Compile and install
libconfig. For Debian this is contained in package
libconfig8-dev. You can compile with or without it using USELIBCONFIG in the Makefile.
libwrap. For Debian, this is contained in packages
libwrap0-dev. You can compile with or without it using USELIBWRAP in the Makefile.
libsystemd, in package
libsystemd-dev. You can compile with or without it using USESYSTEMD in the Makefile.
libcap, in package
libcap-dev. You can compile with or without it using USELIBCAP in the Makefile
libbsd, to enable to change the process name (as shown in
ps, so each forked process shows what protocol and what connection it is serving), which requires
libbsdat runtime, and
For OpenSUSE, these are contained in packages libconfig9 and libconfig-dev in repository http://download.opensuse.org/repositories/multimedia:/libs/openSUSE_12.1/
For Fedora, you’ll need packages
yum install libconfig libconfig-devel
If you want to rebuild
sslh-conf.c (after a
distclean for example), you will also need to add
(v1.5) to your path.
After this, the Makefile should work:
There are a couple of configuration options at the beginning of the Makefile:
USELIBWRAPcompiles support for host access control (see
hosts_access(3)), you will need
libwrapheaders and library to compile (
USELIBCONFIGcompiles support for the configuration file. You will need
libconfigheaders to compile (
USESYSTEMDcompiles support for using systemd socket activation. You will need
systemdheaders to compile (
USELIBBSDcompiles support for updating the process name (as shown by
The Makefile produces two different executables:
sslh-forkforks a new process for each incoming connection. It is well-tested and very reliable, but incurs the overhead of many processes.
If you are going to use
sslhfor a “small” setup (less than a dozen ssh connections and a low-traffic https server) then
sslh-forkis probably more suited for you.
sslh-selectuses only one thread, which monitors all connections at once. It is more recent and less tested, but only incurs a 16 byte overhead per connection. Also, if it stops, you’ll lose all connections, which means you can’t upgrade it remotely.
If you are going to use
sslhon a “medium” setup (a few thousand ssh connections, and another few thousand ssl connections),
sslh-selectwill be better.
If you have a very large site (tens of thousands of connections), you’ll need a vapourware version that would use libevent or something like that.
make cp sslh-fork /usr/local/sbin/sslh cp basic.cfg /etc/sslh.cfg vi /etc/sslh.cfg
cp scripts/etc.init.d.sslh /etc/init.d/sslh
cp scripts/etc.rc.d.init.d.sslh.centos /etc/rc.d/init.d/sslh
You might need to create links in /etc/rc
update-rc.d sslh defaults