Upgrade OpenSSH

[Joe Despres]

What is the safest method to upgrade OpenSSH to 3.4 on production systems that actively use ssh? This is being done due to the latest cert advisory.

Tanks....

[Steve Steel]

Hi

If its in use it wont update so schedule time when no users.


For info

http://www.openssh.com/


Steve Steel

[Joe Despres]

hhhhhmmmmmm let me redo this. Upgrade Openssh with no one on but when they do try to connect they will succeed...

Sorry ......

[Daimian Woznick]

If you are upgrading the secure shell software, the best method would be to take the server down to single user mode to ensure users do not connect. Users should not be logging in while you are updating the system like this.

[Steven Sim Kok Leong]

Hi,

During installation, because your existing sshd binary is in use, the make install (after the make) will not move the new sshd binary in place. Your existing sshd binary will continue to run.

Off my head (untested), I would think that running the following in one statement will incur minimal downtime:

# /sbin/init.d/sshd stop; mv /usr/local/sbin/sshd /usr/local/sbin/sshd.old ; mv /var/sw/openssh-3.4/sshd /usr/local/sbin/sshd; /sbin/init.d/sshd start

This stops the existing daemon, replaces it, restarts the new daemon all in one compound statement step.

Hope this helps. Regards.

Steven Sim Kok Leong

[Joe Despres]

Will the users need to regenerate their key pairs after the upgrade?

[Steven Sim Kok Leong]

Hi,

As far as I can recall, the user public (default named id_rsa.pub or id_dsa.pub) and private keys (default named id_rsa or id_dsa) in the $HOME/.ssh are not removed.

On the safe side, you can write a script to perform backup and restore of these keys.

Backing up the .ssh dir:

#!/sbin/sh
cd /home
tar cvf sshkeys.tar.gz `find . -type d -name .ssh`

Restoring the .ssh dir:

#!/sbin/sh
cd /home
tar xvf sshkeys.tar.gz

Hope this helps. Regards.

Steven Sim Kok Leong