4 ms·

If you have Homebrew or something similar, I recommend installing openssh through there -- you get a newer version to boot.

rovr138 7y ago
I always do this. I'm not sure what's the current state, but there are features on SSH I wasn't able to use due to the version provided being old. I know that `Include` on `config` is/was one. Include "some/path" This is something I use frequently that wasn't available on previous built in versions.
- oefrha 7y ago
  > I'm not sure what's the current state, but there are features on SSH I wasn't able to use due to the version provided being old. > I know that `Include` on `config` is/was one. That's both terribly out of date info and hardly ever true as far as I can tell. The Include directive was a new feature of OpenSSH 7.3, released on 2016-08-01.[1] Apple shipped OpenSSH 7.3 in macOS 10.12.2[2][3], released on 2016-12-13. That's a very reasonable four months gap. I only use the system ssh because stock OpenSSH didn't integrate well with system keychain many years ago (not sure about the current state). But I've been using the Include directive for a long time. [1] https://www.openssh.com/txt/release-7.3 https://www.openssh.com/txt/release-7.3 [2] https://opensource.apple.com/release/macos-10122.html https://opensource.apple.com/release/macos-10122.html [3] https://opensource.apple.com/source/OpenSSH/OpenSSH-209.30.4/openssh/version.h.auto.html https://opensource.apple.com/source/OpenSSH/OpenSSH-209.30.4...
2ion 7y ago
It's usually not a full replacement. SSH for macOS has some integration built in that current OpenSSH does not have, like Keychain integration.
- skoskie 7y ago
  Really? I have my ~/.ssh/config file set to “AddToKeychain” on all entries and it doesn’t seem to be a problem.
- lilyball 7y ago
  I thought Homebrew patched OpensSSH using Apple's keychain patch, but looking at the formula right now I see # Please don't resubmit the keychain patch option. It will never be accepted. # https://github.com/Homebrew/homebrew-dupes/pull/482#issuecomment-118994372 Sadly the homebrew-dupes repo seems to have been deleted so this comment can't be read anymore.
  - saagarjha 7y ago
    > Sadly the homebrew-dupes repo seems to have been deleted so this comment can't be read anymore. They're kinda bad at that in general :/
  - CKN23-ARIN 7y ago
    Archive of the discussion: https://archive.is/hSB6d https://archive.is/hSB6d > We are uncomfortable continually supporting a 1900+ line patch which upstream hasn't signed off on that has the potential to both compromise OpenSSH security and Keychain security. From 10.11 it will also be impossible to edit plists in /System/* without disabling rootless, which isn't a configuration we'll be intentionally supporting.
- _-___________-_ 7y ago
  I prefer ssh-agent anyway, but yeah, I think they did remove the keychain integration patch.
Doctor_Fegg 7y ago
Oh god no. Homebrew managing openssh has been the cause of more command-line instability and forced reinstalls than anything else I’ve encountered in the last few years of OS X (sorry, macOS). I’ve started installing stuff from source again just to prevent a cascade of Homebrew upgrades breaking everything.
- _-___________-_ 7y ago
  Never experienced this in a decade or so of using Homebrew's OpenSSH, but you can absolutely use something other than Homebrew to get a more up-to-date and standard OpenSSH install if you prefer.
- lloeki 7y ago
  > I’ve started installing stuff from source again just to prevent a cascade of Homebrew upgrades breaking everything. Since you crossed that line, do yourself a favour and check out nixpkg.
- theonemind 7y ago
  I sometimes use NetBSD's pkgsrc on macOS because it installs super cleanly in any prefix you like and never, ever breaks the system. It doesn't have everything, and you will occasionally encounter a package that won't build, but it doesn't even dream of taking over /usr/local or disrupting your system. You could install it into your home directory if you wanted to (which I have done, on systems where I don't have root or enough ownership to just throw things anywhere)
- rswail 7y ago
  Why don't people use MacPorts instead? I've never had any problems with it. Homebrew wants to screw around in /usr, Macports installs itself in /opt and doesn't interfere with things in the MacOS world. Set your PATH to have /opt/local/{bin,sbin} and everything Just Works.
  - saila 7y ago
    What is the practical difference between /usr/local and /opt or /opt/local? I don't think macOS puts anything in /usr/local.

rovr138 7y ago

I always do this. I'm not sure what's the current state, but there are features on SSH I wasn't able to use due to the version provided being old. I know that `Include` on `config` is/was one. Include "some/path" This is something I use frequently that wasn't available on previous built in versions.

oefrha 7y ago
> I'm not sure what's the current state, but there are features on SSH I wasn't able to use due to the version provided being old. > I know that `Include` on `config` is/was one. That's both terribly out of date info and hardly ever true as far as I can tell. The Include directive was a new feature of OpenSSH 7.3, released on 2016-08-01.[1] Apple shipped OpenSSH 7.3 in macOS 10.12.2[2][3], released on 2016-12-13. That's a very reasonable four months gap. I only use the system ssh because stock OpenSSH didn't integrate well with system keychain many years ago (not sure about the current state). But I've been using the Include directive for a long time. [1] https://www.openssh.com/txt/release-7.3 https://www.openssh.com/txt/release-7.3 [2] https://opensource.apple.com/release/macos-10122.html https://opensource.apple.com/release/macos-10122.html [3] https://opensource.apple.com/source/OpenSSH/OpenSSH-209.30.4/openssh/version.h.auto.html https://opensource.apple.com/source/OpenSSH/OpenSSH-209.30.4...

2ion 7y ago

It's usually not a full replacement. SSH for macOS has some integration built in that current OpenSSH does not have, like Keychain integration.

skoskie 7y ago
Really? I have my ~/.ssh/config file set to “AddToKeychain” on all entries and it doesn’t seem to be a problem.
lilyball 7y ago
I thought Homebrew patched OpensSSH using Apple's keychain patch, but looking at the formula right now I see # Please don't resubmit the keychain patch option. It will never be accepted. # https://github.com/Homebrew/homebrew-dupes/pull/482#issuecomment-118994372 Sadly the homebrew-dupes repo seems to have been deleted so this comment can't be read anymore.
- saagarjha 7y ago
  > Sadly the homebrew-dupes repo seems to have been deleted so this comment can't be read anymore. They're kinda bad at that in general :/
- CKN23-ARIN 7y ago
  Archive of the discussion: https://archive.is/hSB6d https://archive.is/hSB6d > We are uncomfortable continually supporting a 1900+ line patch which upstream hasn't signed off on that has the potential to both compromise OpenSSH security and Keychain security. From 10.11 it will also be impossible to edit plists in /System/* without disabling rootless, which isn't a configuration we'll be intentionally supporting.
_-___________-_ 7y ago
I prefer ssh-agent anyway, but yeah, I think they did remove the keychain integration patch.

Doctor_Fegg 7y ago

Oh god no. Homebrew managing openssh has been the cause of more command-line instability and forced reinstalls than anything else I’ve encountered in the last few years of OS X (sorry, macOS). I’ve started installing stuff from source again just to prevent a cascade of Homebrew upgrades breaking everything.

_-___________-_ 7y ago
Never experienced this in a decade or so of using Homebrew's OpenSSH, but you can absolutely use something other than Homebrew to get a more up-to-date and standard OpenSSH install if you prefer.
lloeki 7y ago
> I’ve started installing stuff from source again just to prevent a cascade of Homebrew upgrades breaking everything. Since you crossed that line, do yourself a favour and check out nixpkg.
theonemind 7y ago
I sometimes use NetBSD's pkgsrc on macOS because it installs super cleanly in any prefix you like and never, ever breaks the system. It doesn't have everything, and you will occasionally encounter a package that won't build, but it doesn't even dream of taking over /usr/local or disrupting your system. You could install it into your home directory if you wanted to (which I have done, on systems where I don't have root or enough ownership to just throw things anywhere)
rswail 7y ago
Why don't people use MacPorts instead? I've never had any problems with it. Homebrew wants to screw around in /usr, Macports installs itself in /opt and doesn't interfere with things in the MacOS world. Set your PATH to have /opt/local/{bin,sbin} and everything Just Works.
- saila 7y ago
  What is the practical difference between /usr/local and /opt or /opt/local? I don't think macOS puts anything in /usr/local.