OpenSSH: keep the SSH server patched and restart it safely

Updated November 2026

OpenSSH is the front door of almost every Linux and Unix server, so its updates go to the top of the list. Install your distribution’s fixed openssh-server package, test the configuration with sudo sshd -t, restart the SSH service, and then reconnect so your own session runs the new code.

What OpenSSH is

OpenSSH is the standard SSH implementation on Linux, the BSDs, macOS and most other Unix systems. It is developed by the OpenBSD project; the “portable” version (version numbers ending in p1, p2…) is the one built for Linux and other systems. A server runs the sshd daemon, which listens on TCP port 22 and starts a separate process for every connection. Clients use ssh, scp and sftp, and ssh-agent holds keys.

Because sshd is reachable from the network before anyone logs in, a flaw in its pre-authentication code is one of the worst things that can happen to a server. The 2024 race condition below is the reminder.

Check the installed version

ssh -V                                  # client version
dpkg-query -W openssh-server openssh-client   # Debian, Ubuntu
rpm -q openssh-server openssh-clients         # RHEL, Fedora, SUSE
apk info -v | grep openssh                    # Alpine
freebsd-version -u                            # FreeBSD (OpenSSH is in base)

The package version is what matters, not just the upstream number. Debian 12 still ships OpenSSH 9.2p1, but as package version 1:9.2p1-2+deb12u… with many security fixes added. To see what the running server announces, read the banner it sends:

ssh -v -o BatchMode=yes localhost true 2>&1 | grep 'remote software version'

On Debian and Ubuntu the banner includes the package revision (for example OpenSSH_9.6p1 Ubuntu-3ubuntu13.5), which helps you confirm a restart actually happened. To check whether a specific CVE is fixed in your package, search the package changelog:

apt changelog openssh-server | grep CVE-2024-6387       # Debian, Ubuntu
rpm -q --changelog openssh-server | grep CVE-2024-6387  # RHEL family, SUSE

Supported versions

OpenSSH does not publish end-of-life dates or long-term branches. Fixes appear in the next release, and in practice your support period is your operating system’s support period. Recent releases, as of November 2026:

Since 10.0, sshd runs authentication in its own sshd-auth process, so the pre-authentication code runs in a separate address space. If you build OpenSSH yourself, make sure sshd-auth and sshd-session are installed along with sshd.

Distribution packages and backports

Stable distributions rarely move to a new OpenSSH version. Instead they backport: they copy the security fix into the version they already ship. For CVE-2024-6387, for example, Debian fixed bookworm in 1:9.2p1-2+deb12u3 (DSA-5724-1) and Ubuntu fixed 22.04 LTS in 1:8.9p1-3ubuntu0.10 (USN-6859-1). Scanners that only compare version numbers will flag these as vulnerable; check the distribution tracker before you panic.

Use the distribution package. Building OpenSSH from openssh.com source on a production server means you take over every future security update yourself, and you lose the distribution’s PAM, SELinux and systemd integration.

Update OpenSSH

Updating everything with your normal security update command also updates OpenSSH. To update just OpenSSH quickly:

# Debian, Ubuntu
sudo apt update
sudo apt install --only-upgrade openssh-server openssh-client

# RHEL, AlmaLinux, Rocky, Oracle Linux, Fedora
sudo dnf upgrade 'openssh*'

# SUSE, openSUSE
sudo zypper refresh
sudo zypper update 'openssh*'

# Alpine (as root)
apk -U upgrade

# FreeBSD (as root): OpenSSH is part of the base system
freebsd-update fetch install        # installed from distribution sets
pkg upgrade -r FreeBSD-base         # installed from base packages (15.0 and later)

On Alpine, a full upgrade is the safe choice because packages from one branch are meant to be upgraded together. On FreeBSD, OpenSSH fixes come as FreeBSD security advisories; the optional security/openssh-portable port is updated with pkg upgrade instead. See the FreeBSD page for details.

Restart sshd safely

Package scripts usually restart the listener for you, but check. Always test the configuration first and keep your current session open until a new login works:

sudo sshd -t                       # no output means the config is valid

# restarts the SSH service; existing sessions stay connected
sudo systemctl restart ssh         # Debian, Ubuntu
sudo systemctl restart sshd        # RHEL family, Fedora, SUSE
rc-service sshd restart            # Alpine, as root
service sshd restart               # FreeBSD, as root

Restarting the service only replaces the listener. Every connection that is already open keeps running the old per-session code until it ends. Log out and back in, and look for long-lived sessions (tmux hosts, port forwards, automation) that you should close:

who
sudo ss -tnp state established '( sport = :22 )'

On Ubuntu 22.10 and later, sshd is started through ssh.socket (socket activation). A normal systemctl restart ssh is still right after an update. If you also changed Port or ListenAddress, run sudo systemctl daemon-reload and sudo systemctl restart ssh.socket. If you get locked out, see Locked out of SSH.

Verify

• The package version matches the fixed version on your distribution’s tracker.
• The banner check above shows the new version or package revision.
• sudo needrestart -r l (Debian, Ubuntu), sudo dnf needs-restarting -s (RHEL family) or sudo zypper ps -s (SUSE) no longer lists the SSH service.
• A fresh login from a second terminal works before you close the old one.

Notable recent vulnerabilities

The 10.4, 10.5 and 10.6 releases (July to October 2026) also contain security fixes, for example stricter path checks in sftp and scp, a pre-authentication denial of service with GSSAPIAuthentication, and the restrict keyword in authorized_keys not fully applying to tunnel forwarding. Check whether your distribution has backported them. See also the vulnerability list.

Where advisories are published

• OpenSSH security page and the release notes, which list security fixes first in each release.
• The openssh-unix-announce@mindrot.org mailing list: closed for posting and very low volume, used for release announcements. Subscription details are on the OpenSSH mailing lists page.
• Your distribution: the Debian security tracker, Ubuntu Security Notices, Red Hat and SUSE errata. See Security advisories.

Quick hardening tips

• Use key-based logins and set PasswordAuthentication no once every admin has a working key.
• Set PermitRootLogin no (or prohibit-password if automation needs root keys).
• Limit who can log in with AllowUsers or AllowGroups.
• Restrict port 22 in the firewall to admin networks or a VPN where possible (firewall guide).
• Leave PerSourcePenalties at its default (on) and use PerSourcePenaltyExemptList only for trusted monitoring hosts.
• Do not forward your agent (ssh -A) to servers you do not fully trust; use ProxyJump instead.
• Check the effective configuration with sudo sshd -T, because Match blocks and included files can override what you think is set.
• Replace any old DSA keys with Ed25519 keys; OpenSSH 10.0 and later no longer accept DSA.

More detail is in SSH hardening.

Sources

• OpenSSH Security, OpenSSH project
• OpenSSH Release Notes, OpenSSH project
• OpenSSH 9.8 release notes (race condition, sshd-session), OpenSSH project
• OpenSSH mailing lists, OpenSSH project
• CVE-2024-6387, Debian security tracker
• CVE-2024-6387, Ubuntu security
• OpenSSH server, Ubuntu Server documentation
• sshd now uses socket-based activation (Ubuntu 22.10 and later), Ubuntu Discourse
• openssh source package, Debian security tracker