离线--升级Openssh9.3p1

目录

查看当前的openssh版本

下载openssh9.3p1及依赖包

避免升级openssh后，ssh-copy-id提示该命令不存在 

 openssh脚本

---

查看当前的openssh版本

[root@localhost ~]# ssh -V

为了避免升级过程中出现的意外导致服务器无法进行连接,建议对重要的内容先进行备份

1.创建快照：在主机服务为主机创建快照,防止最糟糕的事情发生！！

2.安装telnet：升级过程中会卸载旧版本 ssh，可能导致远程无法连接，可以先安装一个 telnet

#检查是否安装了telnet服务端

rpm -q telnet-server

#检查是否安装了telnet客户端

rpm -q telnet

#仅下载软件及依赖包（针对无外网的机器，若可以连接外网直接yum方式安装）

yumdownloader --resolve --destdir=/root/package/ telnet telnet-server

#然后可将/root/package/目录下的rpm包上传到要升级openssh的目标机器上

#进入到目录，rpm安装

rpm -ivh --force  ./*.rpm

下载openssh9.3p1及依赖包

版本下载地址（任选一个）：

http://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/

http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/

pub-OpenBSD-OpenSSH-portable安装包下载_开源镜像站-阿里云

#在可以连接外网的机器上操作

mkdir /root/openssh

cd /root/openssh

#下载openssh包
wget http://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-9.3p1.tar.gz

#下载依赖包

yumdownloader --resolve --destdir=/root/openssh/ gcc pam-devel zlib-devel openssl-devel

#tar打包

tar cvf openssh.tar.gz /root/openssh

#将openssh.tar.gz上传到要升级openssh的目标机器路径上

#ssh-copy-id.sh也要放到升级openssh的目标机器路径上

避免升级openssh后，ssh-copy-id提示该命令不存在 

[root@localhost home]# vim ssh-copy-id.sh

#ssh-copy-id命令实际是一个shell脚本，位于/usr/bin下，脚本内容如下： 
#!/bin/sh
 
# Shell script to install your public key on a remote machine
# Takes the remote machine name as an argument.
# Obviously, the remote machine must accept password authentication,
# or one of the other keys in your ssh-agent, for this to work.
 
ID_FILE="${HOME}/.ssh/id_rsa.pub"
 
if [ "-i" = "$1" ]; then
  shift
  # check if we have 2 parameters left, if so the first is the new ID file
  if [ -n "$2" ]; then
    if expr "$1" : ".*\.pub" > /dev/null ; then
      ID_FILE="$1"
    else
      ID_FILE="$1.pub"
    fi
    shift         # and this should leave $1 as the target name
  fi
else
  if [ x$SSH_AUTH_SOCK != x ] ; then
    GET_ID="$GET_ID ssh-add -L"
  fi
fi
 
if [ -z "`eval $GET_ID`" ] && [ -r "${ID_FILE}" ] ; then
  GET_ID="cat ${ID_FILE}"
fi
 
if [ -z "`eval $GET_ID`" ]; then
  echo "$0: ERROR: No identities found" >&2
  exit 1
fi
 
if [ "$#" -lt 1 ] || [ "$1" = "-h" ] || [ "$1" = "--help" ]; then
  echo "Usage: $0 [-i [identity_file]] [user@]machine" >&2
  exit 1
fi
 
{ eval "$GET_ID" ; } | ssh $1 "exec sh -c 'umask 077; test -d ~/.ssh || mkdir ~/.ssh ; cat >> ~/.ssh/authorized_keys && (test -x /sbin/restorecon && /sbin/restorecon ~/.ssh ~/.ssh/authorized_keys >/dev/null 2>&1 || true)'" || exit 1
 
cat < Now try logging into the machine, with "ssh '$1'", and check in:
  .ssh/authorized_keys
to make sure we haven't added extra keys that you weren't expecting.
EOF
 

 openssh脚本

[root@localhost home]#vim ssh.sh

#!/bin/bash
#
#########################################################
# Function :openssh-9.3p1 update                          #
# Platform :Centos7                                     #
# Version  :2.0                                         #
# Date     :2023-05-18                                  #    
#########################################################
 
clear
export LANG="en_US.UTF-8"
 
#版本号
openssh_version="openssh-9.3p1"
 
#安装包地址
echo -e "\033[33m 安装包地址/data.............. \033[0m"
file="/home/sshup"  #根据需要自行修改路径
 
#默认编译路径
echo -e "\033[33m 默认编译路径/usr/local.............. \033[0m"
default="/usr/local"
date_time=`date +%Y-%m-%d—%H:%M`
 
#安装目录
echo -e "\033[33m 安装目录/data.............. \033[0m"
file_install="$file/openssh_install"
file_backup="$file/openssh_backup"
file_log="$file/openssh_log"
 
#安装依赖
echo -e "\033[33m rpm方式安装依赖gcc pam-devel zlib-devel openssl-devel.............. \033[0m"
cd $file
tar xvf openssh.tar.gz
cd $file/openssh
rpm -ivh ./*.rpm --force 
  
# Check if user is root
    if [ $(id -u) != "0" ]; then
    echo -e "\033[33m--------------------------------------------------------------- \033[0m"
        echo -e " 当前用户为普通用户，必须使用root用户运行，脚本退出中......" "\033[31m Error\033[0m"
    echo -e "\033[33m--------------------------------------------------------------- \033[0m"
    echo ""
    sleep 4
    exit
    fi
 
#创建文件（可修改）
mkdir -p $file_install
mkdir -p $file_backup
mkdir -p $file_log
mkdir -p $file_backup/ssh
mkdir -p $file_log/ssh
 
#备份文件（可修改）
cp -rf /usr/bin/openssl  $file_backup/ssl/openssl_$date_time.bak > /dev/null
cp -rf /etc/init.d/sshd  $file_backup/ssh/sshd_$date_time.bak > /dev/null
cp -rf /etc/ssh  $file_backup/ssh/ssh_$date_time.bak > /dev/null
cp -rf /usr/lib/systemd/system/sshd.service  $file_backup/ssh/sshd_$date_time.service.bak > /dev/null
cp -rf /etc/pam.d/sshd.pam  $file_backup/ssh/sshd_$date_time.pam.bak > /dev/null
 
##并卸载原有的openssh（可修改）
rpm -e --nodeps `rpm -qa | grep openssh`

#install_openssh(){
echo -e "\033[33m 正在解压Openssh.............. \033[0m"
sleep 2
echo ""
    cd $file/openssh  && tar -xvzf openssh*.tar.gz -C $file_install
    if [ -d $file_install/$openssh_version ];then
    echo -e "\033[33m--------------------------------------------------------------- \033[0m"
         echo -e "  OpenSSh解压源码包成功" "\033[32m Success\033[0m"
    echo -e "\033[33m--------------------------------------------------------------- \033[0m"
            else
    echo -e "\033[33m--------------------------------------------------------------- \033[0m"
         echo -e "  OpenSSh解压源码包失败，脚本退出中......" "\033[31m Error\033[0m"
    echo -e "\033[33m--------------------------------------------------------------- \033[0m"
    echo ""
    sleep 4
    exit
    fi
    echo ""
echo -e "\033[33m 正在编译安装Openssh服务.............. \033[0m"
sleep 2
echo ""
    mv /etc/ssh /etc/ssh_$date_time.bak     #先备份
    cd $file_install/$openssh_version
    ./configure --prefix=$default/$openssh_version --sysconfdir=/etc/ssh --with-ssl-dir=$default/$openssl_version --with-zlib=$default/$zlib_version >  $file_log/ssh/ssh_configure_$date_time.txt   #> /dev/null 2>&1
    if [ $? -eq 0 ];then
    echo -e "\033[33m make -j 4... \033[0m"
        make -j 4 > /dev/null 2>&1
    echo $?
    echo -e "\033[33m make install... \033[0m"
        make install > /dev/null 2>&1
    echo $?
    else
    echo -e "\033[33m--------------------------------------------------------------- \033[0m"
        echo -e " 编译安装OpenSSH失败，脚本退出中......" "\033[31m Error\033[0m"
    echo -e "\033[33m--------------------------------------------------------------- \033[0m"
    echo ""
    sleep 4
    exit
    fi
     
    echo ""
    echo -e "\033[32m==================== OpenSSH veriosn =================== \033[0m"
    echo ""
        /usr/local/$openssh_version/bin/ssh -V
    echo ""
    echo -e "\033[32m======================================================= \033[0m"
    echo ""
 
echo -e "\033[33m 正在迁移Openssh配置文件.............. \033[0m"
sleep 2
echo ""
#迁移sshd
    if [ -f  "/etc/init.d/sshd" ];then
        mv /etc/init.d/sshd /etc/init.d/sshd_$date_time.bak
    else
        echo -e " /etc/init.d/sshd不存在 " "\033[31m Not backed up(可忽略)\033[0m"
    fi
    cp -rf $file_install/$openssh_version/contrib/redhat/sshd.init /etc/init.d/sshd;
 
    chmod u+x /etc/init.d/sshd;
    chkconfig --add sshd      ##自启动
    chkconfig --list |grep sshd;
    chkconfig sshd on
#备份启动脚本,不一定有
    if [ -f  "/usr/lib/systemd/system/sshd.service" ];then
        mv /usr/lib/systemd/system/sshd.service /usr/lib/systemd/system/sshd.service_bak
    else
        echo -e " sshd.service不存在" "\033[31m Not backed up(可忽略)\033[0m"
    fi
#备份复制sshd.pam文件
    if [ -f "/etc/pam.d/sshd.pam" ];then
        mv /etc/pam.d/sshd.pam /etc/pam.d/sshd.pam_$date_time.bak
    else
        echo -e " sshd.pam不存在" "\033[31m Not backed up(可忽略)\033[0m"
    fi
    cp -rf $file_install/$openssh_version/contrib/redhat/sshd.pam /etc/pam.d/sshd.pam
#迁移ssh_config  
    cp -rf $file_install/$openssh_version/sshd_config /etc/ssh/sshd_config
    sed -i 's/Subsystem/#Subsystem/g' /etc/ssh/sshd_config
    echo 'Subsystem sftp internal-sftp'>> /etc/ssh/sshd_config
    cp -rf $default/$openssh_version/sbin/sshd /usr/sbin/sshd
    cp -rf /$default/$openssh_version/bin/ssh /usr/bin/
    cp -rf $default/$openssh_version/bin/ssh-keygen /usr/bin/ssh-keygen
    sed -i 's/#PasswordAuthentication\ yes/PasswordAuthentication\ yes/g' /etc/ssh/sshd_config
    #grep -v "[[:space:]]*#" /etc/ssh/sshd_config  |grep "PubkeyAuthentication yes"
    echo 'PermitRootLogin yes' >> /etc/ssh/sshd_config
 
#重启sshd
    service sshd start > /dev/null 2>&1
    if [ $? -eq 0 ];then
    echo -e "\033[33m--------------------------------------------------------------- \033[0m"
        echo -e " 启动OpenSSH服务成功" "\033[32m Success\033[0m"
    echo -e "\033[33m--------------------------------------------------------------- \033[0m"
    echo ""
    sleep 2
    echo -e "\033[32m==================== OpenSSH veriosn =================== \033[0m"
    echo ""
        ssh -V
    echo ""
    echo -e "\033[32m======================================================== \033[0m"
    else
    echo -e "\033[33m--------------------------------------------------------------- \033[0m"
        echo -e " 启动OpenSSH服务失败，脚本退出中......" "\033[31m Error\033[0m"
    echo -e "\033[33m--------------------------------------------------------------- \033[0m"
    sleep 4
    exit
    fi
    echo ""
#}
 
#删除源码包（可修改）
rm -rf $file/*.tar.gz
rm -rf $file_install
 
##sshd状态
    echo ""
    echo -e "\033[33m====================输出sshd服务状态==================== \033[33m"
    sleep 1
    echo ""
    systemctl status sshd.service
    echo ""
    echo ""
    echo ""
    echo -e "\033[33m=================输出sshd和ssl服务版本================= \033[33m"
    sleep 1
    echo ""
    ssh -V
    echo ""    
    echo ""
    sleep 1
     
echo -e "\033[33m==================== OpenSSH file =================== \033[0m"
echo ""
    echo -e " Openssh升级安装目录请前往:  "
    cd  $file_install && pwd
    cd ~
    echo ""
    echo -e " Openssh升级备份目录请前往:  "
    cd  $file_backup && pwd
    cd ~
    echo ""
    echo -e " Openssh升级日志目录请前往:  "
    cd  $file_log && pwd
    cd ~
    echo ""
echo -e "\033[33m================================================ \033[0m"
sleep 1

echo -e "\033[33m==赋予ssh-cop-id.sh执行权限，并复制到/usr/bin/目录下== \033[33m"
cd $file
chmod +x ssh-copy-id
sleep 1
cp ssh-copy-id /usr/bin/
 

 执行ssh.sh，有报错的看日志，看报错提示解决哈

可能路径对不上！！，看看脚本里的目录是否一致：file="/home/sshup"

 成功升级到OpenSSH_9.3p1, OpenSSL 1.0.2k-fips 26 Jan 2017

重新连接，是否真的可行