【Ubuntu】Ubuntu 22.04 升级 OpenSSH 9.3p2 修复CVE-2023-38408
升级原因
近日Openssh暴露出一个安全漏洞CVE-2023-38408，以下是相关资讯：
一、漏洞详情
OpenSSH是一个用于安全远程登录和文件传输的开源软件套件。它提供了一系列的客户端和服务器程序，包括 ssh、scp、sftp等，用于在网络上进行安全的远程登录和文件传输。
近日，监测到OpenSSH ssh-agent中存在一个远程代码执行漏洞（CVE-2023-38408）。由于对CVE-2016-10009的修复不完整，9.3p2之前的OpenSSH中的PKCS#11功能存在不受信任的搜索路径，如果受害者系统上存在通过ssh-agent(1)的PKCS#11支持加载的特定库，且agent被转发到威胁者控制的系统（启用ssh-agent转发），则可能会导致远程代码执行。
建议受影响用户做好资产自查以及预防工作，以免遭受黑客攻击。
二、影响范围
5.5 < OpenSSH <= 9.3p1
三、修复建议
目前该漏洞已经修复，受影响用户可升级到以下版本：
OpenSSH 版本>=9.3p2
下载链接：https://www.openssh.com/
相关资讯：
- OpenSSH ssh-agent 远程代码执行漏洞(CVE-2023-38408)安全风险通告
- OpenSSH Security
- OpenSSH 9.3p2 Release Note
因此升级OpenSSH迫在眉睫
升级过程
-
下载相关的包
#openssh
wget --no-check-certificate https://mirrors.aliyun.com/pub/OpenBSD/OpenSSH/portable/openssh-9.3p2.tar.gz
#zlib
wget --no-check-certificate http://www.zlib.net/zlib-1.2.13.tar.gz
#openssl (下载比较慢，需要等很久，有条件的加把梯子）
wget --no-check-certificate https://www.openssl.org/source/openssl-3.1.2.tar.gz
-
安装依赖
apt install -y g++ perl make libpam0g-dev build-essential
-
安装telnet
在升级 SSH 过程中，确保 Telnet 能够连接服务器是为了提供备份的远程访问方式。需要注意的是，由于 Telnet 的不安全性，应尽量减少使用 Telnet，并在 SSH 升级完成后恢复正常的 SSH 远程访问,并关闭Telnet。
apt install openbsd-inetd telnetd telnet -y
systemctl restart openbsd-inetd
systemctl status openbsd-inetd
netstat -anpt|grep 23
测试是否可以通过Telnet成功登陆
-
卸载原openssh
apt-get autoremove openssh-server openssh-client -y
-
安装zlib
tar zxvf zlib-1.2.13.tar.gz
cd zlib-1.2.13/
./configure --shared
make && make install
-
安装openssl
#解压
tar zxvf openssl-3.1.2.tar.gz
cd openssl-3.1.2
#编译安装
./config --prefix=/usr/local/openssl shared zlib
sudo make depend
sudo make
sudo make install
#备份原来的openssl,创建软链接到系统位置
sudo mv /usr/bin/openssl /usr/bin/openssl.bak
sudo ln -sv /usr/local/openssl/bin/openssl /usr/bin/openssl
#更新动态链接库数据
echo "/usr/local/openssl/lib" >>sudo /etc/ld.so.conf
sudo ldconfig -v
openssl version
期间出现的错误及解决办法：
root@Virtual-Machine:/openssh-upgrade/openssl-3.1.2# openssl version
openssl: /lib/x86_64-linux-gnu/libcrypto.so.3: version `OPENSSL_3.0.9' not found (required by openssl)
root@Virtual-Machine:/openssh-upgrade/openssl-3.1.2# cp libcrypto.so.3 /lib/x86_64-linux-gnu/libcrypto.so.3
root@Virtual-Machine:/openssh-upgrade/openssl-3.1.2# openssl version
OpenSSL 3.1.2 1 Aug 2023 (Library: OpenSSL 3.1.2 1 Aug 2023)
-
安装openssh
tar zxvf openssh-9.3p2.tar.gz
cd openssh-9.3p2
./configure --prefix=/usr --sysconfdir=/etc/ssh --with-md5-passwords --with-pam --with-zlib --with-ssl-dir=/usr/include/openssl --with-privsep-path=/var/lib/ssh
make && make install
ssh -V
root@Virtual-Machine:/openssh-upgrade/openssh-9.3p2# ssh -V
OpenSSH_9.3p2, OpenSSL 3.1.2 1 Aug 2023
-
取消屏蔽 SSH 服务并启动
systemctl unmask ssh.service
systemctl start sshd
systemctl status sshd
root@Virtual-Machine:/home# systemctl unmask ssh.service
Removed /etc/systemd/system/ssh.service.
root@Virtual-Machine:/home# systemctl start sshd
root@Virtual-Machine:/home# systemctl status sshd
● ssh.service - LSB: OpenBSD Secure Shell server
Loaded: loaded (/etc/init.d/ssh; generated)
Active: active (running) since Fri 2023-08-04 14:26:30 CST; 2s ago
Docs: man:systemd-sysv-generator(8)
Process: 25657 ExecStart=/etc/init.d/ssh start (code=exited, status=0/SUCCESS)
Tasks: 1 (limit: 9421)
Memory: 1.4M
CPU: 30ms
CGroup: /system.slice/ssh.service
└─25667 "sshd: /usr/sbin/sshd [listener] 0 of 10-100 startups"
8月 04 14:26:30 Virtual-Machine systemd[1]: Starting LSB: OpenBSD Secure Shell server...
8月 04 14:26:30 Virtual-Machine ssh[25657]: * Starting OpenBSD Secure Shell server sshd
8月 04 14:26:30 Virtual-Machine ssh[25657]: ...done.
8月 04 14:26:30 Virtual-Machine sshd[25667]: Server listening on 0.0.0.0 port 22.
8月 04 14:26:30 Virtual-Machine sshd[25667]: Server listening on :: port 22.
8月 04 14:26:30 Virtual-Machine systemd[1]: Started LSB: OpenBSD Secure Shell server.
-
关闭Telnet
systemctl status openbsd-inetd
systemctl disable openbsd-inetd
systemctl stop openbsd-inetd
systemctl status openbsd-inetd
root@Virtual-Machine:/home# systemctl status openbsd-inetd
● inetd.service - Internet superserver
Loaded: loaded (/lib/systemd/system/inetd.service; enabled; vendor preset: enabled)
Active: active (running) since Fri 2023-08-04 13:53:23 CST; 47min ago
Docs: man:inetd(8)
Main PID: 609 (inetd)
Tasks: 2 (limit: 9421)
Memory: 3.3M
CPU: 385ms
CGroup: /system.slice/inetd.service
├─ 609 /usr/sbin/inetd
└─12087 "in.telnetd: 00X3V7R4W32Y3FF.lisuantech.com"
8月 04 13:53:22 Virtual-Machine systemd[1]: Starting Internet superserver...
8月 04 13:53:23 Virtual-Machine systemd[1]: Started Internet superserver.
8月 04 14:00:51 Virtual-Machine in.telnetd[12087]: connect from 10.2.12.131 (10.2.12.131)
8月 04 14:00:56 Virtual-Machine login[12088]: pam_unix(login:session): session opened for user knight(uid=1000) by (uid=0)
root@Virtual-Machine:/home# systemctl disable openbsd-inetd
Synchronizing state of openbsd-inetd.service with SysV service script with /lib/systemd/systemd-sysv-install.
Executing: /lib/systemd/systemd-sysv-install disable openbsd-inetd
Removed /etc/systemd/system/multi-user.target.wants/inetd.service.
root@Virtual-Machine:/home# systemctl stop openbsd-inetd
root@Virtual-Machine:/home# systemctl status openbsd-inetd
○ inetd.service - Internet superserver
Loaded: loaded (/lib/systemd/system/inetd.service; disabled; vendor preset: enabled)
Active: inactive (dead) since Fri 2023-08-04 14:40:49 CST; 3s ago
Docs: man:inetd(8)
Process: 609 ExecStart=/usr/sbin/inetd (code=exited, status=0/SUCCESS)
Main PID: 609 (code=exited, status=0/SUCCESS)
Tasks: 1 (limit: 9421)
Memory: 2.7M
CPU: 387ms
CGroup: /system.slice/inetd.service
└─12087 "in.telnetd: 00X3V7R4W32Y3FF.lisuantech.com"
8月 04 13:53:22 Virtual-Machine systemd[1]: Starting Internet superserver...
8月 04 13:53:23 Virtual-Machine systemd[1]: Started Internet superserver.
8月 04 14:00:51 Virtual-Machine in.telnetd[12087]: connect from 10.2.12.131 (10.2.12.131)
8月 04 14:00:56 Virtual-Machine login[12088]: pam_unix(login:session): session opened for user knight(uid=1000) by (uid=0)
8月 04 14:40:49 Virtual-Machine systemd[1]: Stopping Internet superserver...
8月 04 14:40:49 Virtual-Machine systemd[1]: inetd.service: Deactivated successfully.
8月 04 14:40:49 Virtual-Machine systemd[1]: inetd.service: Unit process 12087 (in.telnetd) remains running after unit stopped.
8月 04 14:40:49 Virtual-Machine systemd[1]: Stopped Internet superserver.