centos7升级openssh7.4到8.1
由于公司做三级等级保护 需要升级openssh版本
首先查看openssh版本
[[email protected] openssh-8.1p1]# openssl version
OpenSSL 1.0.2r 26 Feb 2019
安装依赖
yum update openssh -y
yum install -y gcc gcc-c++ glibc make autoconf openssl openssl-devel pcre-devel pam-devel
yum install -y pam* zlib*
在opt下下载升级openssh需要的2个压缩包
cd /opt
wget -c https://openbsd.hk/pub/OpenBSD/OpenSSH/portable/openssh-8.1p1.tar.gz
wget -c https://ftp.openssl.org/source/openssl-1.0.2r.tar.gz
解压压缩包
tar xfz openssh-8.1p1.tar.gz
tar xfz openssl-1.0.2r.tar.gz
可能文件默认显示uid和gid数组都是1000，这里重新授权下
[[email protected] openssh-8.1p1]# chown -R root.root /opt/openssh-8.1p1
备份原文件
mv /usr/bin/openssl /usr/bin/openssl_bak
mv /usr/include/openssl /usr/include/openssl_bak
安装openssl
cd /opt/openssl-1.0.2r
./config shared && make && make install
添加软连接
ln -s /usr/local/ssl/bin/openssl /usr/bin/openssl
ln -s /usr/local/ssl/include/openssl /usr/include/openssl
echo "/usr/local/ssl/lib" >> /etc/ld.so.conf
应用并查看openssl 版本
备份原文件
cp -r /etc/ssh /tmp/
rm -rf /etc/ssh
修改数组
cd /opt/openssh-8.1p1
chown -R root.root /opt/openssh-8.0p1
chown -R root.root /opt/openssh-8.1p1
编译安装openssh8.1
./configure --prefix=/usr/ --sysconfdir=/etc/ssh --with-openssl-includes=/usr/local/ssl/include --with-ssl-dir=/usr/local/ssl --with-zlib --with-md5-passwords --with-pam && make && make install
修改/etc/ssh/sshd_config如下
[[email protected] ~]# grep "^PermitRootLogin" /etc/ssh/sshd_config
PermitRootLogin yes
[[email protected] ~]# grep "UseDNS" /etc/ssh/sshd_config
UseDNS no
[[email protected] ~]#
设置开机启动 这里确保service 和systemctl都设置开机启动
cp -a contrib/redhat/sshd.init /etc/init.d/sshd
cp -a contrib/redhat/sshd.pam /etc/pam.d/sshd.pam
chmod +x /etc/init.d/sshd
chkconfig --add sshd
systemctl enable sshd
mv /usr/lib/systemd/system/sshd.service /opt/
mv /usr/lib/systemd/system/sshd.socket /opt/
chkconfig sshd on
非生产的话 reboot 测试
附上升级的shell
|
cd /opt ssh -V openssl version yum update openssh -y #yum install xinetd telnet-server -y yum install -y gcc gcc-c++ glibc make autoconf openssl openssl-devel pcre-devel pam-devel yum install -y pam* zlib* wget -c https://openbsd.hk/pub/OpenBSD/OpenSSH/portable/openssh-8.1p1.tar.gz wget -c https://ftp.openssl.org/source/openssl-1.0.2r.tar.gz tar xfz openssh-8.1p1.tar.gz tar xfz openssl-1.0.2r.tar.gz mv /usr/bin/openssl /usr/bin/openssl_bak mv /usr/include/openssl /usr/include/openssl_bak cd /opt/openssl-1.0.2r ./config shared && make && make install echo $? ln -s /usr/local/ssl/bin/openssl /usr/bin/openssl ln -s /usr/local/ssl/include/openssl /usr/include/openssl echo "/usr/local/ssl/lib" >> /etc/ld.so.conf /sbin/ldconfig openssl version cd /opt/openssh-8.1p1 chown -R root.root /opt/openssh-8.0p1 chown -R root.root /opt/openssh-8.1p1 cp -r /etc/ssh /tmp/ rm -rf /etc/ssh ./configure --prefix=/usr/ --sysconfdir=/etc/ssh --with-openssl-includes=/usr/local/ssl/include --with-ssl-dir=/usr/local/ssl --with-zlib --with-md5-passwords --with-pam && make && make install echo $?
cat > /etc/ssh/sshd_config <<EOF PermitRootLogin yes AuthorizedKeysFile .ssh/authorized_keys UseDNS no Subsystem sftp /usr/libexec/sftp-server EOF grep "^PermitRootLogin" /etc/ssh/sshd_config cat /tmp/ssh/sshd_config |grep -v '#' |grep -v '^$' cp -a contrib/redhat/sshd.init /etc/init.d/sshd cp -a contrib/redhat/sshd.pam /etc/pam.d/sshd.pam chmod +x /etc/init.d/sshd chkconfig --add sshd systemctl enable sshd mv /usr/lib/systemd/system/sshd.service /opt/ mv /usr/lib/systemd/system/sshd.socket /opt/ chkconfig sshd on service sshd restart openssl version ssh -V |
升级完成之后 免密登陆的机子可能会连接不上，因为升级了openssh的版本，可能通讯方式的加密不一样了。需要删除或者清空/root/.ssh/known_hosts
参考