2

Ubuntu 18.04.3 LTS (bionic) have OpenSSH server version 7.6p1 but that release is 2 years old by now. On my local Arch Linux machine I'm running 8.0p1 but Ubuntu naturally have slower pace.

The network analysis tool we use suggests upgrading the OpenSSH server to a newer version since it finds a few medium threats when testing the server. Since we are on the latest LTS release of Ubuntu we should be in the same situation as a huge portion of the servers on the Internet. How would you handle a situation like this? And from where would you install the update?

I have not been able to find a PPA for it, and that is maybe not the best source for critical components like this one.

The Ubuntu server I want to install version 8.0p1 on is a remote machine that I do not want to become locked out from so I want to experiment as little as possible.

1
  • Please provide feedback when downvoting to help me assess which part of the question you would want me to clarify. Thanks!
    – tirithen
    Commented Oct 1, 2019 at 13:53

2 Answers 2

2

To upgrade openssh from 7.6 to 8.0 on Ubuntu 18.04 (bionic), I followed the instructions given here.

The version I started with:

$ ssh -V
OpenSSH_7.6p1 Ubuntu-4ubuntu0.3, OpenSSL 1.0.2n  7 Dec 2017

Here are the commands to upgrade:

sudo apt update
sudo apt install build-essential zlib1g-dev libssl-dev
sudo mkdir /var/lib/sshd
sudo chmod -R 700 /var/lib/sshd/
sudo chown -R root:sys /var/lib/sshd/
wget -c https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-8.0p1.tar.gz
tar -xzf openssh-8.0p1.tar.gz
cd openssh-8.0p1/
sudo apt install libpam0g-dev libselinux1-dev
./configure --with-md5-passwords --with-pam --with-selinux --with-privsep-path=/var/lib/sshd/ --sysconfdir=/etc/ssh
make
sudo make install

Then opened a new terminal and ran:

$ ssh -V
OpenSSH_8.0p1, OpenSSL 1.1.1  11 Sep 2018
2
  • These seemed to work and when I do ssh -V I now see version 8, but when I do sshd -V it still shows version 7.6.
    – arnoldbird
    Commented Mar 17, 2021 at 1:46
  • Complete answer. Detailed and helpful. Thanks. Commented Jun 16, 2022 at 15:18
1

How would you handle a situation like this? And from where would you install the update?

Supported Ubuntu LTS versions provide relevant security fixes to older versions, usually backported to the version shipped in the release. In case a vulnerability is fixed, installing the updated version from Ubuntu's repository is sufficient.

For any specific issue you can check the package changelog or general security notices. How long each Ubuntu release is supported is described on Ubuntu Releases page.

2
  • I don't understand this answer. Does this mean it's OK to run OpenSSH 7.6 in Ubuntu 18? That it is somehow as secure as OpenSSH 8?
    – arnoldbird
    Commented Mar 17, 2021 at 14:07
  • This is not that helpful as openssh7.x when used with aadsshlogin is not compatible with openssh v9.x clients. This is down to its use of certificates, and will affect other cert based auths as well no doubt. Therefore you have to upgrade openssh 7.x to > openssh 8.x, preferably 9.x. This is not an option with ubuntu 18.04 LTS and native packages unless you create your own
    – krad
    Commented Aug 17, 2023 at 9:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .