We have an Ubuntu server running 16.04, which is used for a client website. The client has recently had a security audit done and one of the recommendations has been to update our OpenSSH version to at least version 7.4, but 16.04 comes pre-installed with 7.2. I tried to just do a straight update but 7.2 is the latest release available, so we are now trying to install 7.6 manually.
I have downloaded and installed 7.6 ok, and it seems to be running fine:
sshd OpenSSH_7.6p1, OpenSSL 1.0.2g 1 Mar 2016
However when connecting remotely or even just running
ssh -v localhost it connects using the old 7.2:
root@server-new:~# ssh -v localhost ... debug1: Local version string SSH-2.0-OpenSSH_7.6 debug1: Remote protocol version 2.0, remote software version OpenSSH_7.2p2 Ubuntu-4ubuntu2.2 debug1: match: OpenSSH_7.2p2 Ubuntu-4ubuntu2.2 pat OpenSSH* compat 0x04000000 ...
This is basically the process I have gone through, except with 7.6 package: https://gist.github.com/techgaun/df66d37379df37838482c4c3470bc48e
What I have noticed is that the install directory is different now, it was
/usr/sbin/ssh but it's now
root@server-new:~# which sshd /usr/local/sbin/sshd root@server-new:~# which ssh /usr/local/bin/ssh
I did update both /etc/init.d/ssh and /etc/init/ssh.conf to use the new path, but even after a restart it doesn't seem to make much difference.
What are we doing wrong? I assume we just need to specify to use the SSH install on startup but I can't see how.
I've found a bunch of other threads around but nothing seems to help, e.g.