Prelude — Why Bother Compiling in 2025?

Most systems today come with prebuilt OpenSSL libraries — patched, repackaged, and conveniently “secure.” But those who lived through Heartbleed know: blind trust is the first bug.

Sometimes, the best way to trust your encryption… is to forge it yourself.

This guide shows how to compile LibreSSL from source on LMDE 6 (Linux Mint Debian Edition), link it with OpenSSH, and create an internal SSH network independent from vendor binaries.

You decide which compiler to use: GCC or Clang. Because real freedom means choosing your own forge.

🧱 Part I — Building LibreSSL with GCC

1. Preparing the ground

sudo apt update
sudo apt install build-essential git zlib1g-dev libevent-dev

Optionally, remove any preinstalled OpenSSL versions (carefully):

sudo apt remove openssl libssl-dev

2. Cloning LibreSSL

git clone https://github.com/libressl/portable.git
cd portable

3. Configuring for GCC

./autogen.sh
./configure CC=gcc CFLAGS="-O2 -fstack-protector-strong"

GCC is like an old blacksmith — raw, reliable, and pragmatic. It hides nothing from you — not even your mistakes.

4. Compiling and installing

make -j$(nproc)
sudo make install

Your compiled LibreSSL now lives in /usr/local/lib and /usr/local/bin.

Check:

/usr/local/bin/openssl version

Expected output:
LibreSSL 4.x.x

🔗 Linking LibreSSL with OpenSSH

Now, let’s rebuild OpenSSH to link it with your freshly forged library.

cd ~
git clone https://github.com/openssh/openssh-portable.git
cd openssh-portable

Configure with GCC:

./configure \
  --with-ssl-engine \
  --with-ssl-dir=/usr/local \
  CC=gcc \
  CFLAGS="-I/usr/local/include" \
  LDFLAGS="-L/usr/local/lib"

Then build and install:

make -j$(nproc)
sudo make install

Check version:

ssh -V

Expected output:
OpenSSH_9.x, LibreSSL 4.x.x

🧠 Part II — The Clang Path

Some prefer scalpels over hammers. That’s where Clang shines — precise, modern, and surgical when dealing with cryptographic code.

1. Installing dependencies

sudo apt install clang lldb lld

2. Rebuilding LibreSSL with Clang

cd ~/portable
make clean
./configure CC=clang CFLAGS="-O2 -Weverything -Wno-padded"
make -j$(nproc)
sudo make install

Clang doesn’t just compile — it whispers warnings you didn’t ask for, but probably needed.

3. Rebuilding OpenSSH with Clang

cd ~/openssh-portable
make clean
./configure \
  --with-ssl-engine \
  --with-ssl-dir=/usr/local \
  CC=clang \
  CFLAGS="-I/usr/local/include" \
  LDFLAGS="-L/usr/local/lib"
make -j$(nproc)
sudo make install

Check version:

ssh -V

Expected output:
OpenSSH_9.x, LibreSSL 4.x.x (compiled with Clang)

🛠️ Testing Internal SSH Connections

Now for the elegant part — connecting your internal machines with your own compiled crypto stack:

ssh user@192.168.1.101

If it connects without errors, you’ve just created an independent cryptographic chain within your own LAN — no vendor patches, no binary trust.

You are now your own certificate authority.

🕯️ Epilogue — Between Hammer and Scalpel

“GCC builds like a forge.
Clang builds like a ritual.
The difference isn’t performance — it’s philosophy.”

Whether you wield GCC’s blunt honesty or Clang’s surgical precision, the principle remains:

Security begins when you understand what you compile.

🧠 LuxBSD — where lucidity is still allowed.