openSSH和openSSL的升级

安装telnet

• 防止升级ssh时意外断开无法再次登陆服务器

1. 安装telnet安装包

• rpm –ivh xinetd-2.3.14-38.el6.x86_64.rpm
• rpm –ivh telnet-0.17-47.el6_3.1.x86_64.rpm
• rpm -ivh telnet-server-0.17-47.el6_3.1.x86_64.rpm
• 编辑设置 /etc/xinetd.d/telnet ,将disable= yes设置成disable= no

1. 启动telnet服务

• service xinetd start
• 使用telnet登陆主机（要注意：默认不能用root用户进行登陆）

升级zlib

（1）查看zlib版本

rpm -q zlib

 

（2）解压zlib_1.2.11源码并编译

    # tar -zxvf zlib-1.2.11.tar.gz

   # cd zlib-1.2.11

  # ./configure --prefix=/usr

  # make

（3）卸载当前zlib

# rpm -e --nodeps  zlib

（4）安装之前编译好的zlib

# make install

（5）共享库注册

# echo '/usr/lib' >> /etc/ld.so.conf

# ldconfig 

依赖安装

rpm -ivh kernel-headers-3.10.0-327.28.3.el7.x86_64.rpm

rpm -ivh glibc-headers-2.17-105.el7.x86_64.rpm

rpm -ivh mpfr-3.1.1-4.el7.x86_64.rpm

rpm -ivh libmpc-1.0.1-3.el7.x86_64.rpm

rpm -ivh cpp-4.8.5-4.el7.x86_64.rpm

rpm -ivh glibc-devel-2.17-105.el7.x86_64.rpm

rpm -ivh libaio-devel-0.3.109-13.el7.x86_64.rpm

rpm -ivh ksh-20120801-22.el7_1.3.x86_64.rpm

rpm -ivh elfutils-libelf-devel-0.163-3.el7.x86_64.rpm

rpm -ivh unixODBC-2.3.1-11.el7.x86_64.rpm

rpm -ivh gcc-4.8.5-4.el7.x86_64.rpm

rpm -ivh libstdc++-devel-4.8.5-4.el7.x86_64.rpm

rpm -ivh unixODBC-devel-2.3.1-11.el7.x86_64.rpm

rpm -ivh gcc-c++-4.8.5-4.el7.x86_64.rpm

 

升级openssl

备份当前openssl

# find / -name openssl

# mv  /usr/lib64/openssl /usr/lib64/openssl.old

# mv  /usr/bin/openssl  /usr/bin/openssl.old

# mv  /etc/pki/ca-trust/extracted/openssl  /etc/pki/ca-trust/extracted/openssl.old

# mv /usr/include/openssl /usr/include/openssl.old

#mv /opt/cloudera/parcels/CDH-5.15.0-1.cdh5.15.0.p0.21/lib/impala/lib/openssl /opt/cloudera/parcels/CDH-5.15.0-1.cdh5.15.0.p0.21/lib/impala/lib/openssl.old

  如下两个库文件必须先备份，因系统内部分工具（如yum、wget等）依赖此库，而新版OpenSSL不包含这两个库

  # cp  /usr/lib64/libcrypto.so.10  /usr/lib64/libcrypto.so.10.old

  # cp  /usr/lib64/libssl.so.10  /usr/lib64/libssl.so.10.old

 

卸载当前openssl

1. # rpm -qa | grep openssl
2. # rpm -e --nodeps openssl-1.0.1e-42.el6.x86_64

解压openssl_1.0.2l源码并编译安装

# tar -zxvf openssl-1.0.2l.tar.gz

# cd openssl-1.0.2l

# ./config --prefix=/usr --openssldir=/etc/ssl --shared zlib    #必须加上--shared，否则编译时会找不到新安装的openssl的库而报错

# make

# make test                            #必须执行这一步结果为pass才能继续，否则即使安装完成，ssh也无法使用

# make install

# openssl version -a                   #查看是否升级成功

恢复共享库

# mv  /usr/lib64/libcrypto.so.10.old  /usr/lib64/libcrypto.so.10

# mv  /usr/lib64/libssl.so.10.old  /usr/lib64/libssl.so.10

升级openssh

备份openssh

# mv /etc/ssh /etc/ssh.old

卸载当前openssh

# rpm -qa | grep openssh

openssh-clients-5.3p1-111.el6.x86_64

openssh-server-5.3p1-111.el6.x86_64

openssh-5.3p1-111.el6.x86_64

# rpm -e --nodeps openssh-5.3p1-111.el6.x86_64

# rpm -e --nodeps openssh-server-5.3p1-111.el6.x86_64

# rpm -e --nodeps openssh-clients-5.3p1-111.el6.x86_64

# rpm -qa | grep openssh

 openssh安装前环境配置

# install  -v -m700 -d /var/lib/sshd

# chown  -v root:sys /var/lib/sshd

# groupadd -g 50 sshd

# useradd  -c 'sshd PrivSep' -d /var/lib/sshd -g sshd -s /bin/false -u 50 sshd

 

安装Pam

Rpm –ivh pam-devel-1.1.8-12.el7_1.1.x86_64.rpm

 解压openssh_7.5p1源码并编译安装

# tar -zxvf openssh-7.5p1.tar.gz

# cd openssh-7.5p1

# ./configure --prefix=/usr  --sysconfdir=/etc/ssh  --with-md5-passwords  --with-pam  --with-zlib --with-openssl-includes=/usr --with-privsep-path=/var/lib/sshd

# make

# make install

openssh安装后环境配置

# 在openssh编译目录执行如下命令

# install -v -m755    contrib/ssh-copy-id /usr/bin

# install -v -m644    contrib/ssh-copy-id.1 /usr/share/man/man1

# install -v -m755 -d /usr/share/doc/openssh-7.5p1

# install -v -m644    INSTALL LICENCE OVERVIEW README* /usr/share/doc/openssh-7.5p1

# ssh -V              #验证是否升级成功

启用OpenSSH服务

# 在openssh编译目录执行如下目录

# echo 'X11Forwarding yes' >> /etc/ssh/sshd_config

# echo "PermitRootLogin yes" >> /etc/ssh/sshd_config   #允许root用户通过ssh登录

# cp -p contrib/redhat/sshd.init /etc/init.d/sshd

# chmod +x /etc/init.d/sshd

# chkconfig  --add  sshd

# chkconfig  sshd  on

# chkconfig  --list  sshd

# service sshd restart

注：以上均为实测。

一只行走的小笨猿！