I have a Red Hat Enterprise Linux server (7.5 x86_64). I have OpenSSH version 7.4. I was asked to upgrade it to a later version for security reasons: Nessus states that OpenSSH should be ugraded from 7.4 to 7.6 or later. However the Red Hat software and downloads does not have the latest package RPM.

I found some clues on where to get the latest package for OpenSSH. I found this link, however, I do not know on how to upgrade it and trust this website. I do not want the SSH and other configuration to be modified by the ugrade.

I did find links but however they are not useful, for example this one.

I would like to know how to upgrade OpenSSH without using yum.

  • 4
    Were you given specific reasons for the upgrade? If it’s about security, the OpenSSH 7.4p1-16 package is fully patched. – Stephen Kitt Dec 5 '18 at 14:26
  • It is about security. Nessus states that openssh should be greater than 7.4 such as 7.6. Here is the link, tenable.com/plugins/nessus/103781 – Abdullah Naina Dec 5 '18 at 14:28
  • 1
    RedHat will backport relevant security patches to the versions they ship. For this issue, a fix was released in April: access.redhat.com/security/cve/cve-2017-15906 – Ulrich Schwarz Dec 5 '18 at 14:37
  • 1
    If there is no available package from RHEL you are best off, imo, building the version you want from source code. Only you can decide if it is worth the effort to do so vs accepting the packages in RHEL repos – Panther Dec 5 '18 at 16:02
  • 1
    @AbdullahNaina I would build it from sources and put it somewhere else instead of messing with the distro's files (eg. build it with ./config --prefix=/some/path/elsewhere; make install and then point apps that need the new version there via LD_LIBRARY_PATH=/some/path/elsewhere). – mosvy Dec 5 '18 at 19:30

RHEL 7 ships OpenSSH 7.4p1 with any patches necessary to fix security issues. RHEL 7 is fully supported until 2024 (and longer with extended support contracts).

This means that all known vulnerabilities in your version of OpenSSH are fixed, and newly-discovered vulnerabilities which are discovered in the future will be fixed — there’s no need to upgrade to the latest version of OpenSSH to avoid vulnerabilities.

That’s one of the points of using a supported distribution: you can rely on your distributor to take care of upstream vulnerabilities for you (as long as you keep your systems up-to-date).

To upgrade to a version of OpenSSH later than 7.4 you’d have to upgrade to RHEL 8 (which is currently in beta and has OpenSSH 7.8), or build it yourself for RHEL 7 (and take on support for future vulnerabilities).

| improve this answer | |
  • The greater point here is that the easier part is having the tools. You have to use your grey matter to process, filter and validate the extra information they provide you with. Asking someone else is just the easy way out. – Rui F Ribeiro Dec 5 '18 at 15:04
  • What if you want openssh 7.8 for the features it provides, not for a security bug. One may be reluctant to upgrade the whole VM or reinstall and remake everything when they just want one package updated. There are MANY decently supported repos providing updated versions of php for instance, even apache, for el7. Are there any for openssh? If it were any other package I'd have no objection to winging it installing from source, and rolling it back if it didn't work. But ssh is one thing that will really ruin your day if you brick it, remotely. – Billy C. Aug 2 at 20:46
  • @BillyC. in such cases I recommend opening a request-for-enhancement ticket; customers explaining why they want new features is one of the main drivers for such changes to packages. It’s not unheard of, for example ssh was bumped from 6.6 to 7.4 in RHEL 7, and so far from 7.8 to 8.0 in RHEL 8. I do suspect however that my colleagues would be more interested in making it simpler for you to upgrade to RHEL 8 than in backporting features from 7.8 to 7.4, or bumping to 7.8 in RHEL 7... – Stephen Kitt Aug 3 at 7:44

The upgrade didn't work though.

It still says:

Weak SSH Key Exchange Algorithms Supported

Weak SSH Encryption Algorithms Supported
3des-cbc, blowfish-cbc, cast128-cbc

Weak SSH Hashing Algorithms Supported
hmac-sha1, hmac-sha1-etm@openssh.com, umac-64-etm@openssh.com

Remote Access Service Detected.

Only solution I've found yet is to block the port, but that's annoying as I have to unblock it to use the SSH.

| improve this answer | |

You can modify the SSH config file to force it to not use these weak key exchange algorithms, encryption algorithms and hashes. I've come across the same issue with the same results from a Nessus scan.

  • Edit the sshd_config file located here: /etc/ssh/sshd_config, and enter this block of text somewhere in the config file:
    # Ciphers and keying
    # If undefined, the default MACs, ciphers and
    # key exchange algorithms are exploitable
    MACs hmac-sha2-256,hmac-sha2-512
    Ciphers aes128-ctr,aes256-ctr
    KexAlgorithms ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521
    #RekeyLimit default none
  • Then you need to restart ssh:
    /bin/systemctl restart sshd.service
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.