Upgrade OpenSSH on Ubuntu 22.04

Target version: 10.0p1

  • Prerequisites:

    a. A C compiler.
    b. Zlib 1.1.4 or 1.2.1.2 or greater.
    c. OpenSSL (https://www.openssl.org) 1.1.1 or greater.
    d. libcrypto from either of LibreSSL or OpenSSL.

  • Current version:

~$ ssh -V
OpenSSH_8.9p1 Ubuntu-3ubuntu0.13, OpenSSL 3.0.2 15 Mar 2022

~$ openssl version
OpenSSL 3.0.2 15 Mar 2022 (Library: OpenSSL 3.0.2 15 Mar 2022)

~$ dpkg -l | grep zlib
ii  zlib1g:amd64                           1:1.2.11.dfsg-2ubuntu9.2                amd64        compression library - runtime
  1. Check openssh service and config.
sakura@sakura:~$ cat /lib/systemd/system/ssh.service
[Unit]
Description=OpenBSD Secure Shell server
Documentation=man:sshd(8) man:sshd_config(5)
After=network.target auditd.service
ConditionPathExists=!/etc/ssh/sshd_not_to_be_run

[Service]
EnvironmentFile=-/etc/default/ssh
ExecStartPre=/usr/sbin/sshd -t
ExecStart=/usr/sbin/sshd -D $SSHD_OPTS
ExecReload=/usr/sbin/sshd -t
ExecReload=/bin/kill -HUP $MAINPID
KillMode=process
Restart=on-failure
RestartPreventExitStatus=255
Type=notify
RuntimeDirectory=sshd
RuntimeDirectoryMode=0755

[Install]
WantedBy=multi-user.target
Alias=sshd.service

sakura@sakura:~$ cat /lib/systemd/system/ssh.socket
[Unit]
Description=OpenBSD Secure Shell server socket
Before=ssh.service
Conflicts=ssh.service
ConditionPathExists=!/etc/ssh/sshd_not_to_be_run

[Socket]
ListenStream=22
Accept=yes

[Install]
WantedBy=sockets.target

sakura@sakura:~$ grep -Ev '^#|^$' /etc/ssh/sshd_config
Include /etc/ssh/sshd_config.d/*.conf
KbdInteractiveAuthentication no
UsePAM yes
X11Forwarding yes
PrintMotd no
AcceptEnv LANG LC_*
Subsystem       sftp    /usr/lib/openssh/sftp-server
  1. Install dependent packages offline.
~$ cd /tmp/
~$ sudo apt-get download $(apt-cache depends --recurse --no-recommends --no-suggests --no-conflicts --no-breaks --no-replaces --no-enhances --no-pre-depends gcc make libssl-dev zlib1g-dev | grep -v i386 | grep "^\w")
~$ sudo dpkg -i *.deb
~$ gcc -v
~$ make -v
  1. Upgrade openssh.
~$ wget https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-10.0p1.tar.gz -P /tmp/
~$ sudo tar zxf /tmp/openssh-10.0p1.tar.gz -C /usr/local/
~$ cd /usr/local/openssh-10.0p1/
~$ sudo ./configure --prefix=/usr/local/ssh --sysconfdir=/etc/ssh
~$ sudo make -j 4 && sudo make install

# Unsupported option UsePAM on 10.0p1
~$ sudo sed -i '/^UsePAM/s/^/#/' /etc/ssh/sshd_config

~$ sudo mv /usr/sbin/sshd /usr/sbin/sshd.bak
~$ sudo mv /usr/bin/ssh /usr/bin/ssh.bak
~$ sudo mv /usr/bin/ssh-keygen /usr/bin/ssh-keygen.bak

~$ sudo cp -f /usr/local/ssh/sbin/sshd /usr/sbin/sshd
~$ sudo cp -f /usr/local/ssh/bin/ssh /usr/bin/ssh 
~$ sudo cp -f /usr/local/ssh/bin/ssh-keygen /usr/bin/ssh-keygen

~$ sudo systemctl restart ssh
~$ sudo systemctl status ssh
~$ ssh -V
OpenSSH_10.0p2, OpenSSL 3.0.2 15 Mar 2022
  1. Change SSH default port.
~$ sudo vi /lib/systemd/system/ssh.socket
Port 2222

~$ sudo vi /lib/systemd/system/ssh.socket
ListenStream=2222

~$ sudo systemctl daemon-reload
~$ sudo systemctl restart ssh.socket
~$ systemctl status ssh.socket

Errors

configure: error: *** zlib.h missing

Workaround: sudo apt install zlib1g-dev

configure: error: *** working libcrypto not found

Workaround: sudo apt install libssl-dev