Subject: Re: How to update to the latest OpenSSH?
To: Paul Hoffman <phoffman@proper.com>
From: Manuel Bouyer <bouyer@antioche.eu.org>
List: tech-security
Date: 12/05/2001 19:36:44
On Tue, Dec 04, 2001 at 07:21:57PM -0800, Paul Hoffman wrote:
> So, back to my original questions. If I want to (a) update to the 
> latest OpenSSH and (b) take steps to prevent the badness of going to 
> an older version if I update to, say, 1.5.2, what can I do? I can 
> make OpenSSH from pkgsrc and edit /etc/rc.d/sshd to point to 
> /usr/pkg, but how do I prevent a future update from overwriting 
> /etc/rc.d/sshd and pointing to /usr/sbin/sshd? Simply removing 
> /usr/sbin/sshd won't be enough, because the future update will 
> probably put in a new sshd. Is there some fancy permissions thing I 
> can do cause the future update to fail to change /etc/rc.d/sshd?

I don't think update touch files in /etc yet, you have to do the merge by
hand.

One thing that should make things safe:
copy /etc/rc.d/sshd to /etc/rc.d/opensshd
in /etc/rc.d/opensshd change rcvar from $name to opensshd (or change name to
opensshd and command to /usr/pkg/sbin/sshd).
Then in /etc/rc.conf set sshd to NO and opensshd to YES.

--
Manuel Bouyer <bouyer@antioche.eu.org>
--