Old SSH server version running after upgrade

Question

We have an Ubuntu server running 16.04, which is used for a client website. The client has recently had a security audit done and one of the recommendations has been to update our OpenSSH version to at least version 7.4, but 16.04 comes pre-installed with 7.2. I tried to just do a straight update but 7.2 is the latest release available, so we are now trying to install 7.6 manually.

I have downloaded and installed 7.6 ok, and it seems to be running fine:

sshd 
OpenSSH_7.6p1, OpenSSL 1.0.2g  1 Mar 2016

However when connecting remotely or even just running ssh -v localhost it connects using the old 7.2:

root@server-new:~# ssh -v localhost
...
debug1: Local version string SSH-2.0-OpenSSH_7.6
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.2p2 
Ubuntu-4ubuntu2.2
debug1: match: OpenSSH_7.2p2 Ubuntu-4ubuntu2.2 pat OpenSSH* compat 0x04000000
...

This is basically the process I have gone through, except with 7.6 package: https://gist.github.com/techgaun/df66d37379df37838482c4c3470bc48e

What I have noticed is that the install directory is different now, it was /usr/sbin/ssh but it's now /usr/local/sbin/ssh

root@server-new:~# which sshd
/usr/local/sbin/sshd
root@server-new:~# which ssh
/usr/local/bin/ssh

I did update both /etc/init.d/ssh and /etc/init/ssh.conf to use the new path, but even after a restart it doesn't seem to make much difference.

What are we doing wrong? I assume we just need to specify to use the SSH install on startup but I can't see how.

I've found a bunch of other threads around but nothing seems to help, e.g.

https://serverfault.com/questions/310384/problem-with-upgrading-openssh-to-the-latest-version

Update OpenSSH Server in 12.04?

https://forums.cpanel.net/threads/whats-it-take-to-update-to-openssh-5-1-or-higher.170818/

Thanks

Answer 1

This is the classic I-want-LTS-but-I-don't-want-LTS logic trap.

One purpose of an Ubuntu LTS is to provide you stability. Ubuntu does that by not incrementing software versions. When you decide to use an LTS, you are locking yourself into those versions without changes for two years.

(If that's not what you want, then don't use an LTS.)

BUT there's one tiny exception: Security updates. The Ubuntu Security Team issues security updates without bumping to the next upstream release (which would violate LTS, of course). Instead, they patch the source code.

So when a vulnerability in OpenSSH 7.2 is discovered, two things happen:

1. The OpenSSH website announces that everyone should immediately upgrade to new OpenSSH 7.3

2. However, the Ubuntu Security Team pushes OpenSSH 7.2p2-4ubuntu2.2 to you.

From a security perspective, they are identical - all the same vulnerabilities are closed in both. Your security auditor just doesn't realize it.

You have three choices:

1. Stick with LTS: You can realize that the auditor is merely misinformed, do a bit of research on the Ubuntu Security Team, and ultimately do nothing...because no additional security action is actually necessary.

2. Follow the Auditor: You can jump off LTS to the normal 6-month releases of Ubuntu. This may mean a lot of extra work every six months if a release-upgrade changes your workflow or production systems.

3. Build a Frankensystem: It's the worst of both worlds, riskier, and harder to maintain. You can try to install newer versions of OpenSSH from PPAs or newer releases of Ubuntu onto your older LTS. Might break your system, might not. Might break future upgrades and security updates, might not.