<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML+RDFa 1.0//EN" "http://www.w3.org/MarkUp/DTD/xhtml-rdfa-1.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
    xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
    xmlns:owl="http://www.w3.org/2002/07/owl#"
    xmlns:rdfs="http://www.w3.org/2000/01/rdf-schema#"
    xmlns:dc="http://purl.org/dc/terms/"
    xmlns:xsd="http://www.w3.org/2001/XMLSchema"
    xmlns:spdx="http://spdx.org/rdf/terms#">

  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
    <link rel="shortcut icon" href="sites/all/themes/cpstandard/favicon.ico" type="image/vnd.microsoft.icon" />

    <title>SSH OpenSSH license | Software Package Data Exchange (SPDX)</title>

    <link rel="shortcut icon" href="sites/all/themes/cpstandard/favicon.ico" type="image/vnd.microsoft.icon" />
    <link type="text/css" rel="stylesheet" media="all" href="sites/all/themes/cpstandard/css/style.css" />
    <link type="text/css" rel="stylesheet" media="all" href="sites/all/themes/cpstandard/css/colors.css" />
    <link href="//netdna.bootstrapcdn.com/font-awesome/4.0.3/css/font-awesome.css" rel="stylesheet" />
    <!-- GOOGLE FONTS -->
    <link href='//fonts.googleapis.com/css?family=Roboto:400,400italic,300,300italic,100italic,100,500,500italic,700,700italic,900,900italic' rel='stylesheet' type='text/css' />

    <style type="text/css">

      .page {
        color: #58595b;
      }

      #header {
        border-bottom: 3px solid #4597cb;
        padding-bottom: 50px;
      }

      .breadcrumb {
        margin-top: 25px;
      }

      #content-header h1 {
        color: #58595b;
      }

      .page h2, h3, h4, h5 {
        color: #00416b;
      }

      .page h1 {
      font-size: 2em;
      }

      .page h2 {
      font-size: 1.5em;
      }

      a, a:visited, a:hover {
        color: #00416b;
      }

      #footer-copyright {
        margin-top: 25px;
      }

      .replaceable-license-text {
      color: #CC0000;
      }

      .replaceable-license-text p var {
      color: #CC0000;
      }

      .optional-license-text {
      color: #0000cc;
      }

      .optional-license-text p var {
      color: #0000cc;
      }
      ul, ol, li {
      margin: 10px 0 10px 0;
	  }
    </style>

  <script type="text/javascript">

    var _gaq = _gaq || [];
    _gaq.push(['_setAccount', 'UA-3676394-2']);
    _gaq.push(['_trackPageview']);

    (function() {
      var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true;
      ga.src = ('https:' == document.location.protocol ? 'https://ssl' : 'http://www') + '.google-analytics.com/ga.js';
      var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s);
    })();

  </script>

  </head>

  <body typeof="spdx:License">

  <div id="lf-header" class="collaborative-projects">
    <div class="gray-diagonal">
      <div class="container">
        <a id="collaborative-projects-logo" href="http://collabprojects.linuxfoundation.org">Linux Foundation Collaborative Projects</a>
      </div>
    </div>
  </div>

  <div id="header">
    <div id="header-inner">
      <a href="/" title="Home" rel="home" id="logo">
        <img src="https://spdx.org/sites/cpstandard/files/logo_spdx_250.png" alt="Home" />
      </a>

      <div id="name-and-slogan">
        <div id="site-name">
          <h1><a href="/" title="Home" rel="home">Software Package Data Exchange (SPDX)</a></h1>
        </div>
      </div>

    </div>
  </div> <!-- /header -->

  <div id="highlighted">
      <div class="region region-highlighted">
      </div>
  </div>

    <div id="page" class="page">

      <div class="breadcrumb"><a href="/">Home</a> » <a href="/licenses">Licenses</a></div>

      <h1 property="dc:title">SSH OpenSSH license</h1>
      <div style="display:none;"><code property="spdx:deprecated">false</code></div>
      <h2>Full name</h2>
          <p style="margin-left: 20px;"><code property="spdx:name">SSH OpenSSH license</code></p>

      <h2>Short identifier</h2>
          <p style="margin-left: 20px;"><code property="spdx:licenseId">SSH-OpenSSH</code></p>

      <h2>Other web pages for this license</h2>
          <div style="margin-left: 20px;">
            <ul>
             <li>
               <a href="https://github.com/openssh/openssh-portable/blob/1b11ea7c58cd5c59838b5fa574cd456d6047b2d4/LICENCE#L10" rel="rdfs:seeAlso" isValid=true isLive=true isWayBackLink=false match=false timestamp=2025-07-01T14:59:59Z>https://github.com/openssh/openssh-portable/blob/1b11ea7c58cd5c59838b5fa574cd456d6047b2d4/LICENCE#L10</a>
               <!--Tentative way of displaying information <p>isValid: true, isLive: true, isWayBackLink: false, match: false, timestamp: 2025-07-01T14:59:59Z</p> -->
             </li>
           </ul>
          </div>

      <div property="spdx:isOsiApproved" style="display: none;">false</div>

      <h2 id="notes">Notes</h2>
          <p style="margin-left: 20px;">This a longer version of SSH-short which includes various comments from the OpenSSH developers.</p>

      <h2 id="licenseText">Text</h2>
      
      <blockquote cite="https://spdx.github.io/spdx-spec/v2.3/license-matching-guidelines-and-templates/">
          <div style="border: 2px solid grey; padding: 8px">
		      Text in italicized blue is omittable (see <a href="https://spdx.github.io/spdx-spec/v2.3/license-matching-guidelines-and-templates/#b35-guideline-omittable-text">Matching Guidelines B.3.5</a>).
		      License or exception text will match to the text for the specified identifier if it either includes or excludes this omittable text.
			  <br/>
			  <br/>
			  Text in red is replaceable (see <a href="https://spdx.github.io/spdx-spec/v2.3/license-matching-guidelines-and-templates/#b34-guideline-replaceable-text">Matching Guidelines B.3.4</a>).
			  License or exception text will match to the text for the specified identifier if it includes a permitted variant of this replaceable text.
			  The permitted variants can be found in the corresponding regular expression as shown in title text visible by hovering over the red text.
	      </div>
	  </blockquote>

      <div property="spdx:licenseText" class="license-text">
      
        <var class="replaceable-license-text"><span title="can be replaced with the pattern .{0,5000}"> 
            Copyright (c) 1995 Tatu Ylonen &lt;ylo@cs.hut.fi&gt;, Espoo, Finland
                               All rights reserved
        </span></var>

        <p>As far as I am concerned, the code I have written for this software
        can be used freely for any purpose.  Any derived versions of this
        software must be clearly marked as such, and if the derived work is
        incompatible with the protocol description in the RFC file, it must be
        called by a name other than &quot;ssh&quot; or &quot;Secure Shell&quot;.</p>

        <p>[Tatu continues]</p>

        <p>However, I am not implying to give any licenses to any patents or
        copyrights held by third parties, and the software includes parts that
        are not under my direct control.  As far as I know, all included
        source code is used in accordance with the relevant license agreements
        and can be used freely for any purpose (the GNU license being the most
        restrictive); see below for details.</p>

        <p>[However, none of that term is relevant at this point in time.  All of
        these restrictively licenced software components which he talks about
        have been removed from OpenSSH, i.e.,</p>

<ul style="list-style:none">
            
<li><var class="replaceable-license-text"><span title="can be replaced with the pattern .{0,20}"> -</span></var> RSA is no longer included, found in the OpenSSL library</li>
            
<li><var class="replaceable-license-text"><span title="can be replaced with the pattern .{0,20}"> -</span></var> IDEA is no longer included, its use is deprecated</li>
            
<li><var class="replaceable-license-text"><span title="can be replaced with the pattern .{0,20}"> -</span></var> DES is now external, in the OpenSSL library</li>
            
<li><var class="replaceable-license-text"><span title="can be replaced with the pattern .{0,20}"> -</span></var> GMP is no longer used, and instead we call BN code from OpenSSL</li>
            
<li><var class="replaceable-license-text"><span title="can be replaced with the pattern .{0,20}"> -</span></var> Zlib is now external, in a library</li>
            
<li><var class="replaceable-license-text"><span title="can be replaced with the pattern .{0,20}"> -</span></var> The make-ssh-known-hosts script is no longer included</li>
            
<li><var class="replaceable-license-text"><span title="can be replaced with the pattern .{0,20}"> -</span></var> TSS has been removed</li>
            
<li><var class="replaceable-license-text"><span title="can be replaced with the pattern .{0,20}"> -</span></var> MD5 is now external, in the OpenSSL library</li>
            
<li><var class="replaceable-license-text"><span title="can be replaced with the pattern .{0,20}"> -</span></var> RC4 support has been replaced with ARC4 support from OpenSSL</li>
            
<li><var class="replaceable-license-text"><span title="can be replaced with the pattern .{0,20}"> -</span></var> Blowfish is now external, in the OpenSSL library</li>
        
</ul>

    <p>[The licence continues]</p>

    <p>Note that any information and cryptographic algorithms used in this
    software are publicly available on the Internet and at any major
    bookstore, scientific library, and patent office worldwide.  More
    information can be found e.g. at &quot;http://www.cs.hut.fi/crypto&quot;.</p>

    <p>The legal status of this program is some combination of all these
    permissions and restrictions.  Use only at your own responsibility.
    You will be responsible for any legal consequences yourself; I am not
    making any claims whether possessing or using this is legal or not in
    your country, and I am not taking any responsibility on your behalf.</p>

	<p>NO WARRANTY</p>

    <p>BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
    FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
    OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
    PROVIDE THE PROGRAM &quot;AS IS&quot; WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
    OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
    MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
    TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
    PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
    REPAIR OR CORRECTION.</p>

    <p>IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
    WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
    REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
    INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
    OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
    TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
    YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
    PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
    POSSIBILITY OF SUCH DAMAGES.</p>

    
      </div>

      <h2  id="licenseHeader">Standard License Header</h2>
      <div property="spdx:standardLicenseHeader" class="license-text">
        <p style="font-style: italic">There is no standard license header for the license</p>
        
      </div>
      <div property="spdx:standardLicenseTemplate" style="display: none;">
      &lt;&lt;var;name&#61;&quot;copyright&quot;;original&#61;&quot;Copyright (c) 1995 Tatu Ylonen &lt;ylo@cs.hut.fi&gt;, Espoo, Finland All rights reserved&quot;;match&#61;&quot;.{0,5000}&quot;&gt;&gt;&#10;As far as I am concerned, the code I have written for this software can be used freely for any purpose. Any derived versions of this software must be clearly marked as such, and if the derived work is incompatible with the protocol description in the RFC file, it must be called by a name other than &quot;ssh&quot; or &quot;Secure Shell&quot;.&#10;&#10;[Tatu continues]&#10;&#10;However, I am not implying to give any licenses to any patents or copyrights held by third parties, and the software includes parts that are not under my direct control. As far as I know, all included source code is used in accordance with the relevant license agreements and can be used freely for any purpose (the GNU license being the most restrictive); see below for details.&#10;&#10;[However, none of that term is relevant at this point in time. All of these restrictively licenced software components which he talks about have been removed from OpenSSH, i.e.,&#10;&#10;   &lt;&lt;var;name&#61;&quot;bullet&quot;;original&#61;&quot;-&quot;;match&#61;&quot;.{0,20}&quot;&gt;&gt; RSA is no longer included, found in the OpenSSL library&#10;   &lt;&lt;var;name&#61;&quot;bullet&quot;;original&#61;&quot;-&quot;;match&#61;&quot;.{0,20}&quot;&gt;&gt; IDEA is no longer included, its use is deprecated&#10;   &lt;&lt;var;name&#61;&quot;bullet&quot;;original&#61;&quot;-&quot;;match&#61;&quot;.{0,20}&quot;&gt;&gt; DES is now external, in the OpenSSL library&#10;   &lt;&lt;var;name&#61;&quot;bullet&quot;;original&#61;&quot;-&quot;;match&#61;&quot;.{0,20}&quot;&gt;&gt; GMP is no longer used, and instead we call BN code from OpenSSL&#10;   &lt;&lt;var;name&#61;&quot;bullet&quot;;original&#61;&quot;-&quot;;match&#61;&quot;.{0,20}&quot;&gt;&gt; Zlib is now external, in a library&#10;   &lt;&lt;var;name&#61;&quot;bullet&quot;;original&#61;&quot;-&quot;;match&#61;&quot;.{0,20}&quot;&gt;&gt; The make-ssh-known-hosts script is no longer included&#10;   &lt;&lt;var;name&#61;&quot;bullet&quot;;original&#61;&quot;-&quot;;match&#61;&quot;.{0,20}&quot;&gt;&gt; TSS has been removed&#10;   &lt;&lt;var;name&#61;&quot;bullet&quot;;original&#61;&quot;-&quot;;match&#61;&quot;.{0,20}&quot;&gt;&gt; MD5 is now external, in the OpenSSL library&#10;   &lt;&lt;var;name&#61;&quot;bullet&quot;;original&#61;&quot;-&quot;;match&#61;&quot;.{0,20}&quot;&gt;&gt; RC4 support has been replaced with ARC4 support from OpenSSL&#10;   &lt;&lt;var;name&#61;&quot;bullet&quot;;original&#61;&quot;-&quot;;match&#61;&quot;.{0,20}&quot;&gt;&gt; Blowfish is now external, in the OpenSSL library&#10;[The licence continues]&#10;&#10;Note that any information and cryptographic algorithms used in this software are publicly available on the Internet and at any major bookstore, scientific library, and patent office worldwide. More information can be found e.g. at &quot;http://www.cs.hut.fi/crypto&quot;.&#10;&#10;The legal status of this program is some combination of all these permissions and restrictions. Use only at your own responsibility. You will be responsible for any legal consequences yourself; I am not making any claims whether possessing or using this is legal or not in your country, and I am not taking any responsibility on your behalf.&#10;&#10;NO WARRANTY&#10;&#10;BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM &quot;AS IS&quot; WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.&#10;&#10;IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.&#10;&#10;
      </div>

    </div> <!-- /page -->

    <div class="collaborative-projects">
      <div class="gray-diagonal">
        <div class="container">
          <div id="footer-copyright">
            <p>&#169; 2018          SPDX Workgroup a Linux Foundation Project. All Rights Reserved.        </p>
            <p>Linux Foundation is a registered trademark of The Linux Foundation. Linux is a registered <a href="http://www.linuxfoundation.org/programs/legal/trademark" title="Linux Mark Institute">trademark</a> of Linus Torvalds.</p>
            <p>Please see our <a href="http://www.linuxfoundation.org/privacy">privacy policy</a> and <a href="http://www.linuxfoundation.org/terms">terms of use</a>.</p>
          </div>
        </div>
      </div>
    </div>

    <div id="top-page-link">
      <a href="#"><i class="fa fa-arrow-circle-up"></i><span>top of page</span></a>
    </div>

  </body>
</html>
