1

I have a Red Hat Enterprise Linux server (7.5 x86_64). I have OpenSSH version 7.4. I was asked to upgrade it to a later version for security reasons: Nessus states that OpenSSH should be ugraded from 7.4 to 7.6 or later. However the Red Hat software and downloads does not have the latest package RPM.

I found some clues on where to get the latest package for OpenSSH. I found this link, however, I do not know on how to upgrade it and trust this website. I do not want the SSH and other configuration to be modified by the ugrade.

I did find links but however they are not useful, for example this one.

I would like to know how to upgrade OpenSSH without using yum.

7
  • 4
    Were you given specific reasons for the upgrade? If it’s about security, the OpenSSH 7.4p1-16 package is fully patched. Dec 5, 2018 at 14:26
  • It is about security. Nessus states that openssh should be greater than 7.4 such as 7.6. Here is the link, tenable.com/plugins/nessus/103781 Dec 5, 2018 at 14:28
  • 1
    RedHat will backport relevant security patches to the versions they ship. For this issue, a fix was released in April: access.redhat.com/security/cve/cve-2017-15906 Dec 5, 2018 at 14:37
  • 1
    If there is no available package from RHEL you are best off, imo, building the version you want from source code. Only you can decide if it is worth the effort to do so vs accepting the packages in RHEL repos
    – Panther
    Dec 5, 2018 at 16:02
  • 1
    @AbdullahNaina I would build it from sources and put it somewhere else instead of messing with the distro's files (eg. build it with ./config --prefix=/some/path/elsewhere; make install and then point apps that need the new version there via LD_LIBRARY_PATH=/some/path/elsewhere).
    – user313992
    Dec 5, 2018 at 19:30

3 Answers 3

14

RHEL 7 ships OpenSSH 7.4p1 with any patches necessary to fix security issues. RHEL 7 is fully supported until 2024 (and longer with extended support contracts).

This means that all known vulnerabilities in your version of OpenSSH are fixed, and newly-discovered vulnerabilities which are discovered in the future will be fixed — there’s no need to upgrade to the latest version of OpenSSH to avoid vulnerabilities.

That’s one of the points of using a supported distribution: you can rely on your distributor to take care of upstream vulnerabilities for you (as long as you keep your systems up-to-date).

To upgrade to a version of OpenSSH later than 7.4 you’d have to upgrade to RHEL 8 (which is currently in beta and has OpenSSH 7.8), or build it yourself for RHEL 7 (and take on support for future vulnerabilities).

3
  • The greater point here is that the easier part is having the tools. You have to use your grey matter to process, filter and validate the extra information they provide you with. Asking someone else is just the easy way out. Dec 5, 2018 at 15:04
  • What if you want openssh 7.8 for the features it provides, not for a security bug. One may be reluctant to upgrade the whole VM or reinstall and remake everything when they just want one package updated. There are MANY decently supported repos providing updated versions of php for instance, even apache, for el7. Are there any for openssh? If it were any other package I'd have no objection to winging it installing from source, and rolling it back if it didn't work. But ssh is one thing that will really ruin your day if you brick it, remotely. Aug 2, 2020 at 20:46
  • @BillyC. in such cases I recommend opening a request-for-enhancement ticket; customers explaining why they want new features is one of the main drivers for such changes to packages. It’s not unheard of, for example ssh was bumped from 6.6 to 7.4 in RHEL 7, and so far from 7.8 to 8.0 in RHEL 8. I do suspect however that my colleagues would be more interested in making it simpler for you to upgrade to RHEL 8 than in backporting features from 7.8 to 7.4, or bumping to 7.8 in RHEL 7... Aug 3, 2020 at 7:44
0

The upgrade didn't work though.

It still says:

Weak SSH Key Exchange Algorithms Supported
diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1

Weak SSH Encryption Algorithms Supported
3des-cbc, blowfish-cbc, cast128-cbc

Weak SSH Hashing Algorithms Supported
hmac-sha1, [email protected], [email protected]

Remote Access Service Detected.

Only solution I've found yet is to block the port, but that's annoying as I have to unblock it to use the SSH.

0

You can modify the SSH config file to force it to not use these weak key exchange algorithms, encryption algorithms and hashes. I've come across the same issue with the same results from a Nessus scan.

  • Edit the sshd_config file located here: /etc/ssh/sshd_config, and enter this block of text somewhere in the config file:
    # Ciphers and keying
    # If undefined, the default MACs, ciphers and
    # key exchange algorithms are exploitable
    MACs hmac-sha2-256,hmac-sha2-512
    Ciphers aes128-ctr,aes256-ctr
    KexAlgorithms ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521
    #RekeyLimit default none
    
  • Then you need to restart ssh:
    /bin/systemctl restart sshd.service
    

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .