How often does OpenSSH Get Updated on 3cx? v20

[UCMUserAZ]

Hi all. Been testing out v20 Enterprise 3cx. Great features. As we review, our Security team wanted to inquire how often the OpenSSH is patched or updated? Looks like OpenSSH is on 9.2p1 currently for v20 update 1 (build 673 beta). Do we know when the next OpenSSH update will come?

 

[SweetAction]

Hi all. Been testing out v20 Enterprise 3cx. Great features. As we review, our Security team wanted to inquire how often the OpenSSH is patched or updated? Looks like OpenSSH is on 9.2p1 currently for v20 update 1 (build 673 beta). Do we know when the next OpenSSH update will come?

3CX releases OS updates with their patches, so it's not near realtime, it's highly delayed. OS updates (and their packages) aren't in every update and are only installed if you have auto-updates turned on.

All this to say - likely not for a few months. But that is a major guess.

 

[UCMUserAZ]

Thanks. Trying to see if it will get a newer OpenSSH version soon. See if 3cx comments. Thanks for the info though.

 

[SteveITS]

Debian security updates are sometimes issued in between 3CX updates. They are not announced here AFAIK but are posted at
https://www.3cx.com/blog/change-log/pbx-security-updates/. (case in point, a new list for April)
As noted they install if auto updates are enabled, they don't install if one updates 3CX manually.

 

[UCMUserAZ]

Debian security updates are sometimes issued in between 3CX updates. They are not announced here AFAIK but are posted at
https://www.3cx.com/blog/change-log/pbx-security-updates/. (case in point, a new list for April)
As noted they install if auto updates are enabled, they don't install if one updates 3CX manually.

Great information. I was not aware that if you had Auto on you would get the linux patches behind the scenes. I see OpenSSH 9.2 installed in Feb 2024. Some of the scans recommended 9.6 or above. I will enable auto and see how it goes. Thanks again.

 

[SteveITS]

One other note...3CX recommends NOT installing updates at the command line because they will install updates they have tested/recommend.

IOW they really want people to use Auto, even if they turn Auto on/off when desired.

 

[SweetAction]

Debian security updates are sometimes issued in between 3CX updates. They are not announced here AFAIK but are posted at
https://www.3cx.com/blog/change-log/pbx-security-updates/. (case in point, a new list for April)
As noted they install if auto updates are enabled, they don't install if one updates 3CX manually.

Well now I'm really curious if 3CX is shipping security updates without patches/action needed. Maybe @Agathocles Prodromou can shed some light on this.

 

[SteveITS]

They do, if auto updates are enabled. Check that security change log URL. I think it restarts the server (?), at least, we receive a handful of those sorts of emails when these updates install.

 

[Agathocles Prodromou]

Hello,

The frequency with which we push debian packages updates varies. We review and evaluate available updates, if they are normal updates or security ones, if they are dependencies of 3CX, the severity of any vulnerabilities an update fixes, their exploitability and more.

Given that all packages are first tested by our team before they make it to the repository, you don't immediately see them after they are released in the official Debian repo. Again, it depends on many factors how much that delay might be.

Now regarding the initial question, our repository currently has the latest available stable version of openssh. Don't rely too much on vulnerability scanner reports because they will commonly just blindly check what is the latest available version and list it. In this case, the suggested 9.6 version is in the testing debian repo. We don't push packages from testing/unstable repositories as they are not ready for production use.

Lastly, if you have 3CX Automatic Updates enabled Debian updates will be installed regardless if there is a 3CX update or not. (meaning a 3CX update/service pack is not required for the O,S packages to be updated.)

 

[VoIPTools]

I've been using 3CX for more than 15 years, and worked for 3CX in the support department, and I did not know Automatic Updates does more than just install service packs and version upgrades. Somehow I missed that memo. Nevertheless, in my opinion, if you must use auto-updates to get an urgent security patch, do not leave it on. You want to be in control when updates are installed. Turn it on, get your patches, and turn it off at the earliest possible moment.

What we really need is the ability to choose what updates are automatically installed. Perhaps something like the following:

X Security Patches only
X Service Packs
X Version Upgrades
X Betas

Thanks @Agathocles Prodromou for the confirmation.

 

[SteveITS]

Also worth noting, SBC OS updates are not installed.

prior thread ref: https://www.3cx.com/community/threa...lled-via-automatic-updating.79651/post-367011
and: https://www.3cx.com/community/threads/3cx-debian-vm-crash.79543/post-366821

 

[SweetAction]

Hello,

The frequency with which we push debian packages updates varies. We review and evaluate available updates, if they are normal updates or security ones, if they are dependencies of 3CX, the severity of any vulnerabilities an update fixes, their exploitability and more.

Given that all packages are first tested by our team before they make it to the repository, you don't immediately see them after they are released in the official Debian repo. Again, it depends on many factors how much that delay might be.

Now regarding the initial question, our repository currently has the latest available stable version of openssh. Don't rely too much on vulnerability scanner reports because they will commonly just blindly check what is the latest available version and list it. In this case, the suggested 9.6 version is in the testing debian repo. We don't push packages from testing/unstable repositories as they are not ready for production use.

Lastly, if you have 3CX Automatic Updates enabled Debian updates will be installed regardless if there is a 3CX update or not. (meaning a 3CX update/service pack is not required for the O,S packages to be updated.)

Can you clarify if OS/Security updates are pushed without 3CX updates? Meaning with automatic updates turned on, would I get a package update without getting a 3CX version update?

 

[SteveITS]

The auto update process will install all pending updates available at the time it triggers, either 3CX, security, or both. The security updates may be released without a 3CX update.

Our last round, it installed the February Debian updates without upgrading to v20.

 

[UCMUserAZ]

Hello,

The frequency with which we push debian packages updates varies. We review and evaluate available updates, if they are normal updates or security ones, if they are dependencies of 3CX, the severity of any vulnerabilities an update fixes, their exploitability and more.

Given that all packages are first tested by our team before they make it to the repository, you don't immediately see them after they are released in the official Debian repo. Again, it depends on many factors how much that delay might be.

Now regarding the initial question, our repository currently has the latest available stable version of openssh. Don't rely too much on vulnerability scanner reports because they will commonly just blindly check what is the latest available version and list it. In this case, the suggested 9.6 version is in the testing debian repo. We don't push packages from testing/unstable repositories as they are not ready for production use.

Lastly, if you have 3CX Automatic Updates enabled Debian updates will be installed regardless if there is a 3CX update or not. (meaning a 3CX update/service pack is not required for the O,S packages to be updated.)

Hi Agathocles. Thank you for this information. Great information to know. I will relay the information on the stable version of openssh in Debian. Also, good to know about the Auto updates gets Debian updates regardless if there is a 3cx update/service pack. Thanks again.

 

[VoIPTools]

The auto update process will install all pending updates available at the time it triggers, either 3CX, security, or both. The security updates may be released without a 3CX update.

Our last round, it installed the February Debian updates without upgrading to v20.

Yes, it will install any available service packs and that's precisely why I have a problem with Automatic Updates. Fortunately, full version updates, and betas require the user to manually select the update and download/install. Only crazy people would allow 3CX to install a service pack on the 3CX schedule rather than yours. What happens if the service pack install goes poorly on a Sunday night. The last thing I need is a non-functional phone system on a Monday morning. I plan, coordinate, and schedule updates for Friday so I have the entire weekend to recover if something goes sideways.

 

[UCMUserAZ]

Question. So is it safe to say if it shows on this site: https://www.3cx.com/blog/change-log/pbx-security-updates/
That having Auto selected it will install those updates? Thanks again.

 

[SteveITS]

I plan, coordinate, and schedule updates for Friday so I have the entire weekend to recover if something goes sideways.

us too

if it shows on this site: https://www.3cx.com/blog/change-log/pbx-security-updates/
That having Auto selected it will install those updates?

yes. Note v20 and v18 are listed separately on that page.

 

[UCMUserAZ]

Thank you all for the information. I just did it and the system received all those latest Security updates in the hour timeframe I selected.

 

[SteveITS]

did not know Automatic Updates does more than just install service packs and version upgrades

I try to bring it up in every conversation I find here, since that first one I stumbled into, since it's not apparent.

ability to choose what updates are automatically installed. Perhaps something like the following:

X Security Patches only
X Service Packs
X Version Upgrades
X Betas

That would be interesting (you could make an Idea... ) and I could see some people wanting to select those separately. And notably, beta not alpha so no one gets surprised.

 

[Agathocles Prodromou]

Can you clarify if OS/Security updates are pushed without 3CX updates? Meaning with automatic updates turned on, would I get a package update without getting a 3CX version update?

It depends. If there is a new stable service pack released for the version you are running then it will install that too.

Example of expected result with Automatic Updates enabled (on a healthy installation):
----------------------------------------------------------------------
Running version: 18.0.8.939
Available version: 18.0.9.20 (stable/final release)
Will it update?: Yes

Running version: 18.0.9.20
Available version: 20.0.0.1620 (stable/final release)
Will it update?: No (not only because there is an O.S upgrade required but also because it's a new major version)

Running version: 20.0.0.1620
Available version: 20.0.1.673 (Beta release)
Will it update?: No

Running version: 20.0.0.1620
Available version: 20.0.1.XXX (stable/final release)
Will it update?: Yes
----------------------------------------------------------------------

* The versions listed above are just for reference, don't expect this behavior for those exact versions if you are reading this in the future.
** The above apply as of the time of writing.