一、介绍
| 分类 | 系统版本 | openssh版本 | openssl版本 | 测试结果 |
|---|---|---|---|---|
| 低版本openssl编译 | centos6 | 8.7p1 | 1.0.1e | 正常 |
| centos7 | 8.7p1 | 1.0.2k | 正常 | |
centos8
centos stream
| 8.7p1 | 1.1.1g | 正常 |
| 高版本openssl编译 | centos6 | 8.7p1 | 1.1.1l | 正常 |
|
centos7
| 8.7p1 | 1.1.1l | 正常 |
|
centos8
centos stream
|
有BUG未编译成功
|
[root@localhost openssh]# tree
.
|-- 针对低版本openssl编译
| |-- centos\ 6
| | |-- openssh-8.7p1
| | | |-- openssh-8.7p1-1.el6.x86_64.rpm
| | | |-- openssh-askpass-8.7p1-1.el6.x86_64.rpm
| | | |-- openssh-askpass-gnome-8.7p1-1.el6.x86_64.rpm
| | | |-- openssh-clients-8.7p1-1.el6.x86_64.rpm
| | | |-- openssh-debuginfo-8.7p1-1.el6.x86_64.rpm
| | | `-- openssh-server-8.7p1-1.el6.x86_64.rpm
| | `-- openssl-1.0.1e
| | |-- openssl-1.0.1e-58.el6_10.x86_64.rpm
| | `-- openssl-devel-1.0.1e-58.el6_10.x86_64.rpm
| |-- centos\ 7
| | |-- openssh-8.7p1
| | | |-- openssh-8.7p1-1.el7.centos.x86_64.rpm
| | | |-- openssh-askpass-8.7p1-1.el7.centos.x86_64.rpm
| | | |-- openssh-askpass-gnome-8.7p1-1.el7.centos.x86_64.rpm
| | | |-- openssh-clients-8.7p1-1.el7.centos.x86_64.rpm
| | | |-- openssh-debuginfo-8.7p1-1.el7.centos.x86_64.rpm
| | | `-- openssh-server-8.7p1-1.el7.centos.x86_64.rpm
| | `-- openssl-1.0.2k
| | |-- openssl-1.0.2k-21.el7_9.x86_64.rpm
| | |-- openssl-devel-1.0.2k-21.el7_9.x86_64.rpm
| | `-- openssl-libs-1.0.2k-21.el7_9.x86_64.rpm
| `-- centos\ 8
| |-- openssh-8.7p1
| | |-- openssh-8.7p1-1.el8.x86_64.rpm
| | |-- openssh-askpass-8.7p1-1.el8.x86_64.rpm
| | |-- openssh-askpass-debuginfo-8.7p1-1.el8.x86_64.rpm
| | |-- openssh-askpass-gnome-8.7p1-1.el8.x86_64.rpm
| | |-- openssh-askpass-gnome-debuginfo-8.7p1-1.el8.x86_64.rpm
| | |-- openssh-clients-8.7p1-1.el8.x86_64.rpm
| | |-- openssh-clients-debuginfo-8.7p1-1.el8.x86_64.rpm
| | |-- openssh-debuginfo-8.7p1-1.el8.x86_64.rpm
| | |-- openssh-debugsource-8.7p1-1.el8.x86_64.rpm
| | |-- openssh-server-8.7p1-1.el8.x86_64.rpm
| | `-- openssh-server-debuginfo-8.7p1-1.el8.x86_64.rpm
| `-- openssl-1.1.1g
| |-- openssl-1.1.1g-12.el8_3.x86_64.rpm
| |-- openssl-devel-1.1.1g-12.el8_3.x86_64.rpm
| |-- openssl-ibmpkcs11-1.0.2-1.el8.x86_64.rpm
| |-- openssl-libs-1.1.1g-12.el8_3.x86_64.rpm
| |-- openssl-perl-1.1.1g-12.el8_3.x86_64.rpm
| `-- openssl-pkcs11-0.4.10-2.el8.x86_64.rpm
`-- 针对高版本openssl编译
|-- centos\ 6
| |-- openssh
| | |-- openssh-8.7p1-1.el6.x86_64.rpm
| | |-- openssh-askpass-8.7p1-1.el6.x86_64.rpm
| | |-- openssh-askpass-gnome-8.7p1-1.el6.x86_64.rpm
| | |-- openssh-clients-8.7p1-1.el6.x86_64.rpm
| | |-- openssh-debuginfo-8.7p1-1.el6.x86_64.rpm
| | `-- openssh-server-8.7p1-1.el6.x86_64.rpm
| `-- openssl
| |-- openssl-1.1.1l-1.el6.x86_64.rpm
| |-- openssl-debuginfo-1.1.1l-1.el6.x86_64.rpm
| `-- openssl-devel-1.1.1l-1.el6.x86_64.rpm
|-- centos\ 7
| |-- openssh-8.7p1
| | |-- openssh-8.7p1-1.el7.centos.x86_64.rpm
| | |-- openssh-askpass-8.7p1-1.el7.centos.x86_64.rpm
| | |-- openssh-askpass-gnome-8.7p1-1.el7.centos.x86_64.rpm
| | |-- openssh-clients-8.7p1-1.el7.centos.x86_64.rpm
| | |-- openssh-debuginfo-8.7p1-1.el7.centos.x86_64.rpm
| | `-- openssh-server-8.7p1-1.el7.centos.x86_64.rpm
| `-- openssl-1.1.1l
| |-- openssl-1.1.1l-1.el7.centos.x86_64.rpm
| |-- openssl-debuginfo-1.1.1l-1.el7.centos.x86_64.rpm
| `-- openssl-devel-1.1.1l-1.el7.centos.x86_64.rpm
`-- centos\ 8
`-- 有BUG未解决未发布
19 directories, 52 files
image.gif
下载地址: https://download.csdn.net/download/ChongDanYiQieHuiYi/21632713
二、升级 --低版本openssl 风险较低！！
- centos6
[root@localhost Desktop]# rpm -Uvh openssl-1.0.1e-58.el6_10.x86_64.rpm openssl-devel-1.0.1e-58.el6_10.x86_64.rpm
[root@localhost Desktop]# rpm -Uvh openssh-8.7p1-1.el6.x86_64.rpm openssh-server-8.7p1-1.el6.x86_64.rpm openssh-clients-8.7p1-1.el6.x86_64.rpm openssh-askpass-8.7p1-1.el6.x86_64.rpm
Preparing... ########################################### [100%]
1:openssh ########################################### [ 25%]
2:openssh-server ########################################### [ 50%]
3:openssh-clients ########################################### [ 75%]
4:openssh-askpass ########################################### [100%]
[root@localhost ~]# sshd -v
unknown option -- v
OpenSSH_8.7p1, OpenSSL 1.0.1e-fips 11 Feb 2013
usage: sshd [-46DdeiqTt] [-C connection_spec] [-c host_cert_file]
[-E log_file] [-f config_file] [-g login_grace_time]
[-h host_key_file] [-o option] [-p port] [-u len]
image.gif
- centos7
[root@localhost Desktop]# rpm -Uvh openssl-1.0.2k-21.el7_9.x86_64.rpm openssl-devel-1.0.2k-21.el7_9.x86_64.rpm openssl-libs-1.0.2k-21.el7_9.x86_64.rpm
[root@localhost Desktop]# rpm -Uvh openssh-8.7p1-1.el7.centos.x86_64.rpm openssh-server-8.7p1-1.el7.centos.x86_64.rpm openssh-clients-8.7p1-1.el7.centos.x86_64.rpm openssh-askpass-8.7p1-1.el7.centos.x86_64.rpm
Preparing... ################################# [100%]
Updating / installing...
1:openssh-8.7p1-1.el7.centos ################################# [ 14%]
2:openssh-server-8.7p1-1.el7.centos################################# [ 29%]
3:openssh-clients-8.7p1-1.el7.cento################################# [ 43%]
4:openssh-askpass-8.7p1-1.el7.cento################################# [ 57%]
Cleaning up / removing...
5:openssh-clients-6.4p1-8.el7 ################################# [ 71%]
6:openssh-server-6.4p1-8.el7 ################################# [ 86%]
7:openssh-6.4p1-8.el7 ################################# [100%]
[root@localhost Desktop]# sshd -v
unknown option -- v
OpenSSH_8.7p1, OpenSSL 1.0.2k-fips 11 Feb 2013
usage: sshd [-46DdeiqTt] [-C connection_spec] [-c host_cert_file]
[-E log_file] [-f config_file] [-g login_grace_time]
[-h host_key_file] [-o option] [-p port] [-u len]
image.gif
- centos8 - centos steam
[root@localhost Desktop]# rpm -Uvh openssl-1.1.1g-12.el8_3.x86_64.rpm openssl-devel-1.1.1g-12.el8_3.x86_64.rpm openssl-libs-1.1.1g-12.el8_3.x86_64.rpm
[root@localhost Desktop]# rpm -Uvh openssh-8.7p1-1.el6.x86_64.rpm openssh-server-8.7p1-1.el6.x86_64.rpm openssh-clients-8.7p1-1.el6.x86_64.rpm openssh-askpass-8.7p1-1.el6.x86_64.rpm
Preparing... ########################################### [100%]
1:openssh ########################################### [ 25%]
2:openssh-server ########################################### [ 50%]
3:openssh-clients ########################################### [ 75%]
4:openssh-askpass ########################################### [100%]
[root@localhost Centos8]# sshd -v
unknown option -- v
OpenSSH_8.7p1, OpenSSL 1.1.1 FIPS 11 Sep 2018
usage: sshd [-46DdeiqTt] [-C connection_spec] [-c host_cert_file]
[-E log_file] [-f config_file] [-g login_grace_time]
[-h host_key_file] [-o option] [-p port] [-u len]
image.gif
三、升级 --高版本openssl 切记有风险!!
注1: 切记升级此版本openssl 1.1.1l版本 属于强制迭代升级
- 不可以提前卸载原openssl 例如: rpm -e openssl-1.0.2k-21.el7_9.x86_64
- 不可以直接升级openssl 1.1.1l 例如: rpm -Uvh openssl-1.0.2k-21.el7_9.x86_64
注2: 迭代直接替换原有文件 -- 如有需要建议备份以下文件
/usr/bin/openssl
/usr/lib64/libcrypto.so.1.1
/usr/lib64/libssl.so.1.1
image.gif
- centos6
# 强制安装 忽略依赖
[root@localhost Desktop]# rpm -ivh openssl-1.1.1l-1.el6.x86_64.rpm --nodeps --force
Preparing... ########################################### [100%]
1:openssl ########################################### [100%]
[root@localhost Desktop]# rpm -Uvh openssh-8.7p1-1.el6.x86_64.rpm openssh-server-8.7p1-1.el6.x86_64.rpm openssh-clients-8.7p1-1.el6.x86_64.rpm openssh-askpass-8.7p1-1.el6.x86_64.rpm
Preparing... ########################################### [100%]
1:openssh ########################################### [ 25%]
2:openssh-server ########################################### [ 50%]
/var/tmp/rpm-tmp.VNPRT4: line 2: /usr/bin/chmod: No such file or directory
3:openssh-clients ########################################### [ 75%]
4:openssh-askpass ########################################### [100%]
[root@localhost Desktop]# sshd -v
unknown option -- v
OpenSSH_8.7p1, OpenSSL 1.1.1l 24 Aug 2021
usage: sshd [-46DdeiqTt] [-C connection_spec] [-c host_cert_file]
[-E log_file] [-f config_file] [-g login_grace_time]
[-h host_key_file] [-o option] [-p port] [-u len]
image.gif
- centos7
# 强制安装 忽略依赖
[root@localhost x86_64]# rpm -ivh openssl-1.1.1l-1.el7.centos.x86_64.rpm --nodeps --force
Preparing... ################################# [100%]
Updating / installing...
1:openssl-1.1.1l-1.el7.centos ################################# [100%]
[root@localhost openssh-8.7p1]# rpm -Uvh openssh-8.7p1-1.el7.centos.x86_64.rpm openssh-server-8.7p1-1.el7.centos.x86_64.rpm openssh-clients-8.7p1-1.el7.centos.x86_64.rpm
Preparing... ################################# [100%]
Updating / installing...
1:openssh-8.7p1-1.el7.centos ################################# [ 17%]
2:openssh-server-8.7p1-1.el7.centos################################# [ 33%]
3:openssh-clients-8.7p1-1.el7.cento################################# [ 50%]
Cleaning up / removing...
4:openssh-clients-6.4p1-8.el7 ################################# [ 67%]
5:openssh-server-6.4p1-8.el7 ################################# [ 83%]
6:openssh-6.4p1-8.el7 ################################# [100%]
[root@localhost openssh-8.7p1]#
[root@localhost openssh-8.7p1]# openssl version
OpenSSL 1.0.2k-fips 26 Jan 2017
[root@localhost openssh-8.7p1]# sshd -v
unknown option -- v
OpenSSH_8.7p1, OpenSSL 1.0.2k-fips 26 Jan 2017
usage: sshd [-46DdeiqTt] [-C connection_spec] [-c host_cert_file]
[-E log_file] [-f config_file] [-g login_grace_time]
[-h host_key_file] [-o option] [-p port] [-u len]
[root@localhost openssh-8.7p1]#
image.gif
- centos8 - centos steam
有BUG未编译成功！
四、异常处理
- CRT和跳板机,由于sshd升级弱算法将不采用
image
image.gif
- 一般不建议添加此项配置
cat >>/etc/ssh/sshd_config <<-EOF
KexAlgorithms diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256
EOF
# centos7/8/stream
systemctl restart sshd
# centos6
service sshd restart
image.gif