OpenSSH Version 8.9-1J for VSI OpenVMS

Thank you for your interest in this port of OpenSSH to VSI OpenVMS IA-64, Alpha, and x86-64. The current release of OpenSSH for OpenVMS is based on the OpenSSH 8.9 distribution.

OpenSSH (https://www.openssh.com/) is an Open Source (BSD licensed) suite of secure networking utilities based on the Secure Shell (SSH) protocol, which provides a secure channel over a potentially unsecured network. OpenSSH is a complete implementation of the SSH protocol (version 2) for secure remote login, command execution, and file transfer. It includes SSH client and server components, file transfer utilities SCP and SFTP, as well as the tools for key generation, run-time key storage, and a number of other supporting programs.

This port of OpenSSH to VSI OpenVMS IA-64, Alpha, and x86-64 is based on the Portable OpenSSH distribution (see https://github.com/openssh/openssh-portable), which is a port of OpenBSD's OpenSSH implementation commonly used on Linux, OS X, and Cygwin.

VMS Software Inc. would like to acknowledge the work of the Portable OpenSSH development team for their ongoing efforts in developing and supporting this software.

For a detailed description of the features and bug fixes included in this release of OpenSSH, please refer to https://www.openssh.com/txt/release-8.9.

The kit you are receiving has been compiled and built using the operating system and compiler versions listed below. Note that while you probably will not have any problems installing and using this kit on systems running higher versions of the operating system and/or products listed below, running older versions may cause problems.

Before installing and using OpenSSH, it is recommended that users read the documentation available at https://www.openssh.com/manual.html in order to better understand how to configure and use the software.

This kit is provided as an OpenVMS PCSI kit that can be installed by a suitably privileged user running the following command:

$ PRODUCT INSTALL OPENSSH

The installation will then proceed as follows. Note that the output may differ slightly from that shown below depending on the platform and other factors.

The following product has been selected:
    VSI I64VMS OPENSSH V8.9-1J             Layered Product
 
Do you want to continue? [YES] 
 
Configuration phase starting ...
 
You will be asked to choose options, if any, for each selected product and for
any products that may be installed to satisfy software dependency requirements.
 
Configuring VSI I64VMS OPENSSH V8.9-1J: VSI OpenVMS OpenSSH
 
    © (c) Copyright 2024 VMS Software, Inc.
 
    OpenVMS OpenSSH is released under a BSD licence, or a licence more free than
 that.

 
* This product does not have any configuration options.
 
Execution phase starting ...

The following product will be installed to destination:
    VSI I64VMS OPENSSH V8.9-1J             DISK$IA64V842L1S:[VMS$COMMON.]
 
Portion done: 0%...10%...20%...30%...40%...50%...60%...70%...80%...90%...100%

   User Accounts and User Identification Codes (UICs)
   --------------------------------------------------

    The OpenVMS OpenSSH installation creates two OpenVMS accounts:
    SSH$SSH, SSH$SSHD. The default UIC group number for these new
    accounts depends on the following:

    o If you are installing the server for the first time, the
      default is the first unused UIC group number, starting
      with 3655.

    o If any of these accounts already exists, then the default
      UIC group number will not be used to change the UIC of
      any existing accounts.

    o If old account TCPIP$SSH already exists, then the default
      UIC group number will be used from TCPIP$SSH account.

    For more information about UIC group numbers, see the
    OpenVMS System Manager's Manual.

Enter default UIC group number for OpenSSH account
Group: [3655] 
Creating OpenVMS account required by OpenSSH
SSH$SSH account already exists
SSH$SSHD account already exists
SSH$ROOT is defined as "DSA102:[SYS0.SYSCOMMON.OPENSSH.]"
Setting file protections...
  File protections are set

The OpenSSH configuration files were saved in the directory:
  SYS$COMMON:[SYSUPD.SSH$SAFETY]

Should it restore OpenSSH configuration files? [y/n]: [y]
Creating OpenSSH for OpenVMS root definition file SYS$COMMON:[SYS$STARTUP]SSH$DE
FINE_ROOT.COM...
  File created
Save startup files
Setup OpenSSH logical environment

Generating public/private keys:
  ssh_host_dsa_key. and ssh_host_dsa_key.pub are already present.
  ssh_host_ecdsa_key. and ssh_host_ecdsa_key.pub are already present.
  ssh_host_rsa_key. and ssh_host_rsa_key.pub are already present.
  ssh_host_ed25519_key. and ssh_host_ed25519_key.pub are already present.

Do you want to migrate your old SSH settings? [y/n]: [n]
  User canceled this operation!
  BY DEFAULT, THE CONNECTION PORT WILL SET TO 222!
  You can change this value now.
  Port: [222]
  You can use migration tool manually, use
  $ @ssh$root:[bin]ssh$migration.com
  Work log see in ssh$root:[var]ssh$migration_27sep2024_033700.log

Successfully finished

   In a cluster, on all the nodes that are going to use common
   ssh$root installation directory as the current node, copy
   the following files to SYS$STARTUP directory of each node:

        SYS$STARTUP:SSH$STARTUP.COM
        SYS$STARTUP:SSH$SHUTDOWN.COM
        SYS$STARTUP:SSH$DEFINE_ROOT.COM

   To automatically start OpenVMS OpenSSH during system startup
   add the following line to the file SYS$MANAGER:SYSTARTUP_VMS.COM
   after the TCPIP startup command procedure:

        $ @SYS$STARTUP:SSH$STARTUP.COM

   Define symbols for all OpenSSH utilities:

        $ @SSH$ROOT:[BIN]SSH$DEFINE_COMMANDS.COM

   To have all symbols defined by the time of login,
   add a caller line of SSH$ROOT:[BIN]SSH$DEFINE_COMMANDS.COM file in either:
        1. in SYS$MANAGER:SYLOGIN.COM (note that you need system priv's for this)
        2. in SYS$LOGIN:LOGIN.COM
...100%

The following product has been installed:
    VSI I64VMS OPENSSH V8.9-1J             Layered Product

After the installation has successfully completed, follow these steps:

If SSH$DEFINE_COMMANDS.COM is run with the parameter "ALL" the following additional commands will be defined. These commands are intended primarily for administrative purposes:

As noted above, this release of OpenSSH for VSI OpenVMS includes a migration script (SSH$ROOT:[BIN]SSH$MIGRATION.COM) that can be used to convert configuration files and user public/private keys from the format used by VSI TCP/IP Services to the format expected by OpenSSH. After installing OpenSSH for VSI OpenVMS, this tool can be run to establish an initial OpenSSH system configuration that is comparable to that provided by the existing VSI TCP/IP Services.

The migration tool is run at the end of the OpenSSH kit installation. The user is prompted as to whether they wish to perform the migration at this time, the default being NO. In general, it is recommended that the migration be performed manually as a post-installation activity. Note that if OpenSSH is already installed or the VSI TCP/IP SSH service does not exist, the migration tool will not run.

Specific features of the migration facility are summarized as follows:

The following brief notes illustrate how to run the migration tool to perform migration tasks or to revert to your old VSI TCP/IP Services configuration. Note that when running the migration tool, it is recommended that you not be logged into the OpenVMS system via VSI TCP/IP Services SSH.

The following table summarizes the parameter conversions that are performed by the migration tool for the SSHD2_CONFIG and SSH2_CONFIG configuration files (for additional details regarding the configuration parameters, see the next section).

This section describes the unique to OpenVMS configuration parameters to be used in OpenSSH client and server configuration files.

The following logical names may be defined (at any level) to control the exit status of SFTP and other OpenSSH utilities, and to control the behaviour of the SFTP client when errors are encountered during file transfer operations.

The rights identifier TCPIP$SSH_FILECOPY_DISALLOWED can be used to prevent users from connecting to the SFTP server.

We are pleased to introduce external authentication support in VSI OpenSSH. All SSH logins now utilize the OpenVMS SYS$ACM(W) system service for password authentication.

X11 Port Forwarding via OpenSSH enables users to connect to an SSH server on the VSI OpenVMS host and run X11 client programs, which will appear on their local display.

X11 Port Forwarding must be enabled on both the SSH client and server. On the client side, this is typically done with the -X or -Y option when initiating an SSH connection.

The server must also have X11 Port Forwarding enabled in its SSH configuration file, ssh$root:[etc]sshd_config, by setting the option X11Forwarding to Yes. For further details see Section 9.1, “Server Configuration Parameters”.

The following issues have been fixed in this release: