How to Compile OpenSSH Without Root Access on Linux

Compiling OpenSSH without root access allows you to install and run a custom version of the SSH client and server in your user space. This is useful in environments where you don’t have administrative privileges, such as shared servers or restricted workstations. By building OpenSSH yourself, you can enable features or versions not available in the system packages and maintain a personal setup without affecting other users.

What You’ll Need

• A Unix-like operating system (Linux, BSD, macOS)
• Basic command line tools: gcc (or another C compiler), make, and shell utilities
• Access to a terminal shell
• Internet connection to download OpenSSH source code and dependencies
• Optional: local installation directory with write permissions (e.g., $HOME/openssh)

Step-by-Step

1. Prepare your environment: Open a terminal and create a directory to hold the OpenSSH source and build files. For example, mkdir -p $HOME/openssh_build && cd $HOME/openssh_build.
2. Download the OpenSSH source code: Visit the official OpenSSH portable release page at https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/ and download the latest stable tarball. For example, use wget https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-9.3p1.tar.gz (replace version as appropriate).
3. Extract the source code: Use tar -xzf openssh-9.3p1.tar.gz to unpack the files, then enter the directory with cd openssh-9.3p1.
4. Install dependencies locally if needed: OpenSSH requires libraries like OpenSSL, zlib, and sometimes others like PAM or Kerberos. If the system versions are too old or missing, you may need to compile these libraries yourself in your home directory and configure OpenSSH to use them. This step can be complex but often is unnecessary if the system libraries are adequate.
5. Configure the build to install in your home directory: Run the configure script with a prefix pointing to a writable directory in your home, for example:
   ./configure --prefix=$HOME/openssh --sysconfdir=$HOME/openssh/etc --without-openssl-header-check
   This installs binaries and configuration in your user space. Adjust --sysconfdir so your sshd config files won’t require root access.
6. Compile OpenSSH: Run make to build the software. This step compiles the source code into executable binaries using your local compiler.
7. Install OpenSSH locally: Use make install to copy the compiled binaries, libraries, and configuration files into your specified prefix directory.
8. Configure your environment: Add the OpenSSH binaries to your PATH by adding export PATH=$HOME/openssh/bin:$PATH to your shell profile (e.g., .bashrc or .zshrc).
9. Configure SSH client and server: Edit the configuration files in $HOME/openssh/etc. For the SSH client, you can create or modify $HOME/.ssh/config. For the SSH server (sshd), adjust sshd_config in the local etc directory. Note that running sshd without root access limits certain features (like binding to port 22).
10. Run your custom ssh or sshd: Use the full path or your updated PATH to run ssh. For sshd, you can start it on a high-numbered port (e.g., 2222) with:
    $HOME/openssh/sbin/sshd -f $HOME/openssh/etc/sshd_config -p 2222
    Remember, binding to ports below 1024 requires root privileges.
11. Test your setup: Connect to your local ssh server with:
    ssh -p 2222 localhost
    Or test the client against remote hosts to verify your OpenSSH build works as expected.

Common Mistakes

• Trying to install OpenSSH to system directories without root access, leading to permission errors.
• Not specifying a custom prefix during configuration, causing binaries to attempt installation in /usr or /usr/local.
• Failing to add the local OpenSSH binary directory to your PATH, resulting in the system ssh client running instead.
• Ignoring dependencies like OpenSSL or zlib, which can cause configure or make to fail.
• Attempting to run sshd on port 22 without root, which will fail due to insufficient privileges.
• Not adjusting configuration paths to reflect the local installation directories.

Tips

• Use a dedicated directory in your home folder to keep your OpenSSH installation organized and easy to manage.
• Check for existing OpenSSL and zlib libraries on your system before compiling your own to save time.
• Run ./configure --help to explore other useful options, such as disabling unneeded features for a smaller build.
• If you need features like Kerberos or PAM, ensure you have user-accessible development headers and libraries or build them locally first.
• Use verbose mode (ssh -v) to debug client connection issues.
• Consider using make -j$(nproc) to speed up compilation by parallelizing builds if your system supports it.
• Keep your OpenSSH source updated and rebuild periodically to incorporate security patches.

Troubleshooting

Configure script fails: Ensure you have essential build tools installed (gcc, make, autoconf). Missing dependencies like OpenSSL or zlib can cause failures. Check config.log for detailed errors. If system libraries are outdated, consider compiling them locally.

Permission denied during make install: This usually means you tried to install to a system directory. Always use --prefix pointing to a directory you own.

sshd fails to start or bind port 22: Non-root users cannot bind to ports below 1024. Use a higher port number (e.g., 2222) in sshd_config or via command line with -p.

SSH client connects but authentication fails: Check your SSH keys and permissions. Ensure your .ssh directory and files have correct permissions (700 for directory, 600 for private keys).

New OpenSSH binaries not found when running ssh: Confirm your PATH includes $HOME/openssh/bin. You can run which ssh to verify which binary is being used.

Compilation is slow or hangs: Try limiting parallel jobs or check system resource usage. Some systems may need updated compilers or tools.

Frequently Asked Questions

Can I run sshd without root access?

Yes, but only on non-privileged ports (above 1024). You cannot bind to port 22 without root. Also, some system-wide features may not be available.

Do I need to compile OpenSSL myself?

Often not. Most systems provide OpenSSL libraries and headers. Only compile your own if the system version is too old or missing.

How do I update my custom OpenSSH installation?

Download the new source version, repeat the build and install steps in your local directory, and replace the old binaries.

Will this interfere with the system OpenSSH?

No. Installing in your home directory and adjusting your PATH ensures you use your custom version without affecting the system-wide OpenSSH.

Can I use this method to run other SSH-related tools?

Yes. Compiling OpenSSH locally also builds tools like ssh-keygen, ssh-agent, and scp, which you can run from your local installation.

What if I get errors about missing PAM or Kerberos support?

You can disable these features during configuration by adding flags like --without-pam or --without-kerberos5 if you don’t need them or lack the dependencies.

By following these steps, you can effectively compile and run OpenSSH in your user space without needing root access. This empowers you to maintain a secure and customized SSH environment even in restricted setups.

Related

• Jak se mění počty obyvatel v českých městech v posledních letech
• Největší města ČR bez průmyslu: 10 zajímavých lokalit
• Nejmenší města ČR podle hustoty zalidnění: 10 překvapení