OpenSSH Security Upgrade Guide: Online and Offline Methods

Translation Notice
This article was originally written in Chinese and translated into English with the assistance of AI. The translation has been reviewed and edited for clarity, accuracy, and readability. Please refer to the original source where necessary, especially for technical terms, commands, configuration details, and proper nouns.

Important Notes#

Before upgrading OpenSSH in any production environment, prepare a fallback or rollback plan, such as VM snapshots, VM clones, or a documented command-by-command recovery procedure.

Prerequisites#

OpenSSL (may be omitted if the existing version is compatible)
OpenSSH

Upgrade Steps#

Online upgrades are usually straightforward. For offline compilation and installation, keep your SSH session active throughout the process. If it disconnects, you may not be able to establish another SSH session until the upgrade finishes; you will need Telnet, VNC, or another remote-control protocol, making the upgrade much harder.

Connected Environment#

A connected environment is relatively simple: download and upgrade directly with a package manager such as apt, dnf, or yum. Package-manager versions are often not the latest, however, so using the newest release still requires downloading, compiling, and installing it yourself.

Ubuntu/Debian#

1
# Update the package index
2
sudo apt update
3
# View the available OpenSSH upgrade (optional)
4
apt list --upgradable openssh-*
5
# Upgrade the OpenSSH client and server
6
sudo apt install --only-upgrade openssh-client openssh-server
7
# Restart the SSH service
8
sudo systemctl restart sshd
9
# Verify the service status
10
sudo systemctl status sshd
11
# Check whether port 22 is listening normally
12
sudo netstat -tunlp

RHEL7/CentOS7#

1
# Check for available updates
2
sudo yum check-update
3
# Upgrade OpenSSH alone
4
sudo yum update openssh openssh-server openssh-clients
5
# Restart the service
6
sudo systemctl restart sshd
7
# Verify the service status
8
sudo systemctl status sshd
9
# Check whether port 22 is listening normally
10
sudo netstat -tunlp

RHEL8/CentOS8+/RockyLinux9+#

1
# Refresh repository metadata
2
sudo dnf makecache
3
# Upgrade SSH-related components
4
sudo dnf upgrade openssh openssh-server openssh-clients
5
# Restart the service
6
sudo systemctl reload sshd
7
# Verify the service status
8
sudo systemctl status sshd
9
# Check whether port 22 is listening normally
10
sudo netstat -tunlp

Isolated Environment (Offline)#

Important Notice#

Version selection recommendation (September 2025)

OpenSSL：1.1.1w
OpenSSH：10.0p1

See the mirror link at the end of this article for the download address.

Preparation#

1
# Create a dedicated working directory
2
mkdir /opt/ssh_upgrade && cd /opt/ssh_upgrade
3

4
# Safer backup option (preserve the original files)
5
cp -a /etc/ssh /etc/ssh_backup_$(date +%F)
6
cp -a /etc/init.d/sshd /etc/init.d/sshd_backup
7
cp -a /usr/bin/openssl /usr/bin/openssl_backup
8
cp -a /etc/pam.d/sshd /etc/pam.d/sshd_backup
9

10
# Back up critical library files
11
ldd $(which sshd) | awk 'NF == 4 {print $3}' | xargs -I {} cp -a {} /opt/lib_backup/

Remove the Existing OpenSSH Service#

1
yum -y remove openssh openssh-server openssh-clients openssh-askpass
2
# yum package manager
3
rpm -e --nodeps openssh openssh-server openssh-clients
4
# apt package manager
5
apt purge -y openssh-server openssh-client

Install OpenSSL (Optional)#

You can skip this step if your OpenSSL version is compatible with OpenSSH.

1
tar -zxvf openssl-3.2.4.tar.gz
2
cd openssl-3.2.4
3

4
# Optimize compilation flags
5
./config --prefix=/usr/local/openssl \
6
         --openssldir=/usr/local/openssl \
7
         shared zlib -Wl,-rpath=/usr/local/openssl/lib
8

9
make && make install
10

11
# Update the security link safely
12
ln -sf /usr/local/openssl/bin/openssl /usr/bin/openssl
13
ln -sf /usr/local/openssl/include/openssl /usr/include/openssl
14

15
# Verify library dependencies
16
echo "/usr/local/openssl/lib" > /etc/ld.so.conf.d/openssl.conf
17
ldconfig -v | grep -i openssl
18

19
# Verify the version
20
openssl version -a

Install OpenSSH#

1
tar -zxvf openssh-10.6p1.tar.gz
2
cd openssh-10.6p1
3

4
# Streamline compilation flags (remove deprecated options)
5
./configure --prefix=/usr \
6
            --sysconfdir=/etc/ssh \
7
            --with-ssl-dir=/usr/local/openssl \
8
            --with-pam \
9
            --with-zlib
10

11
make -j$(nproc)
12
make install
13

14
# Check binary compatibility
15
ldd /usr/sbin/sshd

Verify the Installation#

1
openssl version
2
ssh -V

Modify the sshd Configuration#

1
vi /etc/ssh/sshd_config
2

3
# Write the five configuration lines below
4
Port 22
5
ListenAddress 0.0.0.0
6
PermitRootLogin prohibit-password
7
PasswordAuthentication no
8
UsePAM yes

Start the Service#

1
systemctl sshd start

🔗 Related links

[1] Aliyun OpenSSH mirror: link

[2] OpenSSL: https://www.openssl.org/source

Music