OpenSSH is built into Linux servers, macOS and Windows, and it protects remote connections across much of the internet. But its history is often reduced to a single name: Theo de Raadt. His contribution was important, yet the project emerged from earlier SSH implementations and the work of several OpenBSD developers who deserve credit for building and extending it.
The key facts about OpenSSH in 30 seconds
- SSH began before OpenSSH. Tatu Ylönen created the original Secure Shell implementation in 1995 to replace insecure remote-login tools such as Telnet.
- OpenSSH started in 1999. OpenBSD developers built it from earlier freely available SSH code, including work by Björn Grönvall.
- Theo de Raadt played an important role. He helped simplify the code and make it easier to review, but he was not the sole creator.
- Several developers shaped the project. Markus Friedl, Niels Provos, Bob Beck, Aaron Campbell and Dug Song made important technical contributions.
- Its influence extends far beyond OpenBSD. Portability work helped bring OpenSSH to Linux and other Unix-like systems, while its development continues to rely on a wider community.
From Tatu Ylönen’s SSH to the OpenSSH project
The story begins in 1995, when Finnish researcher Tatu Ylönen developed Secure Shell (SSH) after a password-sniffing incident on his university network. The protocol was designed to provide encrypted remote access and protect communications that traditional tools such as Telnet and rlogin sent without adequate security.
Ylönen’s original implementation became widely used. However, the licensing and distribution of SSH changed over time, prompting developers who wanted a freely available alternative to look for other options.
One of those developers was Björn Grönvall, who recovered and worked on an earlier freely available SSH release. His OSSH project provided a starting point for the OpenBSD developers who began OpenSSH in 1999.
The OpenSSH project’s own history describes it as a derivative of the original free SSH 1.2.12 release. The OpenBSD team imported and modified the code, reviewed its security, and developed an implementation that could be maintained under the project’s licensing and technical requirements.
OpenSSH’s initial code import took place on 26 September 1999. It shipped with OpenBSD 2.6 on 1 December that year, as OpenSSH 1.2.2.
That chronology matters. OpenSSH was not created from scratch by one person, nor was it simply the work of Theo de Raadt. It grew from Tatu Ylönen’s original implementation, Björn Grönvall’s work on OSSH and the collective effort of OpenBSD developers who adapted, reviewed and extended the code.
What Theo de Raadt and the other developers contributed
Theo de Raadt, OpenBSD’s founder and a central figure in the project, had a meaningful role in OpenSSH’s early development. The project’s official history credits him with removing non-portable code and simplifying the source to make it easier to read and audit.
That work fits OpenBSD’s emphasis on code review and security. A security-sensitive program must do more than encrypt traffic: its implementation also needs to be understandable enough for developers to inspect, test and maintain. Simplifying the code can help reviewers identify mistakes and reduce unnecessary complexity.
But the technical history also names several other contributors.
Markus Friedl played a major role in the protocol implementation. He replaced the SSH 1.3 implementation with support for SSH 1.5 and later worked on SSH protocol version 2 and the Secure File Transfer Protocol (SFTP). His work helped move OpenSSH beyond its earliest implementation and support the protocols that became central to its use.
Niels Provos removed cryptographic and GPL-licensed components during the early development of OpenSSH. He later worked with Friedl on privilege separation, a security technique that isolates parts of a program so that a compromise in one component does not automatically grant access to the entire process. OpenBSD records the first implementation of privilege separation in OpenSSH in March 2002, with its release in OpenBSD 3.2.
Bob Beck contributed Makefile and library changes intended to avoid cryptographic algorithms that were subject to patent restrictions at the time. Aaron Campbell worked on documentation and code issues, while Dug Song addressed authentication problems, including those related to Kerberos IV.
These were not merely supporting roles. OpenSSH’s capabilities and maintainability developed through a sequence of changes involving protocol support, cryptography, authentication, portability and security architecture. The official history offers a more accurate account of that work than a narrative that assigns the entire project to its most famous figure.
How OpenSSH spread beyond OpenBSD
A secure implementation is only useful to a broad audience if it can run on the systems people actually use. From its early days, OpenSSH therefore needed to work beyond OpenBSD.
Damien Miller, Philip Hands and other developers contributed to porting the software to Linux and other Unix-like platforms. The portable version of OpenSSH made it easier for system administrators to use the same core project across different operating systems.
Today, SSH is a standard tool for administering servers, transferring files securely and automating remote operations. It is used in data centres, development environments, cloud infrastructure and countless systems managed from the command line.
OpenSSH’s reach reflects both its technical development and the work needed to maintain it across platforms. The project’s stated goal has long been to make secure remote access available broadly, rather than leave users dependent on insecure alternatives such as Telnet and rlogin.
That widespread adoption can make the software’s origins easy to overlook. Users often encounter OpenSSH as a command already installed on a server or as part of their operating system, without seeing the long history of contributions behind it.
The project’s own records are the best starting point for understanding that history. They distinguish the original SSH implementation, the work on OSSH and the contributions made by the OpenBSD developers who created and maintained OpenSSH. They also show why credit should be distributed according to specific technical work rather than concentrated around a single personality.
OpenSSH’s history also illustrates the importance of distinguishing between a project and the wider software supply chain around it. In 2024, a malicious backdoor was discovered in XZ Utils, a compression library used by some Linux distributions. Under certain conditions, the compromise could affect systems where the library interacted with the SSH server. It was a supply-chain attack involving XZ, not a backdoor originating in OpenSSH itself.
That episode underlined how security can depend on multiple layers of software and on the people who maintain them. OpenSSH’s own development history makes a similar point: a widely trusted security tool is the result of sustained work by many contributors.
Frequently asked questions
Did Theo de Raadt create OpenSSH?
No. Theo de Raadt was an important contributor and helped simplify the early code, but OpenSSH was started in 1999 by OpenBSD developers working from earlier SSH implementations.
Who created the original SSH?
Tatu Ylönen developed the original Secure Shell implementation in 1995. OpenSSH came later and was derived from an earlier freely available SSH release.
What did Björn Grönvall contribute?
Grönvall worked on OSSH, based on an earlier free SSH release. His work formed part of the technical lineage from which OpenSSH emerged.
Which developers made major contributions to OpenSSH?
The official project history credits Markus Friedl, Niels Provos, Bob Beck, Aaron Campbell, Dug Song and Theo de Raadt, among others. Damien Miller, Philip Hands and other developers also helped port OpenSSH to Linux and other Unix-like systems.