HOWTO - Install newest OPENSSH from source

Friday, 25 July 2008 20:38 Chris
Print

Want to install newest OpenSSH from source, take a look at this article

Product Name : OpenSSH
Product Version : 5.0p1
Homepage : http://www.openssh.org
Description : OpenSSH (OpenBSD Secure Shell) is a set of computer programs providing encrypted communication sessions over a computer network using the ssh protocol. It was created as an open source alternative to the proprietary Secure Shell software suite offered by SSH Communications Security. OpenSSH is developed as part of the OpenBSD project, which is led by Theo de Raadt.

DO NOT DO THIS ON A PRODUCTION SERVER, if your unlucky sshd dies
You can install WEBMIN temporary incase sshd dies, easy to reconfig sshd

Step 1: Lets install newest openssh from source:

cd /usr/local/src
wget ftp://ftp.belnet.be/packages/openbsd/OpenSSH/portable/openssh-5.0p1.tar.gz
tar -zxvf openssh-5.0p1.tar.gz
cd openssh-5.0p1
./configure -prefix=/usr --bindir=/usr/bin --sbindir=/usr/sbin --sysconfdir=/etc/ssh --with-md5-passwords
make && make install

Step 2: Lets copy new configs and service files (you may need to overwrite):

cp -f contrib/redhat/sshd.pam /etc/pam.d/sshd
cp -f sshd_config /etc/ssh/sshd_config
cp -f contrib/redhat/sshd.init /etc/rc.d/init.d/sshd
chmod +x /etc/rc.d/init.d/sshd
/sbin/chkconfig --level 345 sshd on

Step 3: Lets restart the sshd daemon:

service sshd restart

Step 4: Now to the securing and tuning of the SSHD service

Step 4.1: First of all we need to make a regular user, since we are disabling direct root login:

adduser admin
passwd admin

Step 4.2: Now we need to edit the config file:

nano /etc/ssh/sshd_config

Step 4.3: Find #Port 22 and change it to 2899 or some other port you want:

Port 2899


Remember to change from port 22 and to the new port in APF

Step 4.4: Change #Protocol 2,1 to:

Protocol 2

Step 4.5: Change #ListenAddress 0.0.0.0 to:

ListenAddress IP2

IP2 is what you use as Secondary IP

Step 4.6: Locate #PermitRootLogin yes and change it to:

PermitRootLogin no

Step 4.7: Locate #Banner /some/path and change it to:

Banner /etc/motd

Save and Exit

Step 4.8: Create a motd file for the sshd login:

nano /etc/motd

Step 4.9: And add the text:

ALERT! You are entering a secured area! Your IP and login information
have been recorded. System administration has been notified.

This system is restricted to authorized access only. All activities on
this system are recorded and logged. Unauthorized access will be fully
investigated and reported to the appropriate law enforcement agencies.

Step 4.10: Add AllowUsers admin at the bottom:

AllowUsers admin

Step 5: Then restart the SSHD service:

service sshd restart

Start a new client and see if the new port works. if not you need to fix it before exiting your current ssh window!

Hopefully this worked fine, and you can continue to the next step

Example of a config (This is the whole config,# text is removed)

Port 2899
Protocol 2
ListenAddress YOURLISTENINGIP
PermitRootLogin no
Banner /etc/motd
Subsystem sftp /usr/libexec/sftp-server
AllowUsers admin

Last Updated ( Sunday, 10 August 2008 11:07 )