topic Re: Upgrade OpenSSH in Operating System - HP-UX

Upgrade OpenSSH

Joe Despres — Tue, 09 Jul 2002 11:37:53 GMT

What is the safest method to upgrade OpenSSH to 3.4 on production systems that actively use ssh? This is being done due to the latest cert advisory.

Tanks....

Re: Upgrade OpenSSH

Steve Steel — Tue, 09 Jul 2002 11:46:16 GMT

Hi

If its in use it wont update so schedule time when no users.

For info

http://www.openssh.com/

Steve Steel

Re: Upgrade OpenSSH

Joe Despres — Tue, 09 Jul 2002 11:51:43 GMT

hhhhhmmmmmm let me redo this. Upgrade Openssh with no one on but when they do try to connect they will succeed...

Sorry ......

Re: Upgrade OpenSSH

Daimian Woznick — Tue, 09 Jul 2002 11:59:43 GMT

If you are upgrading the secure shell software, the best method would be to take the server down to single user mode to ensure users do not connect. Users should not be logging in while you are updating the system like this.

Re: Upgrade OpenSSH

Steven Sim Kok Leong — Tue, 09 Jul 2002 12:01:36 GMT

Hi,

During installation, because your existing sshd binary is in use, the make install (after the make) will not move the new sshd binary in place. Your existing sshd binary will continue to run.

Off my head (untested), I would think that running the following in one statement will incur minimal downtime:

# /sbin/init.d/sshd stop; mv /usr/local/sbin/sshd /usr/local/sbin/sshd.old ; mv /var/sw/openssh-3.4/sshd /usr/local/sbin/sshd; /sbin/init.d/sshd start

This stops the existing daemon, replaces it, restarts the new daemon all in one compound statement step.

Hope this helps. Regards.

Steven Sim Kok Leong

Re: Upgrade OpenSSH

Joe Despres — Wed, 10 Jul 2002 09:57:32 GMT

Will the users need to regenerate their key pairs after the upgrade?

Re: Upgrade OpenSSH

Steven Sim Kok Leong — Thu, 11 Jul 2002 01:29:09 GMT

Hi,

As far as I can recall, the user public (default named id_rsa.pub or id_dsa.pub) and private keys (default named id_rsa or id_dsa) in the $HOME/.ssh are not removed.

On the safe side, you can write a script to perform backup and restore of these keys.

Backing up the .ssh dir:

#!/sbin/sh
cd /home
tar cvf sshkeys.tar.gz `find . -type d -name .ssh`

Restoring the .ssh dir:

#!/sbin/sh
cd /home
tar xvf sshkeys.tar.gz

Hope this helps. Regards.

Steven Sim Kok Leong