1

We have an Ubuntu server running 16.04, which is used for a client website. The client has recently had a security audit done and one of the recommendations has been to update our OpenSSH version to at least version 7.4, but 16.04 comes pre-installed with 7.2. I tried to just do a straight update but 7.2 is the latest release available, so we are now trying to install 7.6 manually.

I have downloaded and installed 7.6 ok, and it seems to be running fine:

sshd 
OpenSSH_7.6p1, OpenSSL 1.0.2g  1 Mar 2016

However when connecting remotely or even just running ssh -v localhost it connects using the old 7.2:

root@server-new:~# ssh -v localhost
...
debug1: Local version string SSH-2.0-OpenSSH_7.6
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.2p2 
Ubuntu-4ubuntu2.2
debug1: match: OpenSSH_7.2p2 Ubuntu-4ubuntu2.2 pat OpenSSH* compat 0x04000000
...

This is basically the process I have gone through, except with 7.6 package: https://gist.github.com/techgaun/df66d37379df37838482c4c3470bc48e

What I have noticed is that the install directory is different now, it was /usr/sbin/ssh but it's now /usr/local/sbin/ssh

root@server-new:~# which sshd
/usr/local/sbin/sshd
root@server-new:~# which ssh
/usr/local/bin/ssh

I did update both /etc/init.d/ssh and /etc/init/ssh.conf to use the new path, but even after a restart it doesn't seem to make much difference.

What are we doing wrong? I assume we just need to specify to use the SSH install on startup but I can't see how.

I've found a bunch of other threads around but nothing seems to help, e.g.

https://serverfault.com/questions/310384/problem-with-upgrading-openssh-to-the-latest-version

Update OpenSSH Server in 12.04?

https://forums.cpanel.net/threads/whats-it-take-to-update-to-openssh-5-1-or-higher.170818/

Thanks

1
  • 1
    I would advise your client to switch to a host who knows what they are doing...
    – fkraiem
    Oct 20 '17 at 4:36
4

This is the classic I-want-LTS-but-I-don't-want-LTS logic trap.

One purpose of an Ubuntu LTS is to provide you stability. Ubuntu does that by not incrementing software versions. When you decide to use an LTS, you are locking yourself into those versions without changes for two years.

(If that's not what you want, then don't use an LTS.)

BUT there's one tiny exception: Security updates. The Ubuntu Security Team issues security updates without bumping to the next upstream release (which would violate LTS, of course). Instead, they patch the source code.

So when a vulnerability in OpenSSH 7.2 is discovered, two things happen:

  1. The OpenSSH website announces that everyone should immediately upgrade to new OpenSSH 7.3

  2. However, the Ubuntu Security Team pushes OpenSSH 7.2p2-4ubuntu2.2 to you.

From a security perspective, they are identical - all the same vulnerabilities are closed in both. Your security auditor just doesn't realize it.

You have three choices:

  1. Stick with LTS: You can realize that the auditor is merely misinformed, do a bit of research on the Ubuntu Security Team, and ultimately do nothing...because no additional security action is actually necessary.

  2. Follow the Auditor: You can jump off LTS to the normal 6-month releases of Ubuntu. This may mean a lot of extra work every six months if a release-upgrade changes your workflow or production systems.

  3. Build a Frankensystem: It's the worst of both worlds, riskier, and harder to maintain. You can try to install newer versions of OpenSSH from PPAs or newer releases of Ubuntu onto your older LTS. Might break your system, might not. Might break future upgrades and security updates, might not.

4
  • That's interesting about the OpenSSH patches - I didn't realise they worked in that way. Are you saying that even though we are effectively 3 releases behind (7.3, 7.4, 7.5) there would actually be no vulnerabilities as we are on 7.2p2?
    – Onfire
    Oct 20 '17 at 3:01
  • Correct. It would be foolish to let an LTS be vulnerable, so we don't - it's meant for enterprise production use, after all. Lots of details on each vuln are on the Ubuntu Security Team wiki. Feel free to bounce OpenSSH's list of vulns against Ubuntu's list of patches.
    – user535733
    Oct 20 '17 at 3:07
  • Yep that does make sense. If we must push forward with this regardless, do you know how we can force 7.6 to load?
    – Onfire
    Oct 20 '17 at 3:19
  • Uninstall the Ubuntu package, install your 7.6 from wherever. Resolve dependency version conflicts. Rinse and repeat.
    – user535733
    Oct 20 '17 at 11:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.