I have 3.6.1p2-18 installed from up2date (whitebox channel from nc mirror). up2date says all packages on my system are current - none to update. I heard that ssh lower than 3.7 is remotely exploitable. But I also heard that redhat doesn't change the version numbers. Thanks, Matt