How to check version of Open SSH?

[faiza]

Hi,

I apologize if my question doesn't make any sense because I have little Unix experience. I have been asked if we need to apply patch for following bug.

???All versions of OpenSSH's sshd prior to 3.7.1 contain buffer management errors. It is uncertain whether these errors are potentially exploitable, however, we prefer to see bugs fixed proactively. Other implementations sharing common origin may also have these issues.???

My question is how can I checl that we are using Open SSH? and also how can I check what version has been installed on my machine.

TIA.
Faiza

[H.Merijn Brand (procura]

If you installed it fron the SD from the HP porting centers, just type

# swlist openssh

and it'll report the installed version.

Enjoy, have FUN! H.Merijn

[benoit Bruckert]

Hi,
and in all the cases (compiled from sources or installed from depot ):
ssh -V will show the version (for the client)
sshd -v will show the help page but also the version for the server....

regards
Benoit

[Sorrel G. Jakins]

I don't know why this particular buffer overflow exploit is generating so much excitement - my own security manager was in a perfect sweat over this. To actually use the exploit requires modification to sshd itself, and then sending 1Mb packets might cause a denial of service.

It is not worth it to panic and rush off and install your own copy of OpenSSH. If you are using HP's OpenSSH then you will lose support from HP.

Do you have reasonable security precautions in place? Do you use tcpwrappers? If so, just pay attention to who is coming in and from where and then watch HP security bulletins. If you are really concerned, then put in a call to HP asking when they will be releasing the 3.7.1 code.

$0.02 - sorrel

[Steven E. Protter]

swlist -l product | grep -i secure

That will show secure shell, which is based on openssh

This step will work for either.

ssh -tv hostname

This will display lots of stuff, including the version of openssh

SEP

[GK_5]

"swlist -R | grep -i secure" will show if OpenSSH is installed.

Have fun!

[faiza]

Thanx everybody. I checked on my system and we are not using Open SSH.

Have a good weekend.
Faiza

[Sridhar Bhaskarla]

A cheap way to verify if you are "using" openssh is

echo |telnet localhost 22

It should blip out the ssh version.

You already got the answer on how to check the installation.

-Sri

[Jorge Fabregas]

Hello Sridhar! Thanks for that tip! Pretty cool. I didn't know that one.