ssh-n950

ssh with new hostkeyalgorithms. 

A modern SSH client for MeeGo Harmattan, cross-compiled with the MADDE SDK and statically linked against OpenSSL 1.1.1w. Supports ED25519 and rsa-sha2-256/512 — unlike the system client (OpenSSH ~5.x), which fails against modern servers with no matching host key type.

Step 1 — Copy OpenSSL from the device

Copy the static archives and headers from wunderw onto the build host. (The -oHostKeyAlgorithms=+ssh-rsa option is required because the device's server-side sshd is old — as long as the new client is not yet installed.)

bash

mkdir -p ~/wunderw-ssl/lib ~/wunderw-ssl/include

scp -oHostKeyAlgorithms=+ssh-rsa user@DEVICE_IP:/opt/wunderw/lib/libcrypto.a ~/wunderw-ssl/lib/
scp -oHostKeyAlgorithms=+ssh-rsa user@DEVICE_IP:/opt/wunderw/lib/libssl.a    ~/wunderw-ssl/lib/
scp -oHostKeyAlgorithms=+ssh-rsa -r user@DEVICE_IP:/opt/wunderw/include/openssl ~/wunderw-ssl/include/

Step 2 — Verify ABI compatibility (recommended)

Before starting the full OpenSSH build, it is worth a minimal test of whether GCC 4.4 links against the OpenSSL at all (which was built with a newer toolchain). An ABI mismatch would show up here immediately.

bash

export MADDE_ROOT=/home/USER/QtSDK/Madde
export TOOLCHAIN=$MADDE_ROOT/toolchains/arm-2009q3-67-arm-none-linux-gnueabi-x86_64-unknown-linux-gnu/arm-2009q3-67
export SYSROOT=$MADDE_ROOT/sysroots/harmattan_sysroot_10.2011.34-1_slim
export PATH=$TOOLCHAIN/bin:$PATH

cat > /tmp/ssltest.c << 'EOF'
#include <openssl/opensslv.h>
#include <openssl/evp.h>
#include <stdio.h>
int main(void) {
    printf("OpenSSL: %s\n", OPENSSL_VERSION_TEXT);
    EVP_MD_CTX *c = EVP_MD_CTX_new();
    EVP_MD_CTX_free(c);
    return 0;
}
EOF

arm-none-linux-gnueabi-gcc -std=c99 --sysroot=$SYSROOT \
    -I ~/wunderw-ssl/include \
    /tmp/ssltest.c ~/wunderw-ssl/lib/libcrypto.a \
    -lpthread -ldl \
    -o /tmp/ssltest
echo "Exit: $?"

Expected result: Exit: 0. The warnings about getcontext/setcontext (not implemented and will always fail) are harmless — they concern an optional OpenSSL async feature that the old Harmattan glibc lacks and that SSH does not use. -lpthread -ldl are required because wunderw's OpenSSL was built with thread support.

Step 3 — Cross-compile OpenSSH

Download OpenSSH 7.9p1 and build it with the build script (below):

bash

wget https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-7.9p1.tar.gz
tar xzf openssh-7.9p1.tar.gz
cd openssh-7.9p1

# place build_ssh_n950.sh (see below) here, then:
bash build_ssh_n950.sh 2>&1 | tee build.log

Key cross-compile details

These points were the actual stumbling blocks — they are already solved in the build script, explained here for reference:

1. The preprocessor needs the sysroot. OpenSSH's configure invokes the preprocessor in isolation (sanity check), before CFLAGS take effect. Without --sysroot in the CPP variable itself, it cannot find the system headers. Symptom: C preprocessor ... fails sanity check.
2. GCC #include_next chain. GCC's own include-fixed/limits.h pulls in the system limits.h from the sysroot via #include_next. This path must be added explicitly with -isystem $SYSROOT/usr/include, otherwise the chain breaks with fatal error: limits.h: No such file or directory.
3. Cross-compile cache overrides. configure determines some properties by running test programs — impossible when cross-compiling (ARM binary on an x86 host). The answers are supplied via ac_cv_* variables.
4. -lpthread -ldl in LIBS, see Step 2.

Step 4 — Install and test

After the build, ssh-n950 (stripped) is available. Copy it to the device:

bash

scp -oHostKeyAlgorithms=+ssh-rsa ssh-n950 user@DEVICE_IP:/home/user/MyDocs/Downloads/

Test on the device:

bash

chmod +x ssh-n950
./ssh-n950 -V
# -> OpenSSH_7.9p1, OpenSSL 1.1.1w  11 Sep 2023

# force an ED25519 handshake against a modern server:
./ssh-n950 -o HostKeyAlgorithms=ssh-ed25519 user@MODERN_SERVER

If a password prompt appears instead of no matching host key type, the client works.

build_ssh_n950.sh

bash

#!/bin/bash
# Cross-compile OpenSSH 7.9p1 SSH client for Nokia N950 (Harmattan, armel)
# with MADDE, statically linked against wunderw's OpenSSL 1.1.1w.
set -e

# --- MADDE environment (adjust USER) ---
export MADDE_ROOT=/home/USER/QtSDK/Madde
export TOOLCHAIN=$MADDE_ROOT/toolchains/arm-2009q3-67-arm-none-linux-gnueabi-x86_64-unknown-linux-gnu/arm-2009q3-67
export SYSROOT=$MADDE_ROOT/sysroots/harmattan_sysroot_10.2011.34-1_slim
export PATH=$TOOLCHAIN/bin:$PATH

SSL=$HOME/wunderw-ssl

export CC=arm-none-linux-gnueabi-gcc
export CPP="arm-none-linux-gnueabi-gcc -E --sysroot=$SYSROOT -isystem $SYSROOT/usr/include"
export CPPFLAGS="--sysroot=$SYSROOT -I$SSL/include"
export CFLAGS="-O2 -std=gnu99 -march=armv7-a -mtune=cortex-a8 --sysroot=$SYSROOT -I$SSL/include"
export LDFLAGS="--sysroot=$SYSROOT -L$SSL/lib"
export LIBS="-lpthread -ldl"

# Cross-compile cache overrides (configure cannot run test programs)
CACHE=(
  ac_cv_func_getpgrp_void=yes
  ac_cv_func_setpgrp_void=yes
  ac_cv_have_dev_ptmx=yes
  ac_cv_have_dev_pts_and_ptc=no
  ac_cv_func_arc4random=no
  ac_cv_search_EVP_EncryptInit=-lcrypto
)

rm -f config.cache config.status

./configure \
    --host=arm-none-linux-gnueabi \
    --build=x86_64-unknown-linux-gnu \
    --with-ssl-dir=$SSL \
    --without-pam \
    --without-selinux \
    --without-zlib-version-check \
    --disable-strip \
    "${CACHE[@]}"

# Build only the client (not sshd/scp/sftp)
make ssh

# Strip for a smaller binary
arm-none-linux-gnueabi-strip -s ssh -o ssh-n950
ls -lh ssh-n950
file ssh-n950

Verifying the finished binary

bash

file ssh-n950
# ELF 32-bit LSB, ARM EABI5, dynamically linked, stripped

# OpenSSL is STATICALLY compiled in — libcrypto/libssl do NOT appear:
readelf -d ssh-n950 | grep NEEDED
# only system libs: librt, libutil, libz, libpthread, libdl,
# libcrypt, libresolv, libgcc_s, libc

The absence of libcrypto.so/libssl.so in the NEEDED list confirms the static OpenSSL link: the binary is crypto self-contained and does not require wunderw at runtime.