Safely Upgrade OpenSSH on Remote Linux PCs (CentOS 6.7)?

Safely Upgrading OpenSSH on a Remote Linux PC: Temporary Filtering of Telnet and Script Execution

Upgrading OpenSSH on a remote Linux PC is crucial to maintain the security of your system. However, during the upgrade process, there might be some potential issues that need to be addressed temporarily. In this article, we will discuss a safe approach to upgrading OpenSSH while temporarily filtering Telnet and executing scripts.

Prerequisites

Before proceeding, ensure you have the following prerequisites:

• SSH access to the remote Linux PC
• Root or sudo privileges on the remote Linux PC
• A backup of your SSH configuration file (/etc/ssh/sshd_config)

Temporarily Disable Telnet

Telnet is an insecure protocol that should be disabled on your Linux PC. To do this temporarily, follow these steps:

1. Check if Telnet is currently running: netstat -tuln | grep telnet
2. If Telnet is running, kill the process: kill -9 [PID] (replace [PID] with the process ID)
3. Edit the /etc/services file and comment out the Telnet service by adding a # at the beginning of the line: # telnet 23/tcp
4. Restart the SSH service: service ssh restart

Temporarily Disable Script Execution

To prevent any scripts from running during the upgrade process, you can temporarily disable script execution in the /etc/profile file:

1. Edit the /etc/profile file: sudo nano /etc/profile
2. Add the following line at the end of the file: export disable='true'
3. Save and exit the file (Ctrl+X, Y, Enter)

Upgrade OpenSSH

Now that Telnet is disabled and script execution is temporarily restricted, you can upgrade OpenSSH:

1. Update the package list: sudo apt-get update
2. Upgrade OpenSSH: sudo apt-get upgrade openssh-server

Restore Telnet and Script Execution

After the upgrade is complete, you can restore Telnet and script execution:

1. Edit the /etc/services file and uncomment the Telnet service: telnet 23/tcp
2. Restart the SSH service: service ssh restart
3. Edit the /etc/profile file and remove the export disable='true' line

In this article, we discussed a safe approach to upgrading OpenSSH on a remote Linux PC while temporarily filtering Telnet and restricting script execution. By following the steps outlined, you can minimize potential issues during the upgrade process and ensure the security of your system.

References

• Book: Linux Network Administration, 5th Edition, by Olaf Kirch
• Article: Disable/Enable Telnet Service in Linux/Unix/BSD
• Online Resource: Disable and Enable Script Execution in Linux