OpenSSH

Notes taken while reading OpenSSH, the SSH implementation that ships with essentially every Unix system. These are not upstream documentation. They are the orientation I wanted when I first opened the tree: what the moving parts are, which file owns which phase of a connection, and why the code is shaped the way it is.

The focus is the connection lifecycle — everything from the first plaintext banner to a running shell, with client authentication covered in depth.

At a glance


Language	C
Upstream	https://github.com/openssh/openssh-portable
Version	OpenSSH 10.5p1 — the release with the `sshd` / `sshd-session` / `sshd-auth` split
Pinned at	`8e96478` — every line number on these pages links to that commit
License	BSD-style; see `LICENCE` in the tree

Reading the tree

git clone https://github.com/openssh/openssh-portable
cd openssh-portable
./configure && make -j"$(nproc)"

Then run the client against itself with full verbosity — the trace is the best index into the source there is, because nearly every debug() string is greppable verbatim:

ssh -vvv localhost

Where to go next

Roughly in order of altitude — types, then flows, then one file in detail.

Core types — the six structs the codebase is built from: ssh, sshbuf, sshkey, kex, Authctxt and Channel. What each holds, who owns it, and the conventions that come with them.
Connection workflows — the four phases every connection goes through, the client’s call chain, and the server’s three-binary privilege-separated process model.
Client authentication — the six methods OpenSSH supports, what keyboard-interactive is actually for, and how AuthenticationMethods composes them into multi-factor.
Reading sshconnect2.c — a guided tour of the 2,500-line file that drives key exchange and user authentication on the client side, including the dispatch-table idiom that makes the whole thing readable.
Server-side authentication — the same protocol from the other end: two processes, one privileged and one not, and the boundary between them that decides who gets in.