SSH on 11i

[Deborah Weatherspoon]

We have installed secure shell (ssh) on a trusted 11i system. However, the users are not required to change their password?. But, if they telnet into the system, the aging process works and request them to change they password. It seems as though ssh works like a secure console.

Does anyone have a solution for making the aging process work using ssh. The ssh version is 3.0.

Thanks in advance

[Michael Tully]

Hi,

I think your answer lies here, courtesy of Craig Rants.

HTH
Michael

ssh needs to be compiled with the pam option to work with password aging i.e...

- Compile openssh
cd /tmp
gzip -d < openssh-3.1p1.tar.gz | tar xvf -
cd openssh-3.1p1
(11 version)
./configure --prefix=/opt/openssh2 --sysconfdir=/opt/openssh2/etc --with-pam
--with-ssl-dir=/usr/local/openssl/lib --with-default-path=/bin:/usr/bin:/opt/openssh2/bin
(10 version)
./configure --prefix=/opt/openssh2 --sysconfdir=/opt/openssh2/etc
--with-ssl-dir=/usr/local/ssl/lib --with-default-path=/bin:/usr/bin:/opt/openssh2/bin
make
make install

[Thomas D. Harrison]

I've had the same trouble and I think I'll try Michael's solution ( Courtesy of Craig Rants of course ).

To catch the expired passwords I wrote a script that at least notified me of the expired passwords, inactive accounts, etc...

It's actually a pretty nice script to run even with this issue resolved by recompiling SSH.

It will require minor modifications and please excuse the lack of finesse; I hadn't taken a scripting class yet.

[Deborah Weatherspoon]

Sorry, but I'm back.

When I re-compiled ssh, I received the following error message. "configure: error: configuring with X but xauth not found - aborting.

I was wondering if Thomas Harrison was able to get it working.

I also see that HP has an CD that was dated June 6.

[Steven Sim Kok Leong]

Hi,

If you are running the same release of SSH I am thinking, you can run ./configure with the following option to disable X11 Forwarding/Tunnelling over SSH if you do not need it:

# ./configure --without-x

If you need X11 Forwarding, then you will need xauth binary to be present in your system, specify the correct full pathname to it or set the PATH correctly.

A common xauth path:

# /usr/bin/X11/xauth

Hope this helps. Regards.

Steven Sim Kok Leong

[Keith Buck]

HP has released a supported version of openssh that has been tested by HP and works correctly with a trusted environment (including asking the user to change their password). This is for HP-UX 11.0 and 11i. You can get it from software depot at:

http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/displayProductInfo.pl?productNumber=T1471AA

It's based off of openssh 3.1p1, and requires no compile flags, because HP packaged it for you :)

[Bryan Payne]

Has HP a supported openssh based on 3.4 version... since the current supported version has been deemed insecure? I am attempting to compile from source, but I keep getting the following:
configure:8221: error: *** Can't find recent OpenSSL libcrypto (see config.log for details) ***

The log file doesn't help me much as I'm not a programmer, or an old hand at compiling source.

I do have current versions of openssl on the system and have provided the path in the compile options.

I checked a few sites, and a few mentioned that openssl needed to be static, and not dymanically linked... another mentioned that it had to do with 32/64 bit.

I checked the hpux archive at http://hpux.cs.utah.edu , and no one has an sw package for a newer version either. Anyone having the same problem, or have any ideas?

I've attached the log file if anyone can lead me in the right direction.

[Keith Buck]

See security bulletin 195.