Re: OpenSSH

Lerner, Josh wrote:
> We have a Linux RedHat 7.2 Server running OpenSSH version 3.1.  We
> purchased an SSL encryption software product called Tumbleweed which
> requires OpenSSH version 3.8 or high to be installed.  My
> understanding is that OpenSSH 3.1 is the highest supported version
> for Linux RedHat 7.2.  We cannot upgrade the Linux box at this time.

You've posted to an OpenBSD mailing list.  RedHat and OpenSSH
questions are off-topic here.

> Please let me know if there are any implications (and if so what
> they are) if we leave OpenSSH 3.1 on our Linux box and use the
> Tumbleweed product.  Thanks-

In addition to the above, even in an OpenSSH group, it would be
near-impossible to tell you whether OpenSSH 3.1 would work properly
without first knowing what behaviour Tumbleweed requires from OpenSSH.

That said, OpenSSH 3.1 is over 4 years old.  There have been many
features added and vulnerabilities fixed.  It's strongly recommended
that you upgrade your OpenSSH installation, preferably by upgrading
your OS at large if at all possible.  If this is really impossible,
you may be able to find and/or build a recent OpenSSH for your system.
The most recent portable OpenSSH is 4.3.

HTH,
Tim Hammerquist