How to Compile OpenSSH Without an Internet Connection

Compiling OpenSSH without an internet connection allows you to install and customize a secure shell server or client on isolated or restricted systems. This approach is essential in environments with strict network policies, air-gapped systems, or when working offline. By compiling from source, you ensure control over the build process, dependencies, and installation paths without relying on online package managers.

What You’ll Need

A computer with internet access to download all necessary source files and dependencies.
Storage media (USB drive, external HDD, or any removable device) to transfer files to the offline machine.
The target offline machine with a compatible build environment (compiler, make, and standard development tools).
OpenSSH source tarball and all required dependencies’ source code or precompiled binaries.
Basic knowledge of Linux/Unix commands and compilation procedures.

Step-by-Step

Prepare the online machine: On a system with internet access, download the latest OpenSSH source code from the official site (https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/) or a trusted mirror. Choose a stable release tarball (e.g., openssh-9.4p1.tar.gz).
Identify dependencies: OpenSSH requires several libraries and tools such as OpenSSL or LibreSSL, zlib, and potentially others depending on features you want (e.g., PAM for authentication). Download the source tarballs for these dependencies as well. For example:
- openssl-3.x.x.tar.gz or libressl-3.x.x.tar.gz
- zlib-1.x.x.tar.gz
- PAM source if needed (e.g., pam-1.x.x.tar.gz)
Download build tools if missing: Ensure the offline machine has essential build tools: gcc, make, autoconf, automake, libtool, and pkg-config. If absent, download their source packages or precompiled binaries and transfer them similarly.
Transfer files to the offline machine: Copy all source tarballs and build tools to your removable media, then move them to the offline target system.
Extract and build dependencies: On the offline machine, create a working directory (e.g., ~/build) and extract each dependency’s tarball using tar -xzf filename.tar.gz. Build and install them one by one, typically using:
```
./configure --prefix=/usr/local
make
sudo make install
```
Note that you may want to specify --prefix to control where the libraries and headers go, especially if the system’s default paths are restricted.
Set environment variables: After installing dependencies, update environment variables so the compiler and linker find the correct libraries and headers. For example, add to ~/.bashrc or export directly:
```
export PKG_CONFIG_PATH=/usr/local/lib/pkgconfig
export LD_LIBRARY_PATH=/usr/local/lib
export C_INCLUDE_PATH=/usr/local/include
export LIBRARY_PATH=/usr/local/lib
```
Then run source ~/.bashrc or export them in the current shell.
Extract and configure OpenSSH: Extract the OpenSSH source tarball. Navigate into its directory and run:
```
./configure --prefix=/usr/local/openssh --with-ssl-dir=/usr/local --with-zlib=/usr/local
```
Adjust the --prefix and dependency paths as needed based on where you installed libraries.
Compile OpenSSH: Run make to build the software. This step compiles all binaries and utilities.
Install OpenSSH: Once compilation completes without errors, install it with:
```
sudo make install
```
This installs OpenSSH binaries, configuration files, and manpages to the specified --prefix location.
Configure OpenSSH: Edit configuration files such as sshd_config located in /usr/local/openssh/etc/ or wherever installed. Customize options like ports, authentication methods, and keys.
Start the OpenSSH server: Use the installed sshd binary to start the server manually or integrate it with your system’s init system or systemd by creating appropriate service files.
Verify installation: Test the OpenSSH client and server locally or from another machine to confirm that the build and installation succeeded.

Common Mistakes

Missing dependencies: Forgetting to download or build essential libraries like OpenSSL or zlib causes configuration or compilation failures.
Incorrect environment variables: Not setting PKG_CONFIG_PATH, LD_LIBRARY_PATH, or include paths prevents the compiler and linker from finding dependencies.
Using incompatible versions: Mixing incompatible versions of OpenSSH and dependencies can cause build errors or runtime issues.
Ignoring build errors: Proceeding without resolving errors during configure or make can result in an incomplete or broken installation.
Installing to wrong directories: Installing binaries or libraries to unexpected locations can cause PATH or runtime library loading problems.

Tips

Use the exact same OS and architecture: Prepare dependencies on a machine with the same OS version and architecture to avoid compatibility problems.
Bundle dependencies: Consider building static versions of dependencies or statically linking OpenSSH to reduce runtime dependency issues.
Document your process: Keep notes on versions, configuration flags, and environment settings for reproducibility.
Check OpenSSH release notes: Review release notes for any new dependencies or build instructions before starting.
Use make clean: If you need to recompile, always clean previous builds first to avoid stale object files.
Test dependencies first: Verify that your installed libraries (e.g., OpenSSL) function correctly before compiling OpenSSH.

Troubleshooting

If the build or installation does not go according to plan, consider the following approaches:

Check config.log: Review the config.log file generated by ./configure for detailed error messages and missing dependencies.
Verify compiler availability: Ensure gcc or your chosen compiler is installed and in your PATH by running gcc --version.
Missing header files or libraries: Confirm that the development headers (e.g., openssl-dev) are present. You may need to build or copy these manually.
Library version mismatches: Use ldd on compiled binaries to check linked libraries and ensure they point to your installed versions.
Permission issues: Installing to system directories requires root privileges; use sudo or adjust installation paths to user-owned directories.
Static linking: If dynamic linking fails at runtime, try building OpenSSH with static linking options to embed dependencies.
Consult documentation: Review OpenSSH INSTALL and README files for build instructions and known issues.

Frequently Asked Questions

Can I compile OpenSSH without OpenSSL?: OpenSSH requires cryptographic libraries; OpenSSL or LibreSSL is mandatory. You must provide one of these libraries when compiling.
How do I handle PAM authentication offline?: You need to download and build the PAM library source and enable PAM support during OpenSSH configuration with --with-pam.
Can I cross-compile OpenSSH for a different architecture?: Yes, but you must set up a proper cross-compilation toolchain and provide cross-compiled dependencies matching the target architecture.
What if my offline machine lacks a compiler?: You must transfer and install compiler toolchains manually or compile OpenSSH on a similar machine and transfer the binaries.
Is it possible to build a static OpenSSH binary?: Yes, by configuring static linking flags and ensuring all dependencies are available as static libraries, you can build a fully static OpenSSH binary.
How do I update OpenSSH later without internet?: Repeat the download and transfer process for the newer source tarballs and dependencies, then rebuild and reinstall on the offline machine.

Compiling OpenSSH without internet access requires careful preparation to ensure all dependencies and tools are available offline. By following these steps, you can install a secure, customized SSH server or client on isolated systems, maintaining security and control even in restricted environments.

For example, in government or industrial networks where external connectivity is prohibited, this method ensures you can deploy critical secure communication tools safely. Similarly, air-gapped research or development machines benefit from offline compilation to avoid exposure to external threats.

Remember to verify cryptographic module versions and security patches regularly, as offline systems can lag behind in updates. Maintaining an update routine using removable media and secure transfer methods will keep your OpenSSH installation robust.

Lastly, consider testing your compiled OpenSSH binaries in a controlled environment before deploying to production offline systems to catch any environment-specific issues early.

How to Compile OpenSSH Without an Internet Connection

How to Compile OpenSSH Without an Internet Connection

What You’ll Need

Step-by-Step

Common Mistakes

Tips

Troubleshooting

Frequently Asked Questions

Related