with it.


   3. run the install script
   -------------------------

      Get a root shell and change to the ssh-2.0.x directory.

      # make install

      This should set everything up and create the host key.

      The old files are moved to *.old files. If you don't want them
      around, goto apps/ssh and run 

      # make clean-up-old

      which will delete them.

      NOTE: This host key has relatively little entropy. We'll have
            to actually stir in more randomness to create strong
            keys (this is a problem, if your system doesn't have
	    /dev/random). If your system doesn't have /dev/random, you
            might want to generate a couple of keys with ssh-keygen,
            and after that install a new hostkey. We'll fix this later.


   4. configure sshd2
   ------------------

      Set up the following files:


ssh 2 files
===========

      Public keys have a .pub suffix, private keys have no suffix. 
      For example:

         id_dsa_1024_a        A 1024-bit DSA private key
         id_dsa_1024_a.pub    The corresponding public key

      There is no "known_hosts", as in ssh1. The host keys are stored
      in separate files in ~/.ssh2/hostkeys .


   ~/.ssh2/hostkeys/key_xxxx_yyyy.pub
   -----------------------------

      This would be the public host key of the ssh2 daemon running in 
      port xxxx of the host yyyy.


   /etc/ssh2/hostkey.pub  and  /etc/ssh2/hostkey
   -----------------------------------------

      Public and private hostkeys for sshd2. Created by "make install".


   ~/.ssh2/identification
   ----------------------

      Lists the private keys that can be used for authentication.

         # identification
         IdKey  id_dsa_1024_a

      This means that the private key in the file ~/.ssh2/id_dsa_1024_a
      is used for public key authentication.


   ~/.ssh2/authorization
   ---------------------

      Lists the public keys that are accepted for authentication on 
      this host.

         # authorization
         Key     id_dsa_1024_a.pub

      This means that anyone who holds the matching private key to the
      public key in the file $USER/.ssh2/id_dsa_1024_a.pub can log in 
      as $USER.


   /etc/ssh2/sshd2_config
   --------------------

      The server configuration file, copied here by "make install". 
      See the man page for details.

      The line:

         subsystem-sftp                  sftp-server

      means that when when the subsystem "sftp" is requested, the
      command "sftp-server" is started. For example, if our sshd2_config
      read:

         subsystem-quux                  echo "fim fam foo"

      the command "ssh2 host -s quux" would simply print the text
      "fim fam foo".


   ~/.ssh2/ssh2_config
   -------------------

       The client configuration file. See the global client config file
       ssh2_config in /etc/ssh2.


   ~/.ssh2/knownhosts/xxxxyyyy.pub
   -------------------------------

      These are the public host keys of the hosts that a user wants to 
      log from using host based authentication (equivalent with SSH1's
      RhostsRSAAuthentication). 
      
      Also, a user has to set up her/his ~/.shosts (which only SSH uses)
      or ~/.rhosts file (insecure, as it is also used by the r*-commands).
      If the username is the same in both hosts, it is adequate to put
      the public hostkey to /etc/ssh2/knownhosts and add the host's name to
      /etc/shosts.equiv (or /etc/hosts.equiv). 

      xxxx denotes the hostname (FQDN) and yyyy the public key algorithm 
      of the key.

      For example, zappa.foo.fi's hostkey algorithm is ssh-dss. The
      hostkey would be named 

          zappa.foo.fi.ssh-dss.pub

      in the knowhosts-directory.

      Possible values for publickey-algorithms are "ssh-dss" and
      "ssh-rsa" (without the quotes).


   /etc/ssh2/knownhosts/xxxxyyyy.pub
   ---------------------------------

      As above, but system-wide. These can be overridden by the user
      by putting a file with the same name to her/his ~/.ssh2/knownhosts
      directory. 


   /etc/hosts.equiv and /etc/shosts.equiv
   --------------------------------------

      Used to check whether authentication from host is allowed using
      host based authentication. In its simplest form, the file contains
      host names, one per line.

      For more information, see 'man sshd2'.


   ~/.rhosts and ~/.shosts
   -----------------------

      This file contains host-username-pairs, separated by spaces, one
      per line. The given user from the specified host is allowed to
      log in without a password. 

      For more information, see 'man ssh2' and 'man sshd2'.


Platforms
=========

	Ssh 2.x has been reportedly successfully compiled and
	run on for example the following platforms (there are more):

	Processor	OS		OS-Versions
	-------------------------------------------------------------
	ix86,m68k	NetBSD		1.2, 1.3.x
	ix86		FreeBSD		2.2.x, 3.0-current
	ix86		Linux		2.0.3x, 2.2.x
	sparc		Solaris		2.6, 2.5.1
	PowerPC		AIX		4.1, 4.2.x
	hppa1.1		HPUX		10.20, 11.00
	mips		IRIX		6.5, 6.3, 6.2, 5.3 (with SGI cc)
	alpha		OSF1		4.0D, 4.0E
	ix86		SCO Openserver	5.0.4


NOTES ON INSTALLATION AND USE
=============================

	* Use 'scp2 -1' to enable compatibility with scp1.

	* If your system doesn't support, or has a broken version of
	  non-blocking connect, run ./configure with
	  -enable-blocking-connect .

	* If you get errors when compiling assembler files, configure
	  with --disable-asm and recompile.

	* compatibility with SSH1 works correctly ONLY IF your SSH1 version
	  is 1.2.26 or better (1.2.27 is the latest). So be sure you have
	  that!

	* If your Sun boots during a connect to sshd2, do the following: 
	  Fetch the latest patches from Sun, generate a new host key with 
	  the patched version, and try again. (Also, you might want to try
	  --enable-blocking-connect etc.)

	* If configure complains 'configure: error: configuring with X
	  but xauth not found - aborting', try 

		./configure --without-x

	  or, add path of xauth to your PATH before running
	  configure. You can find xauth's location like this:

		find / -name xauth

	* Use 'ssh-keygen -P' to create keys without passphrases 
	  (for use with rsync etc).

	* Configure option --disable-crypt-asm no longer exists 
	  (use --disable-asm instead).

        * sftp2 (or more correctly sftp-server2, as this is a server
          issue) can not be configured to gain filecopying-only access
          to a server. You cannot configure it to chroot etc. Sftp2
          can only be used if you allow shell access (ie. access with
          ssh2) to the server. Sftp2 IS meant for novice users, and
          users who don't feel like logging in to copy files.

	* If your sftp2 complains something like this: "Need basic
	  cursor movement capability, using vt100", then no library
	  containing tgetent() function was found when you ran
	  ./configure . If you have a Linux system, then that is
	  probably because you don't have either termcap-devel or
	  ncurses-devel packages installed. If you want to get rid of
	  the message, and/or to use some more exotic terminals
	  capabilities, you should install either package. (A good 
	  place to look for those is your distribution's web-page.)


KNOWN BUGS
==========

	* In the Windows terminal client, outgoing (local) forward ports
	  can be accessed from other computers. This will be changed in
	  the next version. If you are on a non-secure LAN you shouldn't
	  use outgoing port forwarding on Windows.

	* scp2_old: When using the '-p' option together with the '-r'
	  option, directory modification times are not properly set.

	* Assembler-optimizations don't compile on BSDI. Configure
	  with --disable-asm.

	* Reportedly sshd2 child process can sometimes end up in a
	  busy loop on the server side, consuming CPU-time. (This has 
	  been reported mainly on Solaris, and on rare occasions on some 
	  other systems as well). This should now be fixed at least for 
	  Solarises. If you still encounter these problems, please report 
	  them to ssh-support@ssh.com

	* Reportedly sshd2 doesn't fork correctly to background on some
	  AIX systems. We haven't been able to reproduce this.
	
	* ssh-keygen2 dumps core on Linux/PowerPC environments. This
	  is probably due to egcs's different arg_list. This should now 
	  be fixed. If you encounter this problem, please report it to 
	  ssh-support@ssh.com


REPORTING BUGS
==============

   When reporting bugs, please attach to you mail at least the following 
   information:

	a) your system type (preferably by running config.guess which
           is in the root of ssh2 sourcedir, and runnning the command 
		% uname -a
		).

	b) detailed description of the bug

	c) how to repeat it

	d) config.log, which is left to the root of ssh2 sourcedir
	   after running configure.

	e) possibly even make.log, if you've encountered a problem
	   with compilation. You can do this by running the following
	   sequence:

		% script make.log
		% make
		  [.... lots of output ...]
		% exit

	   If your system doesn't have script, use shell redirects etc. 
	   For example, in Bourne shell-variants:

		% make > make.log 2>&1
	
	   Note that you need to redirect also stderr (2) to stdout (1). 
	   We need those warnings and errors to appear in the log too.

   See the template in the file BUG.REPORT .


REMEMBER
========

* The SSH compilation success/failure web page. You can fill in the reply
  form about your compilation at
  <URL:http://www.ssh.com/tech/ssh_form.html>. You can query about the
  success/failure database from
  <URL:http://www.ssh.com/tech/ssh_query.html>.

* Latest news about ssh can be found in
  <URL:http://www.ssh.org/>


LEGAL ISSUES
============

See the file LICENSING for licensing and distribution conditions.
THERE IS NO WARRANTY FOR THIS PROGRAM.

In some countries, particularly Russia, Iraq, Pakistan, and France, 
it may be illegal to use any encryption at all without a special permit.

This software may be freely imported into the United States; however,
the United States Government may consider re-exporting it a criminal
offense.  Thus, if you are outside the US, please retrieve this
software from outside the US.

Note that any information and cryptographic algorithms used in this
software are publicly available on the Internet and at any major
bookstore, scientific library, or patent office worldwide.

SSH, SSH2 and Secure shell are registered trademarks or trademarks
of SSH Communications Security.


THANKS
======	
	...to everyone who contributed to SSH2. If you feel that your
	name should be in this list, please mail to ssh2@ssh.fi. The
	following names are in no particular order.

	Dug Song
	Andreas Ley
	Troy Barbee
	Simon Burge
	Luigi Pugnetti
	Youki Kadobayashi
	Georgi Kuzmanov
	Hirotaka Yamamoto
	Martin Buchholz
	John David Anglin
	David Mansfield
	Goran Gajic
	Niko Tyni
	Eugene Krainov
	William C. Ray
	Andrew Libby
	Alexander Savelyev
	Aldo Ramos
	Sigurdur Asgeirsson
	Cedomir Igaly
	Jeremy Buhler
	Per Allansson
	Andre Cornelis van Veen
	Tom Woodburn
	Brian A May
	Horst von Brand
	John Riddoch
	Neil W Rickert
	Marina Buitrago
	Ian Duplisse
	Jeff P. Van Dyke
	Thorsten Schlichting
        Roger Cornelius
        Markus Gyger

	... and everyone else who submitted bug reports,
	feature-requests and patches.

