Install ssh in old workstations with HP-UX 11.11

[R.O.]

Hi all,

I have been asked to install the last ssh version (HP-UX Secure Shell A.05.30.) in some old workstations (C3700, B180L, B2000, C3000 and C3750). I am reading the requisites for installing ssh and in HW, the document says:

Hardware:
• HP/9000 servers
• HP Integrity servers

Since I have HP/9000 WORKSTATIONS, I am wondering if it is possible to install ssh in these machines. Can you please tell me if it is possible?

Regards,

[Horia Chirculescu]

Hello,

As long as the hardware is running HP-UX 11i v1/2/3 there should be no problems.

If the stations are very old and not updated, you should install at least the run-time dependencies for SSH.

A list of those dependencies you should get from the description of the package or from the porting archive:

http://hpux.connect.org.uk/hppd/hpux/Networking/Admin/openssh-5.3p1/


Best regards,
Horia.

[R.O.]

Hi,

From the release notes of the "HP-UX Secure Shell version A.05.30":

" HP-UX Secure Shell is built to install and un-install using the SD-UX utility and includes all required pre-requisites."

It seems to be better to use it instead of "OpenSSH 5.3p1", isnt it? With the openSSH version, I have to install several dependencies.

Regards,

[Horia Chirculescu]

>"With the openSSH version, I have to install several dependencies."

Yes, this is true. Just a comment: HP's implementation is also based on openssh.

Horia.

[Steven Schweda · Accepted solution]

> Can you please tell me if it is possible?

dy # model
9000/785/C3700

dy # uname -a
HP-UX dy B.11.11 U 9000/785 2012616114 unlimited-user license

dy # ssh -V
OpenSSH_5.3p1+sftpfilecontrol-v1.3-hpn13v5, OpenSSL 0.9.8l 5 Nov 2009
HP-UX Secure Shell-A.05.30.007, HP-UX Secure Shell version


> It seems to be better [...]

Define "better".

[R.O.]

> It seems to be better [...]

Define "better".

Hi,

By "better" I mean "easier", because, apart from the recomended patches, you only have to install one depot. With "OpenSSH" you have to instal up to 9 different depots.

Regards,

[Steven Schweda]

> By "better" I mean "easier", because [...]

Ok, I'll agree with "easier". If you build
it all yourself, then you get better control
over the components. For example, "OpenSSL
0.9.8l 5 Nov 2009" is not the latest version.

Of course, HP may have added some fixes and
features of its own. (Or it may have removed
something.) Everything's complicated.

In any case, this stuff apparently doesn't
really know the difference between a server
and a workstation.

[Steven E. Protter]

Shalom,

The latest secure shell from http://software.hp.com will work.

Workstations in theory can not run server oriented products like ServiceGuard.

SEP

[Horia Chirculescu]

> By "better" I mean "easier", because [...]

I will put it other way around: "easier" does not always mean "better".

Horia.

[R.O.]

"I will put it other way around: "easier" does not always mean "better". "

Ok, in this case, which one do you think it is more advisable, OpenSSH or the HP Secure Shell depot?

Regards,

[Horia Chirculescu]

In this case, it depends on what path do you want to choose: The "better" way would be to get the latest versions for the software you are trying to install, "easier" would be to install the available depot from HP.

In order to make a decision, you should read the changelog for all the dependencies that ssh uses (openssl, zlib, etc...).

Best regards,
Horia.

[Steven Schweda]

> [...] The "better" way would be to get the
> latest versions [...]

Newer is always better? Really?

> In order to make a decision, [...]

In order to make a decision, you should know
what all the differences are between the
different options. Figuring this out would
probably involve much work. As a practical
method, I'd probably install the HP depot,
and wait for a problem to occur. If you have
no problems, then relax. If you have
problems which might be solved by some newer
version of some component, and if HP is too
slow in providing a newer kit, then it might
make sense to try building everything from
the sources.

[Horia Chirculescu]

>Newer is always better?

I did not say that it is _always_ better. I said that someone should read the changelog for every dependencies in order to make a decision.

Dependencies are not usually related only to the package installed. In my opinion yes, it is best to try to understand the fixes from the new releases and apply those on working servers. Why should someone wait for HP to release a new depot for the same piece of software that was changed a few days ago?

From November 2009 until today there are 6 months. Read the changelog/docs for openssl about security issues that were fixed in this period.

Horia.