centos6.5 升级openssl1.1.1g、openssh8.6p1小记

系统版本：CentOS release 6.5 (Final)

默认版本：OpenSSH_5.3p1, OpenSSL 1.0.1e-fips

升级版本：OpenSSH_8.6p1, OpenSSL 1.1.1g

相关升级文件下载：https://download.csdn.net/download/qq_25868251/19426574 （其中基于 openssl1.1 的是 centos7 版本的）

一、安装应急服务

1.安装相关依赖及服务

yum install -y gcc pam-devel zlib-devel perl expat-devel perl-Time-HiRes perl-Test-Harness perl-Test-Simple xinetd telnet-server vsftpd

（1）.此处安装 telnet 服务的目的是使 linux 能通过 telnet 登录系统，避免升级过程出现问题导致 ssh 无法登录，必要情况还需要安装 vsftpd 服务，假如 ssh 无法使用而且需要上传相关文件会用到此服务，此处建议安装上，出现问题可以省略很多不必要的麻烦。注意：默认防火墙并不开放 23 端口，可直接关闭防火墙，若服务器不允许关闭，请在防火策略开放 23 端口，ftp 服务需要开放 21和 20（建议使用默认配置，匿名登录即可）

  a.若 yum 安装遇到无法使用源的情况，请参照该教程：

Centos6.5 解决源无法使用问题_啊 这的博客-CSDN博客

  b.若想进一步了解 vsftpd 服务，请参考该教程：

ftp之vsftpd使用过程遇到的坑_vsftpd3.0.5 pam不起作用_啊 这的博客-CSDN博客

2、配置服务及开启服务

（1）将 disable yes 改为 disable no

[root@localhost ~]# vi /etc/xinetd.d/telnet 
# default: on
# description: The telnet server serves telnet sessions; it uses \
#       unencrypted username/password pairs for authentication.
service telnet
{
        flags           = REUSE
        socket_type     = stream
        wait            = no
        user            = root
        server          = /usr/sbin/in.telnetd
        log_on_failure  += USERID
#       disable         = yes   
        disable         = no
}

（2）启动服务

[root@localhost ~]# chkconfig xinetd on                    # 设置开机自启
[root@localhost ~]# mv /etc/securetty /etc/securetty_bak   # 设置允许root通过telnet登录
[root@localhost ~]# service xinetd start                   # 启动telnet
Starting xinetd:                                           [  OK  ]
[root@localhost yum.repos.d]# service vsftpd start         # 启动ftp
Starting vsftpd for vsftpd:                                [  OK  ]

（3）开启后通过另外的服务器 telnet ip 进行测试，若连接失败，请检查防火墙，若密码正确但一直登录不上，则可能是 selinux 导致：

临时关闭：setenforce 0 

永久关闭：sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config

二、升级 openssl1.1.1g

1.备份当前版本的 ssl

[root@localhost ~]# mv /usr/bin/openssl /usr/bin/openssl_bak
[root@localhost ~]# mv /usr/include/openssl /usr/include/openssl_bak # 若有则备份，若无则忽略 
[root@localhost ~]# mv /usr/lib64/libssl.so.1.0.1e /usr/lib64/libssl.so.1.0.1e_bak # 重命名之后会发现无法使用 yum 和 rpm 命令了，若是有外网条件的，后面需要下载之前忘记下载的依赖或者软件，重命名回来使用 yum 就可以了，无外网条件就通过 ftp 上传 rpm 包进行安装（其实这几个过程更新 openssl 并不会导致无法登录 ssh 以及 ssh 进行文件传输，会导致的可能是其他误操作或者在更新 openssh 的时候）
[root@localhost ~]# mv /usr/lib64/libssl.so.10 /usr/lib64/libssl.so.10_bak
[root@localhost ~]# mv /usr/lib64/libcrypto.so.10 /usr/lib64/libcrypto.so.10_bak

2.卸载当前版本 openssl

[root@localhost ~]# rpm -qa |grep openssl
openssl-1.0.1e-15.el6.x86_64
[root@localhost ~]# rpm -e --nodeps openssl-1.0.1e-15.el6.x86_64

3.安装新版本 openssl

[root@localhost ~]# tar -zxf openssl-1.1.1g.tar.gz 
[root@localhost ~]# cd openssl-1.1.1g
[root@localhost openssl-1.1.1g]# ./config --prefix=/usr/local/openssl shared
Operating system: x86_64-whatever-linux2
Configuring OpenSSL version 1.1.1g (0x1010107fL) for linux-x86_64
Using os-specific seed configuration
Creating configdata.pm
Creating Makefile

**********************************************************************
***                                                                ***
***   OpenSSL has been successfully configured                     ***
***                                                                ***
***   If you encounter a problem while building, please open an    ***
***   issue on GitHub   ***
***   and include the output from the following command:           ***
***                                                                ***
***       perl configdata.pm --dump                                ***
***                                                                ***
***   (If you are new to OpenSSL, you might want to consult the    ***
***   'Troubleshooting' section in the INSTALL file first)         ***
***                                                                ***
**********************************************************************
[root@localhost ~]# make
[root@localhost ~]# make test
[root@localhost ~]# make install

（1）.若 ./config 出现如下错误，则说明没有安装到 perl 依赖

[root@localhost ~]# cd openssl-1.1.1g
[root@localhost openssl-1.1.1g]# ./config --prefix=/usr/local/openssl shared
Operating system: x86_64-whatever-linux2
You need Perl 5.

[root@localhost openssl-1.1.1g]# yum install -y perl
There was a problem importing one of the Python modules
required to run yum. The error leading to this problem was:

   libcrypto.so.10: cannot open shared object file: No such file or directory

Please install a package which provides this module, or
verify that the module is installed correctly.

It's possible that the above module doesn't match the
current version of Python, which is:
2.6.6 (r266:84292, Nov 22 2013, 12:16:22) 
[GCC 4.4.7 20120313 (Red Hat 4.4.7-4)]

If you cannot solve this problem yourself, please go to 
the yum faq at:
  http://yum.baseurl.org/wiki/Faq

（2）若 make test 出现以下错误，则说明 expat 没有安装

make[1]: Leaving directory `/root/openssl-1.1.1g'
[root@localhost openssl-1.1.1g]# make test
make depend && make _tests
make[1]: Entering directory `/root/openssl-1.1.1g'
make[1]: Leaving directory `/root/openssl-1.1.1g'
make[1]: Entering directory `/root/openssl-1.1.1g'
( cd test; \
          mkdir -p test-runs; \
          SRCTOP=../. \
          BLDTOP=../. \
          RESULT_D=test-runs \
          PERL="/usr/bin/perl" \
          EXE_EXT= \
          OPENSSL_ENGINES=`cd .././engines 2>/dev/null && pwd` \
          OPENSSL_DEBUG_MEMORY=on \
            /usr/bin/perl .././test/run_tests.pl  )
Can't locate Test/Harness.pm in @INC (@INC contains: /root/openssl-1.1.1g/test/../util/perl /usr/local/lib64/perl5 /usr/local/share/perl5 /usr/lib64/perl5/vendor_perl /usr/share/perl5/vendor_perl /usr/lib64/perl5 /usr/share/perl5 .) at .././test/run_tests.pl line 112.
BEGIN failed--compilation aborted at .././test/run_tests.pl line 112.
make[1]: *** [_tests] Error 2
make[1]: Leaving directory `/root/openssl-1.1.1g'
make: *** [tests] Error 2

（3）若 make test 出现如下错误，则说明 perl-Time-HiRes 没有安装

make depend && make _tests
make[1]: Entering directory `/root/openssl-1.1.1g'
make[1]: Leaving directory `/root/openssl-1.1.1g'
make[1]: Entering directory `/root/openssl-1.1.1g'
( cd test; \
          mkdir -p test-runs; \
          SRCTOP=../. \
          BLDTOP=../. \
          RESULT_D=test-runs \
          PERL="/usr/bin/perl" \
          EXE_EXT= \
          OPENSSL_ENGINES=`cd .././engines 2>/dev/null && pwd` \
          OPENSSL_DEBUG_MEMORY=on \
            /usr/bin/perl .././test/run_tests.pl  )
Can't locate Test/Harness.pm in @INC (@INC contains: /root/openssl-1.1.1g/test/../util/perl /usr/local/lib64/perl5 /usr/local/share/perl5 /usr/lib64/perl5/vendor_perl /usr/share/perl5/vendor_perl /usr/lib64/perl5 /usr/share/perl5 .) at .././test/run_tests.pl line 112.
BEGIN failed--compilation aborted at .././test/run_tests.pl line 112.
make[1]: *** [_tests] Error 2
make[1]: Leaving directory `/root/openssl-1.1.1g'
make: *** [tests] Error 2

（4）若 make test 出现如下错误，则说明 perl-Test-Harness 没有安装

[root@localhost openssl-1.1.1g]# make test
make depend && make _tests
make[1]: Entering directory `/root/openssl-1.1.1g'
make[1]: Leaving directory `/root/openssl-1.1.1g'
make[1]: Entering directory `/root/openssl-1.1.1g'
( cd test; \
          mkdir -p test-runs; \
          SRCTOP=../. \
          BLDTOP=../. \
          RESULT_D=test-runs \
          PERL="/usr/bin/perl" \
          EXE_EXT= \
          OPENSSL_ENGINES=`cd .././engines 2>/dev/null && pwd` \
          OPENSSL_DEBUG_MEMORY=on \
            /usr/bin/perl .././test/run_tests.pl  )
Can't locate Test/Harness.pm in @INC (@INC contains: /root/openssl-1.1.1g/test/../util/perl /usr/local/lib64/perl5 /usr/local/share/perl5 /usr/lib64/perl5/vendor_perl /usr/share/perl5/vendor_perl /usr/lib64/perl5 /usr/share/perl5 .) at .././test/run_tests.pl line 112.
BEGIN failed--compilation aborted at .././test/run_tests.pl line 112.
make[1]: *** [_tests] Error 2
make[1]: Leaving directory `/root/openssl-1.1.1g'

（5）若 make test 出现如下错误，则说明 perl-Test-Simple 没有安装（若已经安装还是提示该错误，说明安装的版本太低，默认 yum 安装的版本是 perl-Test-Simple-0.92-144 ），这里解决我是在网上找了一个高版本的进行rpm安装后解决的：perl-Test-Simple-1.302162-79.1.noarch.rpm

make depend && make _tests
make[1]: Entering directory `/root/openssl-1.1.1g'
make[1]: Leaving directory `/root/openssl-1.1.1g'
make[1]: Entering directory `/root/openssl-1.1.1g'
( cd test; \
          mkdir -p test-runs; \
          SRCTOP=../. \
          BLDTOP=../. \
          RESULT_D=test-runs \
          PERL="/usr/bin/perl" \
          EXE_EXT= \
          OPENSSL_ENGINES=`cd .././engines 2>/dev/null && pwd` \
          OPENSSL_DEBUG_MEMORY=on \
            /usr/bin/perl .././test/run_tests.pl  )
../test/recipes/01-test_abort.t .................... Dubious, test returned 2 (wstat 512, 0x200)
No subtests run 
../test/recipes/01-test_sanity.t ................... Dubious, test returned 2 (wstat 512, 0x200)
No subtests run 
../test/recipes/01-test_symbol_presence.t .......... Dubious, test returned 2 (wstat 512, 0x200)
No subtests run 
../test/recipes/01-test_test.t ..................... Dubious, test returned 2 (wstat 512, 0x200)
No subtests run 
../test/recipes/02-test_errstr.t ................... Dubious, test returned 2 (wstat 512, 0x200)
No subtests run 
../test/recipes/02-test_internal_ctype.t ........... Dubious, test returned 2 (wstat 512, 0x200)
No subtests run 
../test/recipes/02-test_lhash.t .................... Dubious, test returned 2 (wstat 512, 0x200)
No subtests run 
../test/recipes/02-test_ordinals.t ................. Dubious, test returned 2 (wstat 512, 0x200)
No subtests run 
../test/recipes/02-test_stack.t .................... Dubious, test returned 2 (wstat 512, 0x200)
No subtests run 
../test/recipes/03-test_exdata.t ................... Dubious, test returned 2 (wstat 512, 0x200)
No subtests run 
../test/recipes/03-test_internal_asn1.t ............ Dubious, test returned 2 (wstat 512, 0x200)
No subtests run 
../test/recipes/03-test_internal_chacha.t .......... Dubious, test returned 2 (wstat 512, 0x200)
No subtests run 
../test/recipes/03-test_internal_curve448.t ........ Dubious, test returned 2 (wstat 512, 0x200)
No subtests run 
../test/recipes/03-test_internal_ec.t .............. Dubious, test returned 2 (wstat 512, 0x200)
No subtests run 
../test/recipes/03-test_internal_mdc2.t ............ Dubious, test returned 2 (wstat 512, 0x200)
No subtests run 
../test/recipes/03-test_internal_modes.t ........... Dubious, test returned 2 (wstat 512, 0x200)
No subtests run 
../test/recipes/03-test_internal_poly1305.t ........ Dubious, test returned 2 (wstat 512, 0x200)
No subtests run 
../test/recipes/03-test_internal_siphash.t ......... Dubious, test returned 2 (wstat 512, 0x200)
No subtests run 
../test/recipes/03-test_internal_sm2.t ............. Dubious, test returned 2 (wstat 512, 0x200)
No subtests run 
../test/recipes/03-test_internal_sm4.t ............. Dubious, test returned 2 (wstat 512, 0x200)
No subtests run 
../test/recipes/03-test_internal_ssl_cert_table.t .. Dubious, test returned 2 (wstat 512, 0x200)
No subtests run 
../test/recipes/03-test_internal_x509.t ............ Dubious, test returned 2 (wstat 512, 0x200)
No subtests run 
../test/recipes/03-test_ui.t ....................... Dubious, test returned 2 (wstat 512, 0x200)
No subtests run 
../test/recipes/04-test_asn1_decode.t .............. Dubious, test returned 2 (wstat 512, 0x200)
No subtests run 
../test/recipes/04-test_asn1_encode.t .............. Dubious, test returned 2 (wstat 512, 0x200)
No subtests run 
../test/recipes/04-test_asn1_string_table.t ........ Dubious, test returned 2 (wstat 512, 0x200)
No subtests run 
../test/recipes/04-test_bio_callback.t ............. Dubious, test returned 2 (wstat 512, 0x200

.....省略...........................................

  Parse errors: No plan found in TAP output
../test/recipes/80-test_ca.t                     (Wstat: 512 Tests: 0 Failed: 0)
  Non-zero exit status: 2
  Parse errors: No plan found in TAP output
../test/recipes/80-test_cipherbytes.t            (Wstat: 512 Tests: 0 Failed: 0)
  Non-zero exit status: 2
  Parse errors: No plan found in TAP output
../test/recipes/80-test_cipherlist.t             (Wstat: 512 Tests: 0 Failed: 0)
  Non-zero exit status: 2
  Parse errors: No plan found in TAP output
../test/recipes/80-test_ciphername.t             (Wstat: 512 Tests: 0 Failed: 0)
  Non-zero exit status: 2
  Parse errors: No plan found in TAP output
../test/recipes/80-test_cms.t                    (Wstat: 512 Tests: 0 Failed: 0)
  Non-zero exit status: 2
  Parse errors: No plan found in TAP output
../test/recipes/80-test_cmsapi.t                 (Wstat: 512 Tests: 0 Failed: 0)
  Non-zero exit status: 2
  Parse errors: No plan found in TAP output
../test/recipes/80-test_ct.t                     (Wstat: 512 Tests: 0 Failed: 0)
  Non-zero exit status: 2
  Parse errors: No plan found in TAP output
../test/recipes/80-test_dane.t                   (Wstat: 512 Tests: 0 Failed: 0)
  Non-zero exit status: 2
  Parse errors: No plan found in TAP output
../test/recipes/80-test_dtls.t                   (Wstat: 512 Tests: 0 Failed: 0)
  Non-zero exit status: 2
  Parse errors: No plan found in TAP output
../test/recipes/80-test_dtls_mtu.t               (Wstat: 512 Tests: 0 Failed: 0)
  Non-zero exit status: 2
  Parse errors: No plan found in TAP output
../test/recipes/80-test_dtlsv1listen.t           (Wstat: 512 Tests: 0 Failed: 0)
  Non-zero exit status: 2
  Parse errors: No plan found in TAP output
../test/recipes/80-test_ocsp.t                   (Wstat: 512 Tests: 0 Failed: 0)
  Non-zero exit status: 2
  Parse errors: No plan found in TAP output
../test/recipes/80-test_pkcs12.t                 (Wstat: 512 Tests: 0 Failed: 0)
  Non-zero exit status: 2
  Parse errors: No plan found in TAP output
../test/recipes/80-test_ssl_new.t                (Wstat: 512 Tests: 0 Failed: 0)
  Non-zero exit status: 2
  Parse errors: No plan found in TAP output
../test/recipes/80-test_ssl_old.t                (Wstat: 512 Tests: 0 Failed: 0)
  Non-zero exit status: 2
  Parse errors: No plan found in TAP output
../test/recipes/80-test_ssl_test_ctx.t           (Wstat: 512 Tests: 0 Failed: 0)
  Non-zero exit status: 2
  Parse errors: No plan found in TAP output
../test/recipes/80-test_sslcorrupt.t             (Wstat: 512 Tests: 0 Failed: 0)
  Non-zero exit status: 2
  Parse errors: No plan found in TAP output
../test/recipes/80-test_tsa.t                    (Wstat: 512 Tests: 0 Failed: 0)
  Non-zero exit status: 2
  Parse errors: No plan found in TAP output
../test/recipes/80-test_x509aux.t                (Wstat: 512 Tests: 0 Failed: 0)
  Non-zero exit status: 2
  Parse errors: No plan found in TAP output
../test/recipes/90-test_asn1_time.t              (Wstat: 512 Tests: 0 Failed: 0)
  Non-zero exit status: 2
  Parse errors: No plan found in TAP output
../test/recipes/90-test_async.t                  (Wstat: 512 Tests: 0 Failed: 0)
  Non-zero exit status: 2
  Parse errors: No plan found in TAP output
../test/recipes/90-test_bio_enc.t                (Wstat: 512 Tests: 0 Failed: 0)
  Non-zero exit status: 2
  Parse errors: No plan found in TAP output
../test/recipes/90-test_bio_memleak.t            (Wstat: 512 Tests: 0 Failed: 0)
  Non-zero exit status: 2
  Parse errors: No plan found in TAP output
../test/recipes/90-test_constant_time.t          (Wstat: 512 Tests: 0 Failed: 0)
  Non-zero exit status: 2
  Parse errors: No plan found in TAP output
../test/recipes/90-test_fatalerr.t               (Wstat: 512 Tests: 0 Failed: 0)
  Non-zero exit status: 2
  Parse errors: No plan found in TAP output
../test/recipes/90-test_gmdiff.t                 (Wstat: 512 Tests: 0 Failed: 0)
  Non-zero exit status: 2
  Parse errors: No plan found in TAP output
../test/recipes/90-test_gost.t                   (Wstat: 512 Tests: 0 Failed: 0)
  Non-zero exit status: 2
  Parse errors: No plan found in TAP output
../test/recipes/90-test_ige.t                    (Wstat: 512 Tests: 0 Failed: 0)
  Non-zero exit status: 2
  Parse errors: No plan found in TAP output
../test/recipes/90-test_includes.t               (Wstat: 512 Tests: 0 Failed: 0)
  Non-zero exit status: 2
  Parse errors: No plan found in TAP output
../test/recipes/90-test_memleak.t                (Wstat: 512 Tests: 0 Failed: 0)
  Non-zero exit status: 2
  Parse errors: No plan found in TAP output
../test/recipes/90-test_overhead.t               (Wstat: 512 Tests: 0 Failed: 0)
  Non-zero exit status: 2
  Parse errors: No plan found in TAP output
../test/recipes/90-test_secmem.t                 (Wstat: 512 Tests: 0 Failed: 0)
  Non-zero exit status: 2
  Parse errors: No plan found in TAP output
../test/recipes/90-test_shlibload.t              (Wstat: 512 Tests: 0 Failed: 0)
  Non-zero exit status: 2
  Parse errors: No plan found in TAP output
../test/recipes/90-test_srp.t                    (Wstat: 512 Tests: 0 Failed: 0)
  Non-zero exit status: 2
  Parse errors: No plan found in TAP output
../test/recipes/90-test_sslapi.t                 (Wstat: 512 Tests: 0 Failed: 0)
  Non-zero exit status: 2
  Parse errors: No plan found in TAP output
../test/recipes/90-test_sslbuffers.t             (Wstat: 512 Tests: 0 Failed: 0)
  Non-zero exit status: 2
  Parse errors: No plan found in TAP output
../test/recipes/90-test_store.t                  (Wstat: 512 Tests: 0 Failed: 0)
  Non-zero exit status: 2
  Parse errors: No plan found in TAP output
../test/recipes/90-test_sysdefault.t             (Wstat: 512 Tests: 0 Failed: 0)
  Non-zero exit status: 2
  Parse errors: No plan found in TAP output
../test/recipes/90-test_threads.t                (Wstat: 512 Tests: 0 Failed: 0)
  Non-zero exit status: 2
  Parse errors: No plan found in TAP output
../test/recipes/90-test_time_offset.t            (Wstat: 512 Tests: 0 Failed: 0)
  Non-zero exit status: 2
  Parse errors: No plan found in TAP output
../test/recipes/90-test_tls13ccs.t               (Wstat: 512 Tests: 0 Failed: 0)
  Non-zero exit status: 2
  Parse errors: No plan found in TAP output
../test/recipes/90-test_tls13encryption.t        (Wstat: 512 Tests: 0 Failed: 0)
  Non-zero exit status: 2
  Parse errors: No plan found in TAP output
../test/recipes/90-test_tls13secrets.t           (Wstat: 512 Tests: 0 Failed: 0)
  Non-zero exit status: 2
  Parse errors: No plan found in TAP output
../test/recipes/90-test_v3name.t                 (Wstat: 512 Tests: 0 Failed: 0)
  Non-zero exit status: 2
  Parse errors: No plan found in TAP output
../test/recipes/95-test_external_boringssl.t     (Wstat: 512 Tests: 0 Failed: 0)
  Non-zero exit status: 2
  Parse errors: No plan found in TAP output
../test/recipes/95-test_external_krb5.t          (Wstat: 512 Tests: 0 Failed: 0)
  Non-zero exit status: 2
  Parse errors: No plan found in TAP output
../test/recipes/95-test_external_pyca.t          (Wstat: 512 Tests: 0 Failed: 0)
  Non-zero exit status: 2
  Parse errors: No plan found in TAP output
../test/recipes/99-test_ecstress.t               (Wstat: 512 Tests: 0 Failed: 0)
  Non-zero exit status: 2
  Parse errors: No plan found in TAP output
../test/recipes/99-test_fuzz.t                   (Wstat: 512 Tests: 0 Failed: 0)
  Non-zero exit status: 2
  Parse errors: No plan found in TAP output
Files=155, Tests=0,  2 wallclock secs ( 0.26 usr  0.22 sys +  0.53 cusr  0.21 csys =  1.22 CPU)
Result: FAIL
make[1]: *** [_tests] Error 1
make[1]: Leaving directory `/root/openssl-1.1.1g'
make: *** [tests] Error 2

4.链接与配置

# （1）设置软连接
[root@localhost openssl-1.1.1g]# ln -s /usr/local/openssl/bin/openssl /usr/bin/openssl
[root@localhost openssl-1.1.1g]# ln -s /usr/local/openssl/include/openssl /usr/include/openssl
[root@localhost openssl-1.1.1g]# ln -s /usr/local/openssl/lib/libssl.so.1.0.0 /usr/lib64/libssl.so
[root@localhost openssl-1.1.1g]# ln -s /usr/local/openssl/lib/libssl.so.1.0.0 /usr/lib64/libssl.so.10
[root@localhost openssl-1.1.1g]# ln -s /usr/local/openssl/lib/libcrypto.so.1.0.0 /usr/lib64/libcrypto.so.10
# （2）将 OpenSSL 的动态链接库地址写入动态链接装入器（dynamic loader）
[root@localhost openssl-1.1.1g]# echo "/usr/local/openssl/lib" >> /etc/ld.so.conf
# （3）重新加载动态链接库
[root@localhost openssl-1.1.1g]# ldconfig -v

5.最后查看 openssl 版本

[root@localhost openssl-1.1.1g]# openssl version -a
OpenSSL 1.1.1g  21 Apr 2020
built on: Fri Jun  4 01:56:09 2021 UTC
platform: linux-x86_64
options:  bn(64,64) rc4(16x,int) des(int) idea(int) blowfish(ptr) 
compiler: gcc -fPIC -pthread -m64 -Wa,--noexecstack -Wall -O3 -DOPENSSL_USE_NODELETE -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM -DNDEBUG
OPENSSLDIR: "/usr/local/openssl/ssl"
ENGINESDIR: "/usr/local/openssl/lib/engines-1.1"
Seeding source: os-specific

三、升级openssh8.6p1

1.卸载旧版本 openssh

[root@localhost ~]# rpm -e --nodeps `rpm -qa | grep openssh`

2.安装相关依赖

[root@localhost ~]# yum install -y libICE libSM libX11 libXt atk cairo gtk2

3.安装新版本openssh

[root@localhost openssh]# ll
total 10824
-rw-r--r--. 1 root root 5491570 Jun  1 11:01 openssh8.6-c6.zip
-rw-r--r--. 1 root root  611856 May 10 20:58 openssh-8.6p1-1.el6.x86_64.rpm
-rw-r--r--. 1 root root   42728 May 10 20:58 openssh-askpass-8.6p1-1.el6.x86_64.rpm
-rw-r--r--. 1 root root   24512 May 10 20:58 openssh-askpass-gnome-8.6p1-1.el6.x86_64.rpm
-rw-r--r--. 1 root root  735316 May 10 20:58 openssh-clients-8.6p1-1.el6.x86_64.rpm
-rw-r--r--. 1 root root 3690132 May 10 20:58 openssh-debuginfo-8.6p1-1.el6.x86_64.rpm
-rw-r--r--. 1 root root  477096 May 10 20:58 openssh-server-8.6p1-1.el6.x86_64.rpm
[root@localhost openssh]# rpm -ivh ./*.rpm
Preparing...                ########################################### [100%]
   1:openssh                ########################################### [ 17%]
   2:openssh-askpass        ########################################### [ 33%]
   3:openssh-askpass-gnome  ########################################### [ 50%]
   4:openssh-clients        ########################################### [ 67%]
   5:openssh-server         ########################################### [ 83%]
   6:openssh-debuginfo      ########################################### [100%]

（1）若不卸载就版本直接更新 ，需要修改以下文件权限

cd /etc/ssh
chmod 400 ssh_host_ecdsa_key ssh_host_ed25519_key ssh_host_rsa_key

（2）配置 /etc/ssh/sshd_config 文件（安装后 sshd_config 为默认状态）

[root@localhost ssh]# echo "PermitRootLogin yes" >> /etc/ssh/sshd_config
[root@localhost ssh]# echo "PasswordAuthentication yes"  >> /etc/ssh/sshd_config

（3）重启 sshd（若发现重启后ssh断了，则需要用到 telnet 去操作，可以先做后面的步骤后再重启 sshd）

[root@localhost ssh]# service sshd restart

（4）重新配置配还原的 /etc/pam.d/sshd 文件

[root@localhost ~]# >/etc/pam.d/sshd                       # 先清空，后配置
[root@localhost ~]# echo '#%PAM-1.0
> auth       required     pam_sepermit.so
> auth       include      password-auth
> account    required     pam_nologin.so
> account    include      password-auth
> password   include      password-auth
> # pam_selinux.so close should be the first session rule
> session    required     pam_selinux.so close
> session    required     pam_loginuid.so
> # pam_selinux.so open should only be followed by sessions to be executed in the user context
> session    required     pam_selinux.so open env_params
> session    optional     pam_keyinit.so force revoke
> session    include      password-auth'>/etc/pam.d/sshd

  a.重新登录 ssh 你会发现无法连接，报以下第一段错误，只需要在 sshd_config 文件中最后加入如下第二段配置，并重启即可

Key exchange failed.
No compatible key exchange method. The server supports these methods: curve25519-sha256,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256

[root@localhost ~]# vi /etc/ssh/sshd_config  # 末尾加入如下内容
KexAlgorithms [email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1
[root@localhost ~]# service sshd restart

  b.若输入正确密码后还是不能登录 ssh ，说明是 selinux 限制，上面有提到，关闭即可。

---

四、小结

1.上述升级过程为比较规范的升级过程，升级过程中所出现的错误也是我不断百度并实验得以解决，若升级过程有其他的错误已经解决方案也请评论，或者给个链接，大家一起学习学习。

其中 openssl 升级也可以忽略不做 make test 那一步，升级就会很顺畅，但是后续有什么后果，或者导致某些服务不可用的情况还不可知，所以是否要忽略这一步大家自行判断，因为有些环境完全外网隔离的，安装依赖等相对麻烦。

以下是我参考其他链接的执行步骤（该方法可行，在 centos6 版本中测试了均没出现问题），参考地址：CentOS升级Openssl至1.1.1g_乐大师的博客-CSDN博客

# 解压文件，并安装
# tar xfz openssl-1.1.1g.tar.gz
# cd openssl-1.1.1g
# ./config --prefix=/usr/local/openssl
# make && make install

# 备份源文件及目录
# mv /usr/bin/openssl  /usr/bin/openssl.old
# mv /usr/include/openssl/ /usr/include/openssl.old

# 设置相关软链接
ln -s /usr/local/openssl/bin/openssl /usr/bin/openssl
ln -s /usr/local/openssl/include/openssl /usr/include/openssl
ln -s /usr/local/openssl/lib/libssl.so /usr/local/lib64/libssl.so

# 将 OpenSSL 的动态链接库地址写入动态链接装入器（dynamic loader）
echo "/usr/local/openssl/lib" >> /etc/ld.so.conf

# 重新加载动态链接库 
ldconfig -v

# 测试升级后版本
openssl version -v

2.还有一个大家可能关注的问题，使用 ssh -V 查看的版本和 openssl version 查出的 openssl 版本不一致。其原因是 ssh -V 显示的是 openssh 编译成 rpm 包时使用的 openssl ，不是当前部署的 openssl ，这个其实不影响实际版本，若一定要求版本一致，可以使用编译安装 openssh，可参考下这篇 centos7 编译安装的：Centos 7.3 下 编译Openssh 8.6 RPM （使用Openssl 1.1.1k）_centos openssl rpm_lijq3370的博客-CSDN博客