Centos7 OpenSSH升级 低版本安全漏洞修复

喜欢ヅ旅行 2023-06-12 11:16 119阅读 0赞

Centos7 OpenSSH升级 低版本安全漏洞修复

  • 绿盟检查出的漏洞
  • 修复方案-升级OpenSSH版本
    • 查看当前版本
    • 升级到最新版本
      • 官网查看最新版本
      • 下载并升级
        • 下载openssh-8.1p1.tar.gz
        • 卸载原Openssh
        • 解压openssh安装包
        • 检测环境是否满足
          • 可能出现的问题 解决问题之后重新检测环境 ./configure
        • 编译安装
      • 配置
        • 拷贝ssh服务文件
        • 允许root用户远程登录
        • 加入系统服务
        • 重启openssh，查看版本
        • 打开新窗口，并查看版本
      • SELinux如果是开启状态，断开后或者新开窗口无法连接

绿盟检查出的漏洞

在这里插入图片描述

修复方案-升级OpenSSH版本

查看当前版本

  1. [root@k8s-node1 ~]# ssh -V
  2. OpenSSH_7.4p1, OpenSSL 1.0.2k-fips  26 Jan 2017

升级到最新版本

官网查看最新版本

http://www.openssh.com/portable.html\#http
目前是8.1pl
在这里插入图片描述

下载并升级

下载openssh-8.1p1.tar.gz

  1. [root@k8s-node1 ~]# cd /usr/local/software/
  2. [root@k8s-node1 software]# ll
  3. total 1936
  4. drwxrwxr-x 7 root root    4096 Nov  4 23:19 redis-5.0.5
  5. -rw-r--r-- 1 root root 1975750 May 16 00:26 redis-5.0.5.tar.gz
  6. [root@k8s-node1 software]# wget https://openbsd.hk/pub/OpenBSD/OpenSSH/portable/openssh-8.1p1.tar.gz
  7. --2019-11-12 17:26:01--  https://openbsd.hk/pub/OpenBSD/OpenSSH/portable/openssh-8.1p1.tar.gz
  8. Resolving openbsd.hk (openbsd.hk)... 74.82.48.34, 2404:bb40::2
  9. Connecting to openbsd.hk (openbsd.hk)|74.82.48.34|:443... connected.
  10. HTTP request sent, awaiting response... 200 OK
  11. Length: 1625894 (1.5M) [application/x-gzip]
  12. Saving to: ‘openssh-8.1p1.tar.gz’
  14. 32% [====================================>                        ] 532,480     21.4KB/s  eta 52s

卸载原Openssh

  1. [root@k8s-node1 software]# rpm -qa |grep openssh
  2. openssh-clients-7.4p1-11.el7.x86_64
  3. openssh-7.4p1-11.el7.x86_64
  4. openssh-server-7.4p1-11.el7.x86_64
  5. [root@k8s-node1 software]# for i in $(rpm -qa |grep openssh);do rpm -e $i --nodeps;done
  6. [root@k8s-node1 software]#

解压openssh安装包

  1. [root@k8s-node1 software]# tar -zxvf openssh-8.1p1.tar.gz 
  2. openssh-8.1p1
  3. ·············
  4. openssh-8.1p1/config.h.in
  5. [root@k8s-node1 software]# cd openssh-8.1p1
  6. [root@k8s-node1 openssh-8.1p1]#

检测环境是否满足

  1. [root@k8s-node1 openssh-8.1p1]# ./configure --prefix=/usr --sysconfdir=/etc/ssh --with-pam --with-zlib --with-md5-passwords --with-tcp-wrappers
  2. configure: WARNING: unrecognized options: --with-tcp-wrappers
  3. checking for cc... cc
  4. checking whether the C compiler works... yes
  5. ······
  6. config.status: creating config.h
  7. configure: WARNING: unrecognized options: --with-tcp-wrappers
  9. OpenSSH has been configured with the following options:
  10.                      User binaries: /usr/bin
  11.                    System binaries: /usr/sbin
  12.                Configuration files: /etc/ssh
  13.                    Askpass program: /usr/libexec/ssh-askpass
  14.                       Manual pages: /usr/share/man/manX
  15.                           PID file: /var/run
  16.   Privilege separation chroot path: /var/empty
  17.             sshd default user PATH: /usr/bin:/bin:/usr/sbin:/sbin
  18.                     Manpage format: doc
  19.                        PAM support: yes
  20.                    OSF SIA support: no
  21.                  KerberosV support: no
  22.                    SELinux support: no
  23.               MD5 password support: yes
  24.                    libedit support: no
  25.                    libldns support: no
  26.   Solaris process contract support: no
  27.            Solaris project support: no
  28.          Solaris privilege support: no
  29.        IP address in $DISPLAY hack: no
  30.            Translate v4 in v6 hack: yes
  31.                   BSD Auth support: no
  32.               Random number source: OpenSSL internal ONLY
  33.              Privsep sandbox style: seccomp_filter
  35.               Host: x86_64-pc-linux-gnu
  36.           Compiler: cc
  37.     Compiler flags: -g -O2 -pipe -Wall -Wpointer-arith -Wuninitialized -Wsign-compare -Wformat-security -Wsizeof-pointer-memaccess -Wno-pointer-sign -Wno-unused-result -fno-strict-aliasing -D_FORTIFY_SOURCE=2 -ftrapv -fno-builtin-memset -fstack-protector-strong -fPIE  
  38. Preprocessor flags:  -D_XOPEN_SOURCE=600 -D_BSD_SOURCE -D_DEFAULT_SOURCE
  39.       Linker flags:  -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -fstack-protector-strong -pie 
  40.          Libraries: -lcrypto -ldl -lutil -lz  -lcrypt -lresolv
  41.          +for sshd:  -lpam
  43. PAM is enabled. You may need to install a PAM control file 
  44. for sshd, otherwise password authentication may fail. 
  45. Example PAM control files can be found in the contrib/ 
  46. subdirectory
可能出现的问题 解决问题之后重新检测环境 ./configure
  1. 1）configure: error: no acceptable C compiler found in $PATH
  2.         yum install -y gcc
  3. 2）configure: error: *** zlib.h missing - please install first or check config.log ***
  4.          yum install -y zlib-devel
  5. 3）configure: error: *** working libcrypto not found, check config.log
  6.         yum install -y openssl-devel
  7. 4）configure: error: PAM headers not found
  8.         yum install -y pam-devel

编译安装

  1. [root@k8s-node1 openssh-8.1p1]# rm -rf /etc/ssh
  2. [root@k8s-node1 openssh-8.1p1]# make && make install
  3. ······
  4. /usr/bin/install -c -m 644 ssh-pkcs11-helper.8.out /usr/share/man/man8/ssh-pkcs11-helper.8
  5. /usr/bin/mkdir -p /etc/ssh
  6. ssh-keygen: generating new host keys: RSA DSA ECDSA ED25519 
  7. /usr/sbin/sshd -t -f /etc/ssh/sshd_config
  8. [root@k8s-node1 openssh-8.1p1]#

配置

拷贝ssh服务文件

  1. [root@k8s-node1 openssh-8.1p1]# cp contrib/redhat/sshd.init /etc/init.d/sshd
  2. [root@k8s-node1 openssh-8.1p1]#

允许root用户远程登录

新增33行：

  1. [root@k8s-node1 openssh-8.1p1]# vi /etc/ssh/sshd_config 
  3.       1 # $OpenBSD: sshd_config,v 1.103 2018/04/09 20:41:22 tj Exp $
  4. ······
  5.      32 #PermitRootLogin prohibit-password
  6.      33 PermitRootLogin yes
  7.      34 #StrictModes yes

或者执行脚本：

  1. [root@k8s-node1 openssh-8.1p1]# sed -i "32a PermitRootLogin yes" /etc/ssh/sshd_config

加入系统服务

  1. [root@k8s-node1 openssh-8.1p1]# chkconfig --add sshd
  2. [root@k8s-node1 openssh-8.1p1]# chkconfig --list|grep sshd
  4. Note: This output shows SysV services only and does not include native
  5.       systemd services. SysV configuration data might be overridden by native
  6.       systemd configuration.
  8.       If you want to list systemd services use 'systemctl list-unit-files'.
  9.       To see services enabled on particular target use
  10.       'systemctl list-dependencies [target]'.
  12. sshd               0:off    1:off    2:on    3:on    4:on    5:on    6:off
  13. [root@k8s-node1 openssh-8.1p1]#

重启openssh，查看版本

  1. [root@k8s-node1 openssh-8.1p1]# systemctl restart sshd
  2. [root@k8s-node1 openssh-8.1p1]# systemctl status sshd
  3. ● sshd.service - SYSV: OpenSSH server daemon
  4.    Loaded: loaded (/etc/rc.d/init.d/sshd; bad; vendor preset: enabled)
  5.    Active: active (running) since Tue 2019-11-12 18:00:53 HKT; 1min 52s ago
  6.      Docs: man:systemd-sysv-generator(8)
  7.   Process: 28425 ExecStart=/etc/rc.d/init.d/sshd start (code=exited, status=0/SUCCESS)
  8.  Main PID: 28433 (sshd)
  9.    Memory: 1.4M
  10.    CGroup: /system.slice/sshd.service
  11.            ├─28433 /usr/sbin/sshd
  12.            ├─28437 sshd: root@pts/3
  13.            └─28487 -bash
  15. Nov 12 18:00:53 k8s-node1 systemd[1]: Starting SYSV: OpenSSH server daemon...
  16. Nov 12 18:00:53 k8s-node1 sshd[28433]: Server listening on 0.0.0.0 port 22.
  17. Nov 12 18:00:53 k8s-node1 sshd[28433]: Server listening on :: port 22.
  18. Nov 12 18:00:53 k8s-node1 sshd[28425]: Starting sshd:[  OK  ]
  19. Nov 12 18:00:53 k8s-node1 systemd[1]: Started SYSV: OpenSSH server daemon.
  20. Nov 12 18:00:59 k8s-node1 sshd[28437]: Accepted password for root from 192.168.56.1 port 5002 ssh2
  21. [root@k8s-node1 openssh-8.1p1]# ssh -V
  22. OpenSSH_8.1p1, OpenSSL 1.0.2k-fips  26 Jan 2017
  23. [root@k8s-node1 openssh-8.1p1]#

打开新窗口，并查看版本

可能会提示保存密码

  1. Connecting to 192.168.56.106:22...
  2. Connection established.
  3. To escape to local shell, press 'Ctrl+Alt+]'.
  5. WARNING! The remote SSH server rejected X11 forwarding request.
  6. Last login: Tue Nov 12 17:08:07 2019 from 192.168.56.1
  7. [root@k8s-node1 ~]# ssh -V
  8. OpenSSH_8.1p1, OpenSSL 1.0.2k-fips  26 Jan 2017
  9. [root@k8s-node1 ~]#

升级成功！！！

SELinux如果是开启状态，断开后或者新开窗口无法连接

本机之前已经关闭SELinux，所以没出现该问题

  1. [root@k8s-node1 ~]# cat /etc/selinux/config 
  3. # This file controls the state of SELinux on the system.
  4. # SELINUX= can take one of these three values:
  5. # enforcing - SELinux security policy is enforced.
  6. # permissive - SELinux prints warnings instead of enforcing.
  7. # disabled - No SELinux policy is loaded.
  8. SELINUX=disabled
  9. # SELINUXTYPE= can take one of three two values:
  10. # targeted - Targeted processes are protected,
  11. # minimum - Modification of targeted policy. Only selected processes are protected. 
  12. # mls - Multi Level Security protection.
  13. SELINUXTYPE=targeted

如出现该异常，可以：
临时关闭：setenforce 0
永久关闭：sed -i s#SELINUX=enforcing#SELINUX=disabled# /etc/selinux/config
关于SELinux详细介绍，请移步：https://blog.csdn.net/iceliooo/article/details/103039756

发表评论

表情：
评论列表 （有 0 条评论，119人围观）

还没有评论，来说两句吧...

相关阅读