Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

to be PCI compliant i need to be running openssh 5.8 on a server running ubuntu hardy. editing /etc/apt/sources.list to install openssh-server from natty has way too many unresolved dependencies, i'd need to do a full upgrade.

what are my options?

share|improve this question
    
Why do you need 5.8 specifically? –  Shane Madden Apr 8 '12 at 18:06
    
CVE-2008-1483 CVE-2008-1657 CVE-2008-3259 CVE-2008-5161 these are the vulnerabilities, 5.8 was listed as the fix. i installed openssh-server after an update and there doesn't seem to be a security release to fix it –  Ben Apr 8 '12 at 18:10
1  
@Ben: The latest update of OpenSSH on Hardy was released Wed, 02 Mar 2011 - long after those vulnerabilities were known. Your installed version should be named "4.7p1-8ubuntu3", use dpkg -l to check –  pauska Apr 8 '12 at 18:19
    
@Ben Also, here is a CVE lookup tool for Ubuntu: people.canonical.com/~ubuntu-security/cve –  pauska Apr 8 '12 at 18:20
    
very useful, thanks for that! they're all listed as priority low, not sure why the risk is considered high for pci compliance. it looks like CVE-2008-5161 is the only one that needs to be addressed for hardy. looks like i can try to update to 5.2 or add that Ciphers line and hope that's enough to pass? not sure if they try to exploit it in their test or if they just look at version installed. –  Ben Apr 8 '12 at 18:28

2 Answers 2

Your installed version of SSH (mostly) isn't vulnerable to these - your compliance scan is wrong.

Compliance scans which blindly compare CVE lists against software version numbers are mostly worthless when you're using an OS that backports security fixes to stable versions instead of dropping in new major versions of software. Your first step should always be to confirm that you're actually vulnerable.

share|improve this answer
    
awesome, thank you! running the scan again after adding that and reloading, i'll give them a call if it's still failing. –  Ben Apr 8 '12 at 18:41
    
@Ben Please mark this as your accepted answer, so that future visitors will easily see what the fix was :) –  pauska Apr 11 '12 at 21:19
    
I was recently flagged for the same CVE's on 8.04 by SecurityMetrics, ta for the very complete answer. –  Steve Jun 26 '12 at 8:43

There is no pre-compiled package of OpenSSH for Ubunty Hardy newer than 4.7p1, so your only choice is to compile the software from source on your own.

The OpenSSH project has a INSTALL file documenting the procedure.

That being said - I take no responsibility if you manage to make your system unreachable. If I really had to do this, then I would enable telnetd (or use the console), remove the installed openssh packages (dpkg -l | grep openssh) and then install by source.

I have no idea if the install script (when compiling from source) gives you proper init scripts to start up sshd at boot, so you might want to check that aswell.

Edit so, now after I took the while to write all that above, it seems like you are trying to upgrade OpenSSH because you think your system has vulnerabilities from 2008. Security fixes are backported to Ubuntu systems via the Ubuntu Security repo, and then via the updates repo for your specific release (in this case, hardy-updates). The latest release for Hardy is 4.7p1-8ubuntu3, which got released March 2, 2011.

share|improve this answer
    
yeah, it makes me a little nervous to do that :) was hoping there was another way, but installing from source or doing a full upgrade may be it. –  Ben Apr 8 '12 at 18:21
    
@Ben there is no reason for you to do this, see my comments above (under your question). –  pauska Apr 8 '12 at 18:24
    
thank you! made the fix. –  Ben Apr 8 '12 at 18:42

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.