I want to install SSH so I went to pkgmaster.com. I found the OpenSSH 3.4p1-PM4 package but it requires the latest OS Update, which I think is OSUpdate 2.0. I still have OSUpdate 1.0. Do you know where I can find another older SSH version? Thank you.
Older versions of SSH are simply that - old. If you install an older version of SSH you will also be installing all the bugs and possible security holes that come with it.
You should (ideally) go to the official Sun Cobalt site and download and install all their updates
Then go to pkgmaster and grab all of theirs (in the correct order)
If you don't you potentially have an open box.
If nothing else at least install the apache fix if you haven't already
You should listen carefully to the advice you're already been given. You should not even connect a RaQ4 server that only has OSUpdate1 on to the internet and it could well be compromised already if not soon.
It's not a question of whether it is vulnerable. It is. It can be hacked now (if it's connected to the internet) using various root exploits and SSH access is the least of your security concerns and TELNET will serve you just as well considering how vulnerable the box is until you upgrade it to the level you can install SSH on it.
It's even known that hosts that provide RaQ hosting have their IP blocks trawled for newly connected servers with scripts that will automatically compromise it.
I'm not just doom mongering either. We've heard from plenty of people, e.g. on the Cobalt Users lists that have had the servers hacked as they were handed over to them from their providers not having even logged into the things.
Now, to your question...
If you want to compile it yourself and don't care about the risk to your server you will need to:
1. Download and install openssl from source tarball using a config command something like:
./config --prefix=/usr --openssldir=/usr/share/ssl shared
2. Download and install openssh from source tarball using a configure command something like:
./configure --prefix=/usr --sysconfdir=/etc/ssh --localstatedir=/var --with-pam
But doing it from package onto a properly upgraded server is much easier