Upgrade openssh on OS X with homebrew for PCI compliance

The existing version of openssh on OS X 10.7.4 is SSH-2.0-OpenSSH_5.6, which is not, unfortunately, PCI Compliant. So, I need to upgrade it and I have been trying to do so with Homebrew.

So far, what I've done is:

brew tap homebrew/dupes
brew install openssh


No problem, all went well, and now when I try which ssh I get:

which ssh

/usr/local/bin/ssh


Which seems fine, also which sshd gives:

which sshd

/usr/local/sbin/sshd


and ssh -v duly reports:

ssh -v

OpenSSH_5.9p1, OpenSSL 0.9.8r 8 Feb 2011


So far so good. But here's where I'm out of my element. Port 22 is still using the OS installed version, which is to say that telnet hostname 22 reports:

telnet hostname 22

SSH-2.0-OpenSSH_5.6


I've tried mucking around with /System/Library/LaunchDaemons/ssh.plist with no luck.

So, my questions are (probably in reverse order of importance):

I'm frustrated about not passing the PCI Compliance scan and need to get this figured out, and frankly I'm considering changing all the e-commerce websites on my server over to stripe.com, but I would like to get this figured out. Also, does anyone know if openssh will be upgraded in Mountain Lion?

Edit: Here's what I've been trying in /System/Library/LaunchDaemons/ssh.plist:

I've only edited one line, changing:

<string>/usr/sbin/sshd</string>


To

<string>/usr/local/sbin/sshd</string>


And then I tried sudo kill -HUP 1 as suggested by @the-paul below, as well as restarting the Mac.

sudo kill -HUP 1

Telnetting in from a remote still shows SSH-2.0-OpenSSH_5.6

SSH-2.0-OpenSSH_5.6

My whole ssh.plist file now looks like this: http://pastie.org/private/qnhofuxomawjdypp9wgaq

2 Answers
2

Daemons like this are controlled on OS X by launchd, which is in turn configured by files in directories like /System/Library/LaunchDaemons/ and /Library/LaunchDaemons. On at least Lion and Snow Leopard, the default ssh daemon is defined by /System/Library/LaunchDaemons/ssh.plist.

launchd

/System/Library/LaunchDaemons/

/Library/LaunchDaemons

/System/Library/LaunchDaemons/ssh.plist

You can open that up as root with a text editor, and change the value for the "Program" key from /usr/libexec/sshd-keygen-wrapper to the path you want; in your case, that's probably /usr/local/sbin/sshd. Then you also need to change the first of the ProgramArguments strings, the one saying /usr/sbin/sshd, since that is meant as an argument to launchproxy. Then, to reload,

Program

/usr/libexec/sshd-keygen-wrapper

/usr/local/sbin/sshd

ProgramArguments

/usr/sbin/sshd

launchproxy

sudo launchctl unload -w /System/Library/LaunchDaemons/ssh.plist
sudo launchctl load -w /System/Library/LaunchDaemons/ssh.plist


I don't see how that should cause any conflicts with normal or well-behaved OS X software.

Yes, that seems like a very reasonable thing to me. Security is important.

This is not really a very answerable question. But almost certainly, yes, same as everyone else :^)

Nope. The only thing to really worry about is that you keep your sshd up-to-date with security as well or better than the OS does. If you're aware of concerns like the one posed by this question, then I don't think that will be a problem for you.

Edit: Corrected my suggestions for editing ssh.plist (tested it this time).

ssh.plist

exec /usr/sbin/sshd $@

$@

sshd-keygen-wrapper

sshd-keygen-wrapper

-i

This is what I did. Based on the above discussion. Successfully tested on 10.11.6 (El Capitan)

Edit /System/Library/LaunchDaemons/ssh.plist so that the corresponding key reflects…

/System/Library/LaunchDaemons/ssh.plist

<key>ProgramArguments</key>
<array>
<string>/usr/local/sbin/sshd</string>
<string>-i</string>
</array>


Edit shell script /usr/libexec/sshd-keygen-wrapper so that the last command reflects the following:

/usr/libexec/sshd-keygen-wrapper

exec /usr/local/sbin/sshd $@


Clone /etc/ssh/ directory content:

/etc/ssh/

$ sudo cp /etc/ssh/ssh* /usr/local/etc/ssh/


Make sure of solid file ownership and permissions:

$ sudo chmod 755 /usr/local/etc/ssh/
$ sudo chmod 600 /usr/local/etc/ssh/*_key
$ sudo chmod 644 /usr/local/etc/ssh/ssh,d_config,*.pub
$ sudo chown -R root:wheel /usr/local/etc/ssh/


Reload SSH dæmon:

$ sudo launchctl unload -w /System/Library/LaunchDaemons/ssh.plist
$ sudo launchctl load -w /System/Library/LaunchDaemons/ssh.plist


Note: the last entry, for example, is equivalent to systemsetup -setremotelogin on or activating Sharing service in System Preference panel.

systemsetup -setremotelogin on

Make sure of OpenSSH upgrade from Client:

$ ssh-audit <Server IP>
# general
(gen) banner: SSH-2.0-OpenSSH_7.8
(gen) software: OpenSSH 7.8
(gen) compatibility: OpenSSH 6.5+, Dropbear SSH 2013.62+
(gen) compression: enabled (zlib@openssh.com)


Install OpenSSH:

$ brew install openssh


Clone /etc/ssh/ directory content.

/etc/ssh/

Make sure of solid file ownership and permissions.

Thanks for contributing an answer to Stack Overflow!

But avoid …

To learn more, see our tips on writing great answers.

Required, but never shown

Required, but never shown

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.