Openssh升级到8.6p1版本

野性酷女 2022-09-09 06:22 278阅读 0赞

Openssh升级到8.6p1版本

1，安装所需环境变量

> yum -y install zlib zlib-devel openssl-devel pam-devel pam-krb5  
> krb5-devel krb5-libs pam-devel

2，下载安装包

> http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-8.6p1.tar.gz

3， 升级步骤  
tar -zxvf openssh-8.6p1.tar.gz  
cd openssh-8.6p1

./configure --prefix=/usr --sysconfdir=/etc/ssh --with-pam --with-zlib --with-ssl-dir=/usr --with-md5-passwords --mandir=/usr/share/man --with-kerberos5=/usr/lib64/libkrb5.so

会出现以下提示：  
PAM is enabled. You may need to install a PAM control file for sshd, otherwise password authentication may fail.Example PAM control files can be found in the contrib/ subdirectory

cp /etc/init.d/sshd /etc/init.d/sshd_old
    cp /etc/pam.d/sshd /etc/pam.d/sshd_old
    cd openssh-7.5p1/contrib/redhat
    cp sshd.init /etc/init.d/sshd
    cp sshd.pam /etc/pam.d/sshd
    修改/etc/ssh/sshd_config中 UsePAM yes

make && make install

检查版本  
ssh -V

4，重启sshd服务

> service sshd restart

遇到了执行重启命令时卡住的问题，解决办法：

> rm -f /usr/lib/systemd/system/sshd.service  
> systemctl daemon-reload

再次执行重启命令就会成功

> service sshd restart

5，注：ssh升级后，默认关闭root远程登录，如果需要，请打开

6，如果无法登录，请修改/etc/pam.d/sshd

auth       required     pam_sepermit.so
    auth       include      password-auth
    account    required     pam_nologin.so
    account    include      password-auth
    password   include      password-auth
    session    required     pam_selinux.so close
    session    required     pam_loginuid.so
    session    required     pam_selinux.so open env_params
    session    required     pam_namespace.so
    session    optional     pam_keyinit.so force revoke
    session    include      password-auth

7，升级过程中遇到的问题  
*configure: error: \*\*\* working libcrypto not found, check config.log*

> 原因是openssh的版本高，和主机中的openssl不兼容造成的，故需要升级openssl  
> 特别要注意，升级openssl也是比较危险的操作，要注意选好版本和回退  
> openssl安装包下载地址：https://ftp.openssl.org/source/old/

升级openssl

> tar -zxvf openssl-1.1.1g.tar.gz  
> cd openssl-1.1.1g  
> ./config --prefix=/usr --openssldir=/etc/ssl --shared zlib  
> make && make test && make install  
> openssl version -a (查看是否升级成功)

openssl升级完成后再执行openssh的./configure操作