Prerequisites and System Preparation

Before proceeding, ensure the system has essential build tools and libraries installed:

yum install -y vim gcc gcc-c++ glibc make autoconf openssl openssl-devel pcre-devel pam-devel zlib-devel tcp_wrappers-devel libedit-devel perl-IPC-Cmd wget tar lrzsz

Update zlib Library

Download and compile the latest zlib version for improved compatibility:

tar -zxvf zlib-1.3.1.tar.gz
cd /usr/local/zlib-1.3.1
./configure --prefix=/usr/local/zlib
make -j 2
make test
make install
ldconfig -v

Compile and Install OpenSSL 1.1.1w

Fetch and build OpenSSL with custom installation paths:

tar -zxvf openssl-1.1.1w.tar.gz
cd /usr/local/openssl-1.1.1w
./config --prefix=/usr/local/openssl
make -j2
make install
openssl version -v

Build and Deploy OpenSSH 9.8p1

Extract the source package and configure with dependencies:

tar -zxvf openssh-9.8p1.tar.gz
cd /usr/local/openssh-9.8p1
./configure --prefix=/usr/local/openssh --sysconfdir=/etc/ssh --with-pam --with-ssl-dir=/usr/local/openssl/ --with-zlib=/usr/local/zlib

Verify that PAM support is active in the configuration output.

Proceed with compilation and installation:

make -j 2
make install

Service Integration and Configuration

Replace the default SSH daemon script and update binaries:

cp contrib/redhat/sshd.init /etc/init.d/sshd
cp /etc/pam.d/sshd /etc/pam.d/sshd.bak

# Copy updated binaries to system paths
cp /usr/local/openssh/sbin/sshd /usr/sbin/
cp /usr/local/openssh/bin/ssh /usr/bin/
cp /usr/local/openssh/bin/ssh-keygen /usr/bin/

# Register service
chkconfig --add sshd

Fix SFTP Connectiivty Post-Upgrade

After upgrading, SFTP may fail due to outdated subsystem path. Correct it by editing the SSH configuration:

vim /etc/ssh/sshd_config

Update the subsystem line as follows:

Subsystem sftp internal-sftp

Restart the service to apply changes:

systemctl restart sshd

Final Verification

Confirm successful upgrade by checking the version:

ssh -V
OpenSSH_9.8p1, OpenSSL 1.1.1w  11 Sep 2023

This completes the secure migrasion to OpenSSH 9.8p1, addressing critical vulnerabiliteis including CVE-2024-6387.