Zero byte PID file allows ssh v1 connection on Solaris 9

First time poster.

Ultimately the solution to this is probably to upgrade but I would like to =
get a better understanding of the mechanics behind the issue.

OpennSSH deamon allowed an ssh v1 connection despite config file set to all=
ow v2 only.

1.  Occurred on a Solaris 9 server with sshd version OpenSSH_3.8p1, OpenSSL=
 0.9.7d
2.  Confirmed that /usr/local/etc/sshd_config is set for protocol 2 only.
3.  ps -eaf shows /usr/local/sbin/sshd -u0
4.  Execute ssh -1 -v -p xx localhost and got the following output indicati=
ng a successful
    v1 connection:

-->  Sun_SSH_1.1, SSH protocols 1.5/2.0, OpenSSL 0x0090700f
     debug1: Reading configuration data /etc/ssh/ssh_config
     debug1: Rhosts Authentication disabled, originating port will not be t=
rusted.
     debug1: ssh_connect: needpriv 0
     debug1: Connecting to xxx.xxx.xxx.xxx [xxx.xxx.xxx.xxx] port xx.
     debug1: Connection established.

5.  Confirmed that /etc/ssh/ssh_config is also set to use protocol 2 only.
6.  Restarted OpenSHH using /etc/init.d/opensshd to ensure that config file=
 was being read
    and got an error message stating OpenSSH could not write to the PID fil=
e.
7.  Discovered that PID was missing from /var/run/sshd.pid (file was zero b=
ytes).
8.  Deleting sshd.pid, kill -9 on sshd, failed to allow creation of PID fil=
e.
9.  Manually entered PID into sshd.pid and restarted opensshd with complete=
 success.
10. Re-tested with ssh -1 -v localhost and connection failed. All is better.
11. I've since discovered that the ssh command from Sun_SSH is first in the=
 path which may
    be part of the problem.

My main concern is that sshd allowed the insecure protocol v1 to connect de=
spite the fact that the sshd_config files were set to allow v2 only because=
 of the zero byte PID file. My company is nearly finished migrating to RHEL=
 so I have limited Solaris resources and have no way to test if removing Su=
n_SSH from the scenario would prevent resolve this issue or to test if upgr=
ading will resolve the issue. Also, I understand that a zero byte PID can c=
ause problems, but I don't understand why I couldn't fix that by killing th=
e sshd process and then restarting OpenSSH.

I've been unable to find any information on this issue in the news group ar=
chives, Google results, or anywhere else and would appreciate any feedback/=
education including "Go look [wherever]."

Thanks,
Dave

The information contained in this message is proprietary and/or confidentia=
l. If you are not the intended recipient, please: (i) delete the message an=
d all copies; (ii) do not disclose, distribute or use the message in any ma=
nner; and (iii) notify the sender immediately. In addition, please be aware=
 that any message addressed to our domain is subject to archiving and revie=
w by persons other than the intended recipient. Thank you.