A tale of installing OpenSSH 6 from source on a remote CentOS 5.8 server

Everyone knows how conservative RedHat and CentOS are about updating packages. But new security holes keep turning up in old software versions, and that’s not acceptable on a server. CentOS 5.x ships OpenSSH 4.3. Our task is to update it to the latest available version.

You could try to find a suitable rpm package, but chances are your OS version won’t satisfy the package’s requirements. The only way to get the latest version is to build it yourself.

First we need a few packages:

yum install gcc make openssl-devel pam-devel screen

Next, download the package and unpack it:

wget ftp://ftp3.usa.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-6.6p1.tar.gz  
tar xvf openssh-6.4*.gz  
cd openssh-6.4p1

Before building, I’d suggest grabbing the version of OpenSSH available from the repos. For that you need one more package:

yum -y install yum-utils.noarch

Download OpenSSH server:

yumdownloader openssh-server

Here’s the configuration I went with:

• config files live in /etc/sshd/
• binaries go into /usr/bin/
• ipv4 support enabled by default
• also need cached password support and pam authorization

  ./configure -sysconfdir=/etc/sshd/ -bindir=/usr/bin/ -sbindir=/usr/sbin/ -with-ipv4-default -with-md5-passwords -with-pam
  

Remove the current OpenSSH version. From this point on, your active ssh session is the only thread connecting you to the server. If something goes wrong, you won’t be able to reconnect. Good if you’ve got support you can call.

yum remove openssh-server

Compile and install OpenSSH:

make
make install

Copy the init script into place:

cp contrib/redhat/sshd.init /etc/init.d/sshd

If you connect to the server as root, force this option on in the config file: (uncomment PermitRootLogin yes in /etc/sshd/sshd_config)

On start, sshd complains about a missing certificate file. To fix that, comment out this line in the init.d script (/etc/init.d/sshd):

/etc/ssh/ssh_host_ecdsa_key.pub

Move the old ssh folder aside and symlink the new one:

mv /etc/ssh /etc/ssh.bak && ln -s /etc/sshd /etc/ssh

Enable the daemon on boot:

chkconfig sshd -add  
chkconfig sshd on

Itching to start the new ssh already? I’d recommend stopping it and starting it fresh instead of using restart.

When I ran /etc/init.d/sshd restart, my session dropped and ssh didn’t come back up. I found nothing in the logs, but connecting to the server directly and starting ssh worked fine. It only complained about the certificate we’d already commented out in the init.d script — which is exactly why we commented it out.

Just in case, run it inside screen:

screen  
/etc/init.d/sshd stop && /etc/init.d/sshd start

At this point the connection to the server drops.

If you’re on Linux, to reconnect to the server you’ll need to remove the old entry from your known_hosts file:

ssh-keygen -f `~/.ssh/known_hosts` -R %server_ip%

Now you can connect to the server.

If you hit this message during the build:

configure: error: PAM headers not found

Install the missing package:

yum install pam-devel