Linode.com Forum

[Risar]

as a point of reference: this is the reason that major vendors dont usually accept patches ad-hoc.

Something like this company wide would be a major PITA.

[aag]

tronic wrote:
I had to do 'sudo apt-get update && sudo apt-get dist-upgrade' to get the full set of updated openssh packages since a few were held back otherwise.
How can I tell whether OpenSSL was upgraded when I did this? I still get the following results:
Code:   # ssh -V
  OpenSSH_4.6p1 Debian-5ubuntu0.5, OpenSSL 0.9.8e 23 Feb 2007

  # openssl
  OpenSSL> version
  OpenSSL 0.9.8e 23 Feb 2007

Those are the same results I got before I upgraded. Does that mean that I'm not running the new versions, or is there some sub-version information that isn't printed? Something definitely did change, because <ssh-vulnkey> is now installed, and it runs.

[SteveG]

Yes, there is deb package specific version info that won't show up in the vendor commands. Try 'dpkg -l openssh-server', or look in the Debian changelog for the package. For example:

$ dpkg -l openssh-server
||/ Name Version Description
+++-==============-==============-============================================
ii openssh-server 1:4.7p1-10 secure shell server, an rshd replacement

The part after the dash (-10) is the Debian specific release number. It says this is the 10th version of the Debian package for openssh 4.7p1.