Security issues

[roger]

1. How can we update openssh? The command

   yum update openssh

   does not update past version 3.9. As the servers are using an old version, there are exploits and connectivity issues with some applications. To fix the connectivity issues, the version needs to be past 4.x.
2. Also, there is a bug (that's what Hostican told me) that is preventing cpHulk and the firewall to run on my VPS servers. This has been an issue for a couple months at least, and there have been security issues as a result of this. When will this be fixed?
3. Finally, what is the timetable to update the servers. One of the guys here told me that CentOS 4.x is no longer actively supported with security fixes, updates, etc. (I don't know if that's true, as I've not checked the CentOS site to see yet). He suggested I ask when servers will be updated to CentOS 5.x as it is a stable release.

[roger]

***Bump***

[DOCENTA]

Hello,
Just use:

# yum update


and all will be updated to the latest versions available.

[roger]

Originally Posted by DOCENTA

Hello,
Just use:

# yum update


and all will be updated to the latest versions available.

No that is NOT true. As mentioned in the post, yum will not take openssh past version 3.9 (which is very old).

Can Hostican please answer the three questions - THANKS!

[roger]

***Bump***

[roger]

***Bump***

[DOCENTA]

OS default OpenSSH is good you do not need to mess with it.

[KODY]

Hello mister, from where you know that OpenSSH_3.9 in CeontOS is vulnerable? Are you sure that this applies specifically to OpenSSH, perhaps you mean OpenSSL? About the exploit, there is last know exploit:

2008-07-17 Debian (maybe other derivates |KUDUBUTUNTU|) OpenSSH Remote -=Authenticated=- SELinux Privilege Elevation

Lets see. HostICan use CenotOS, not Debian. And second, which is also important, SELinux support is DISABLED. Please, have trust fully of updates which are provided by the repository of CentoOS. I think the guys from CentoOS are not rookies people and would not allow any bugs to crash impeccable reputation of the best secured Linux

[roger]

Everyone is missing other issues mentioned. Version 4/5 are now standard. Most apps dont work with less than version 3 (SSH).

Also, there are 3 questions.

Does Hostican not support this forum? I was told to put some questions here, but then they don't get answered properly.

@KODY - This is not a CentOS vs some other OS issue, I use both CentOS and Debian based with no problems. Sites on this server have been going up and down regularly. I've been concerned and asked someone to look at it. The first thing they said was that much of the files were old and outdated. It's not about one expolit in the version of SSH, rather about several issues, that cooperatively allow security breaches.

@Hostican - A short while back, I did notice a performance improvement in the servers (I have 4 of them), but now perfomance is not good. Please can you answer the above. Also, there is a ticket from about April that has still to be resolved - You told me you would make sure the issue is fixed, but it is not.

[roger]

***Bump***