Centos7升级OpenSSH到OpenSSH_8.0p1版本

柔光的暖阳◎ 2022-09-06 01:21 243阅读 0赞

> Centos7升级OpenSSH到OpenSSH\_8.0p1版本

##### 1、升级要求 #####

升级至openssl 1.1.1版本  
升级至openssh 8.0版本  
ssh -V 当前查看版本

##### 2、安装telnet （以防升级失败，连不上服务器，建议弄） #####

4  2020-11-01 16:34:22 rpm -qa | grep telnet     
        5  2020-11-01 16:34:24 rpm -qa | grep xinetd   
        6  2020-11-01 16:34:34 yum -y install telnet* 
        7  2020-11-01 16:34:42 yum -y install xinetd   
        8  2020-11-01 16:34:56 systemctl enable xinetd.service
        9  2020-11-01 16:35:13 systemctl enable telnet.socket
       10  2020-11-01 16:35:24 systemctl enable telnet.sockesystemctl enable telnet.sockett
       11  2020-11-01 16:35:34 systemctl start telnet.socket  
       12  2020-11-01 16:35:47 systemctl start xinetd
       13  2020-11-01 16:36:02  vi /etc/securetty
       在最后添加两行 pts/0    pts/1
       14  2020-11-01 16:36:32 systemctl restart xinetd
       15  2020-11-01 16:36:42 netstat -plnt |grep 23 # 确认下是否启动成功

##### 3、升级OpenSSl #####

cd /opt/
    scp  root@62.234.150.127:/tmp/open* ./ #上传软件
    [root@VM-39-10-centos ~]# cd /opt/
    [root@VM-39-10-centos opt]# ls
    mellanox  openssh-8.0p1  openssh-8.0p1.tar.gz  openssl-1.1.1c  openssl-1.1.1c.tar.gz  rh
    [root@VM-39-10-centos opt]#

tar zxvf openssl-1.1.1c.tar.gz
    cd openssl-1.1.1c
    ./config --prefix=/usr/local/openssl  #检查环境
    ./config –t
    make     #编译
    make install      #编译安装
    
    cd /usr/local
    ldd /usr/local/openssl/bin/openssl    #检查函数库
    echo "/usr/local/openssl/lib" >> /etc/ld.so.conf    #添加所缺函数库
    ldconfig -v        #更新函数库
    openssl/bin/openssl version      #查看新安装的版本
     
    which openssl           #查看旧版本openssl命令在哪里
    mv /bin/openssl /usr/bin/openssl.old      #将旧版本openssl移除
    ln -s /usr/local/openssl/bin/openssl /usr/bin/openssl           #新版本制作软链接
    openssl version         最后查看版本，更新完毕

[root@VM-39-10-centos opt]# openssl version 
    OpenSSL 1.1.1c  28 May 2019
    [root@VM-39-10-centos opt]# #更新完毕

##### 4、升级openssh #####

mv /etc/ssh /etc/ssh.old
    ### 需要注意，移除之后，不能退出当前终端，若退出，只能通过telnet连了
     cd /opt/
     tar -zxvf  openssh-8.0p1.tar.gz 
     cd openssh-8.0p1/
     yum install -y gcc gcc-c++ glibc make autoconf openssl openssl-devel pcre-devel pam-devel pam* zlib*
     ./configure --prefix=/usr/local/openssh --sysconfdir=/etc/ssh --with-pam --with-ssl-dir=/usr/local/openssl --with-md5-passwords --mandir=/usr/share/man --with-zlib=/usr/local/zlib --without-hardening
    echo $?
    make && make install 
    echo $?
     s -l ./contrib/redhat/sshd.init

# 拷贝启动脚本
    cp ./contrib/redhat/sshd.init /etc/init.d/sshd
    # 修改启动脚本
    vim /etc/init.d/sshd
    # 按如下修改,需要注意，此路径是你安装新版本的openssh路径，根据你的实际情况修改
    SSHD=/usr/local/openssh/sbin/sshd
    
    ### 注意根据自身情况修改路径
    /usr/local/openssh/bin/ssh-keygen –A
    /sbin/restorecon /etc/ssh/ssh_host_key.pub
    /sbin/restorecon /etc/ssh/ssh_host_rsa_key.pub
    /sbin/restorecon /etc/ssh/ssh_host_dsa_key.pub
    /sbin/restorecon /etc/ssh/ssh_host_ecdsa_key.pub

[root@VM-39-10-centos openssh-8.0p1]# echo "PermitRootLogin yes" >> /etc/ssh/sshd_config
    [root@VM-39-10-centos openssh-8.0p1]# echo 'X11Forwarding yes' >> /etc/ssh/sshd_config
    [root@VM-39-10-centos openssh-8.0p1]# echo "PasswordAuthentication yes" >> /etc/ssh/sshd_config 
    [root@VM-39-10-centos openssh-8.0p1]# for i in $(rpm -qa |grep openssh);do rpm -e $i --nodeps ;done
    警告：/etc/ssh/moduli 已另存为 /etc/ssh/moduli.rpmsave
    警告：/etc/ssh/ssh_config 已另存为 /etc/ssh/ssh_config.rpmsave
    警告：/etc/ssh/sshd_config 已另存为 /etc/ssh/sshd_config.rpmsave
    [root@VM-39-10-centos openssh-8.0p1]# mv /etc/ssh/sshd_config.rpmsave /etc/ssh/sshd_config
    [root@VM-39-10-centos openssh-8.0p1]# 
    [root@VM-39-10-centos openssh-8.0p1]# mv /etc/ssh/ssh_config.rpmsave /etc/ssh/ssh_config
    [root@VM-39-10-centos openssh-8.0p1]# 
    [root@VM-39-10-centos openssh-8.0p1]# mv /etc/ssh/moduli.rpmsave /etc/ssh/moduli
    [root@VM-39-10-centos openssh-8.0p1]# cp -arp /usr/local/openssh/bin/* /usr/bin/
    [root@VM-39-10-centos openssh-8.0p1]# service sshd restart
    Restarting sshd (via systemctl):                           [  OK  ]
    [root@VM-39-10-centos openssh-8.0p1]# ssh -V 
    OpenSSH_8.0p1, OpenSSL 1.1.1c  28 May 2019
    [root@VM-39-10-centos openssh-8.0p1]# chkconfig --add sshd
    [root@VM-39-10-centos openssh-8.0p1]# chkconfig --level 2345 sshd on
    [root@VM-39-10-centos openssh-8.0p1]# systemctl stop telnet.socket 
    [root@VM-39-10-centos openssh-8.0p1]# ssh 49.232.141.113
    The authenticity of host '49.232.141.113 (49.232.141.113)' can't be established. ECDSA key fingerprint is SHA256:YURCHUWDH7YGwNetYX5iduAJhwC5DJclN/1akV2l9t0. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '49.232.141.113' (ECDSA) to the list of known hosts. root@49.232.141.113's password: 
    Last login: Sun Nov  1 16:33:34 2020 from 223.20.102.110
    [root@VM-39-10-centos ~]#