openssh8.3p1 rpm升级报错解决方案

openssh8.3p1 rpm 升级后报错误:
(1)报:Permissions 0640 for’/etc/ssh/ssh_host_rsa_key’ are too open.
解决方案:chmod -R 600 /etc/ssh
(2)报:SecureCRT Key exchange failed
解决方案:vi /etc/ssh/sshd_config
在文件尾部增加下面:
#RSAAuthentication yes
PubkeyAuthentication yes
PasswordAuthentication yes
KexAlgorithms diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1
保存退出
#vi /etc/ssh/ssh_config
打开以下:
GSSAPIAuthentication no
GSSAPIDelegateCredentials no
IdentityFile ~/.ssh/id_rsa
IdentityFile ~/.ssh/id_dsa
IdentityFile ~/.ssh/id_ecdsa
IdentityFile ~/.ssh/id_ed25519
保存退出
#ssh-keygen -A
#service ssh restart
(3)报root 登陆提示 ACCESS DENIED
解决方案:
#vi /etc/ssh/sshd_config
找到 Authentication: LoginGraceTime 120 PermitRootLogin without passwd StrictModes yes
把"PermitRootLogin without passwd"改成"PermitRootLogin yes",并将注释取消
保存退出
(4)PAM报错
Jul 1 13:11:19 credit_elsearch sshd[6027]: PAM unable to dlopen(/usr/lib64/security/pam_stack.so):/usr/lib64/security/pam_stack.so: cannot open shared object file: No such file or directory
Jul 1 13:11:19 credit_elsearch sshd[6027]: PAM adding faulty module: /usr/lib64/security/pam_stack.so
Jul 1 13:11:19 credit_elsearch sshd[6027]: Failed password for root from 10.23.181.28 port 60094 ssh2

经过排查发现是ssh rpm 升级后会修改/etc/pam.d/sshd 文件,如下:
#%PAM-1.0
auth required pam_stack.so service=system-auth
account required pam_nologin.so
account required pam_stack.so service=system-auth
password required pam_stack.so service=system-auth
session required pam_stack.so service=system-auth

修改为之前的即可,修改后的文件如下:

#%PAM-1.0
auth required pam_sepermit.so
auth include password-auth
account required pam_nologin.so
account include password-auth
password include password-auth

pam_selinux.so close should be the first session rule

session required pam_selinux.so close
session required pam_loginuid.so
#pam_selinux.so open should only be followed by sessions to be executed in the user context
session required pam_selinux.so open env_params
session optional pam_keyinit.so force revoke
session include password-auth
最后换回从前的配置文件，然后就不报错了
（5）缺少gcc
[root@credit_elsearch zlib-1.2.8]# gcc -v
bash: gcc: command not found…
[root@credit_elsearch zlib-1.2.8]# ./configure
Checking for gcc…
Compiler error reporting is too harsh for ./configure (perhaps remove -Werror).
** ./configure aborting.
解决方法：
rpm -ivh mpfr-3.1.1-4.el7.x86_64.rpm
rpm -ivh libmpc-1.0.1-3.el7.x86_64.rpm
rpm -ivh kernel-headers-3.10.0-123.el7.x86_64.rpm
rpm -ivh glibc-headers-2.17-55.el7.x86_64.rpm
rpm -ivh glibc-devel-2.17-55.el7.x86_64.rpm
rpm -ivh cpp-4.8.2-16.el7.x86_64.rpm
rpm -ivh gcc-4.8.2-16.el7.x86_64.rpm
（6）编译安装openssl报错：POD document had syntax errors at /usr/bin/pod2man line 69. make: *** [install_docs]
错误如下：
cms.pod around line 457: Expected text after =item, not a number
cms.pod around line 461: Expected text after =item, not a number
cms.pod around line 465: Expected text after =item, not a number
cms.pod around line 470: Expected text after =item, not a number
cms.pod around line 474: Expected text after =item, not a number
POD document had syntax errors at /usr/bin/pod2man line 69.
make: *** [install_docs] Error 1
解决方法：
执行：
rm -f /usr/bin/pod2man
重新编译安装即可。
（7）openssh安装好默认是不执行sshd_config文件的
vim /etc/init.d/sshd
在 ‘$SSHD $OPTIONS && success || failure’这一行上面加上一行 ‘OPTIONS="-f /etc/ssh/sshd_config"’
保存退出
（8）root用户无法登陆
解决：vim /etc/ssh/sshd_config
#PermitRootLogin prohibit-password改成PermitRootLogin yes
（9）升级openssh后Xshell、SecureCRT等工具无法连接xftp和不能上传文件
解决：vim /etc/ssh/sshd_config

override default of no subsystems

#Subsystem sftp /usr/local/openssh/libexec/sftp-server改成下面那句
Subsystem sftp internal-sftp
（10）编译和安装openssl时出错，POD document had syntax errors
installing man1/smime.1
　　smime.pod around line 272： Expected text after =item， not a number
　　smime.pod around line 276： Expected text after =item， not a number
　　smime.pod around line 280： Expected text after =item， not a number
　　smime.pod around line 285： Expected text after =item， not a number
　　smime.pod around line 289： Expected text after =item， not a number
　　POD document had syntax errors at /usr/bin/pod2man line 71.
　　make： *** ［install_docs］ 错误 255
　　原因分析：这是由于OpenSSL 1.0.1e 与 perl5.18 不兼容。
　　解决方法：
　　1、有人验证 安装perl 5.16 可以兼容，安排低版本perl 5.16可以解决问题。
　　2、删除 pod2man文件：
　　sudo rm /usr/bin/pod2man
（11）升级Openssh高版本后，为了安全，默认不采用低等级的加密算法，低等级加密算法 pshell工具无法远程连接。（支持高等级加密算法的工具有xshell）。升级Openssh高版本后，为了安全，默认不采用低等级的加密算法，低等级加密算法 pshell工具无法远程连接。（支持高等级加密算法的工具有xshell）。
解决方法：修改sshd的配置文件 /etc/ssh/sshd_config，在最后面添加以下三行内容：添加完后重启sshd服务则生效。
Ciphers aes128-cbc,aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr,3des-cbc,arcfour128,arcfour256,arcfour,blowfish-cbc,cast128-cbc
MACs hmac-md5,hmac-sha1,[email protected],hmac-ripemd160,hmac-sha1-96,hmac-md5-96