HP-UX Secure Shell and OpenSSL

[Jonathan Grymes]

I recently downloaded and installed HP-UX Secure Shell-A.05.30.008 which integrates with Openssl 0.9.8l. I have since upgraded OpenSSL per an HP security bulletin to 0.9.8n-fips. However, I noticed during an sftp session that 0.9.8l is still referenced.

#which openssl
/usr/bin/openssl
#openssl version
OpenSSL 0.9.8n-fips 24 Mar 2010

From the most recent sftp session log:
OpenSSH_5.3p1+sftpfilecontrol-v1.3-hpn13v5, OpenSSL0.9.8l 5 Nov 2009
HP-UX Secure Shell-A.05.30.008, HP-UX Secure Shell version

Can I make the HP-UX Secure Shell point to the new OpenSSL 0.9.8n-fips?

[avizen9]

looks path is not set for Shell-A.05.30.008 can you post here the path info
echo $PATH
and
env

[Steven Schweda]

> Can I make the HP-UX Secure Shell point to
> the new OpenSSL 0.9.8n-fips?

I know nothing, but I'd sure hope not. The
HP Secure Shell product was tested in one
configuration. There's no guarantee that it
would work the same way if you were to yank
out some big piece of its run-time
infrastructure, and replace it with some
newer/better thing (possibly from a different
vendor).

If you really want the latest versions of
open-source products, then it makes sense to
build them yourself, so that you have the
control you want. If you want to use
products supplied (and supported) by HP, then
you should probably get accustomed to using
versions a little behind the latest ones. If
there's some known vulnerability (or other
defect) in a vendor-supported product, then
complaining to the vendor may be the best
(and/or only real) recourse.