* Note that this is a old article saved from a previous blog.

I had a few FreeBSD machine’s still running a old version of OpenSSH and OpenSSL, so it was about time to upgrade these to the latest version.

These were the current versions of OpenSSH and OpenSSL that I was running:

There are multiple ways of upgrading these packages on FreeBSD, here I point out the way I like to use. First thing to do is setup telnetd so I can access the server using telnet, this way I won’t be lost if something goes wrong while updating OpenSSH to the latest version (Note that this is not needed if you do the upgrade local, but for me it will save me a 40KM trip to the colo).
Edit /etc/inetd.conf and enable the telnetd server:

Then add inetd to the rc.conf so it will start at boot time (So you can give the server a powerboot if needed and use telnet again).

Now we need to start inetd and see if it works:

And to see if telnet works from a local machine:

Good telnet is working now we can start the upgrade of OpenSSH and OpenSSL. Make sure you have cvsuped your ports tree to the latest version. First I will upgrade OpenSSL:

In version 5 you can’t upgrade OpenSSl over the base anymore so I backup the original versions so I can go back if anything is wrong and link the new version there.

1
2
3
4
5
6
7
8
9
10
11
12

#!/bin/sh
mv /usr/bin/openssl /usr/bin/openssl.bak
mv /lib/libcrypto.so.3 /lib/libcrypto.so.3.bak
mv /usr/lib/libssl.so.3 /usr/lib/libssl.so.3.bak
 
chmod 000 /usr/bin/openssl.bak
chmod 000 /lib/libcrypto.so.3.bak
chmod 000 /usr/lib/libssl.so.3.bak
 
ln -s /usr/local/lib/libssl.so.3 /usr/bin/openssl /usr/bin/openssl
ln -s /usr/local/lib/libssl.so.3 /usr/crypto.so.3 /lib/libcrypto.so.3
ln -s /usr/local/lib/libssl.so.3 /usr/lib/libssl.so.3

Now OpenSSL should be the latest version:

root@server:~# openssl version
OpenSSL 0.9.7g 11 Apr 2005

Good that worked, now its time to upgrade OpenSSH:

After the installation you should set NO_OPENSSH=true in your make.conf so it won’t be overwritten if you upgrade your system.

The ports version has got its binary’s in /usr/local/bin while the base ssh is installed in /usr/bin/ now you could set your path’s to look in /usr/local/bin first, but I like to backup the old version and link the new version for the original.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

#!/bin/sh
mv /usr/bin/ssh /usr/bin/ssh.bak
mv /usr/bin/ssh-keyscan /usr/bin/ssh-keyscan.bak
mv /usr/libexec/ssh-keysign /usr/libexec/ssh-keysign.bak
mv /usr/bin/ssh-agent /usr/bin/ssh-agent.bak
mv /usr/sbin/sshd /usr/sbin/sshd.bak
 
chmod 000 /usr/bin/ssh.bak
chmod 000 /usr/bin/ssh-keyscan.bak
chmod 000 /usr/libexec/ssh-keysign.bak
chmod 000 /usr/bin/ssh-agent.bak
chmod 000 /usr/sbin/sshd.bak
 
ln -s /usr/local/bin/ssh /usr/bin/ssh
ln -s /usr/local/bin/ssh-keyscan /usr/bin/ssh-keyscan
ln -s /usr/local/libexec/ssh-keysign /usr/libexec/ssh-keysign
ln -s /usr/local/bin/ssh-agent /usr/bin/ssh-agent
ln -s /usr/local/sbin/sshd /usr/sbin/sshd

Also the ports version has got a nice start/stop script that you can use, i’m going to use that instead of starting the sshd using rc.conf. First edit /etc/rc.conf and disable the SSH daemon:

Now move the sample sshd script and edit the file to use your old sshd config file:

This will tell the new sshd to look at the config file in /etc/ssh/sshd_config. Now find your current sshd pid and kill it then start ssh using the script.

So SSH is running again and should be the latest version:

Now connect from your client again to your server, you should get a warning that the key is changed, add the new key and you should be running using the latest version of ssh.
Now kill the inetd deamon and if you want to remove it from the rc.conf (I keep it in there untill I have rebooted the machine to make sure it is working.