1

I have a Red Hat Enterprise Linux server (7.5 x86_64). I have OpenSSH version 7.4. I was asked to upgrade it to a later version for security reasons: Nessus states that OpenSSH should be ugraded from 7.4 to 7.6 or later. However the Red Hat software and downloads does not have the latest package RPM.

I found some clues on where to get the latest package for OpenSSH. I found this link, however, I do not know on how to upgrade it and trust this website. I do not want the SSH and other configuration to be modified by the ugrade.

I did find links but however they are not useful, for example this one.

I would like to know how to upgrade OpenSSH without using yum.

  • 4
    Were you given specific reasons for the upgrade? If it’s about security, the OpenSSH 7.4p1-16 package is fully patched. – Stephen Kitt Dec 5 '18 at 14:26
  • It is about security. Nessus states that openssh should be greater than 7.4 such as 7.6. Here is the link, tenable.com/plugins/nessus/103781 – Abdullah Naina Dec 5 '18 at 14:28
  • 1
    RedHat will backport relevant security patches to the versions they ship. For this issue, a fix was released in April: access.redhat.com/security/cve/cve-2017-15906 – Ulrich Schwarz Dec 5 '18 at 14:37
  • 1
    If there is no available package from RHEL you are best off, imo, building the version you want from source code. Only you can decide if it is worth the effort to do so vs accepting the packages in RHEL repos – Panther Dec 5 '18 at 16:02
  • 1
    @AbdullahNaina I would build it from sources and put it somewhere else instead of messing with the distro's files (eg. build it with ./config --prefix=/some/path/elsewhere; make install and then point apps that need the new version there via LD_LIBRARY_PATH=/some/path/elsewhere). – mosvy Dec 5 '18 at 19:30
8

RHEL 7 ships OpenSSH 7.4p1 with any patches necessary to fix security issues. RHEL 7 is fully supported until 2024 (and longer with extended support contracts).

This means that all known vulnerabilities in your version of OpenSSH are fixed, and newly-discovered vulnerabilities which are discovered in the future will be fixed — there’s no need to upgrade to the latest version of OpenSSH to avoid vulnerabilities.

That’s one of the points of using a supported distribution: you can rely on your distributor to take care of upstream vulnerabilities for you (as long as you keep your systems up-to-date).

To upgrade to a version of OpenSSH later than 7.4 you’d have to upgrade to RHEL 8 (which is currently in beta and has OpenSSH 7.8), or build it yourself for RHEL 7 (and take on support for future vulnerabilities).

  • The greater point here is that the easier part is having the tools. You have to use your grey matter to process, filter and validate the extra information they provide you with. Asking someone else is just the easy way out. – Rui F Ribeiro Dec 5 '18 at 15:04
0

The upgrade didn't work though.

It still says:

Weak SSH Key Exchange Algorithms Supported
diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1

Weak SSH Encryption Algorithms Supported
3des-cbc, blowfish-cbc, cast128-cbc

Weak SSH Hashing Algorithms Supported
hmac-sha1, hmac-sha1-etm@openssh.com, umac-64-etm@openssh.com

Remote Access Service Detected.

Only solution I've found yet is to block the port, but that's annoying as I have to unblock it to use the SSH.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.