centos6.5 升级openssl1.1.1g、openssh8.6p1小记
系统版本：CentOS release 6.5 (Final)
默认版本：OpenSSH_5.3p1, OpenSSL 1.0.1e-fips
升级版本：OpenSSH_8.6p1, OpenSSL 1.1.1g
相关升级文件下载：https://download.csdn.net/download/qq_25868251/19426574 （其中基于 openssl1.1 的是 centos7 版本的）
一、安装应急服务
1.安装相关依赖及服务
yum install -y gcc pam-devel zlib-devel perl expat-devel perl-Time-HiRes perl-Test-Harness perl-Test-Simple xinetd telnet-server vsftpd（1）.此处安装 telnet 服务的目的是使 linux 能通过 telnet 登录系统，避免升级过程出现问题导致 ssh 无法登录，必要情况还需要安装 vsftpd 服务，假如 ssh 无法使用而且需要上传相关文件会用到此服务，此处建议安装上，出现问题可以省略很多不必要的麻烦。注意：默认防火墙并不开放 23 端口，可直接关闭防火墙，若服务器不允许关闭，请在防火策略开放 23 端口，ftp 服务需要开放 21和 20（建议使用默认配置，匿名登录即可）
a.若 yum 安装遇到无法使用源的情况，请参照该教程：
Centos6.5 解决源无法使用问题_啊 这的博客-CSDN博客
b.若想进一步了解 vsftpd 服务，请参考该教程：
ftp之vsftpd使用过程遇到的坑_vsftpd3.0.5 pam不起作用_啊 这的博客-CSDN博客
2、配置服务及开启服务
（1）将 disable yes 改为 disable no
[root@localhost ~]# vi /etc/xinetd.d/telnet
# default: on
# description: The telnet server serves telnet sessions; it uses \
# unencrypted username/password pairs for authentication.
service telnet
{
flags = REUSE
socket_type = stream
wait = no
user = root
server = /usr/sbin/in.telnetd
log_on_failure += USERID
# disable = yes
disable = no
}（2）启动服务
[root@localhost ~]# chkconfig xinetd on # 设置开机自启
[root@localhost ~]# mv /etc/securetty /etc/securetty_bak # 设置允许root通过telnet登录
[root@localhost ~]# service xinetd start # 启动telnet
Starting xinetd: [ OK ]
[root@localhost yum.repos.d]# service vsftpd start # 启动ftp
Starting vsftpd for vsftpd: [ OK ]（3）开启后通过另外的服务器 telnet ip 进行测试，若连接失败，请检查防火墙，若密码正确但一直登录不上，则可能是 selinux 导致：
临时关闭：setenforce 0
永久关闭：sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config二、升级 openssl1.1.1g
1.备份当前版本的 ssl
[root@localhost ~]# mv /usr/bin/openssl /usr/bin/openssl_bak
[root@localhost ~]# mv /usr/include/openssl /usr/include/openssl_bak # 若有则备份，若无则忽略
[root@localhost ~]# mv /usr/lib64/libssl.so.1.0.1e /usr/lib64/libssl.so.1.0.1e_bak # 重命名之后会发现无法使用 yum 和 rpm 命令了，若是有外网条件的，后面需要下载之前忘记下载的依赖或者软件，重命名回来使用 yum 就可以了，无外网条件就通过 ftp 上传 rpm 包进行安装（其实这几个过程更新 openssl 并不会导致无法登录 ssh 以及 ssh 进行文件传输，会导致的可能是其他误操作或者在更新 openssh 的时候）
[root@localhost ~]# mv /usr/lib64/libssl.so.10 /usr/lib64/libssl.so.10_bak
[root@localhost ~]# mv /usr/lib64/libcrypto.so.10 /usr/lib64/libcrypto.so.10_bak2.卸载当前版本 openssl
[root@localhost ~]# rpm -qa |grep openssl
openssl-1.0.1e-15.el6.x86_64
[root@localhost ~]# rpm -e --nodeps openssl-1.0.1e-15.el6.x86_643.安装新版本 openssl
[root@localhost ~]# tar -zxf openssl-1.1.1g.tar.gz
[root@localhost ~]# cd openssl-1.1.1g
[root@localhost openssl-1.1.1g]# ./config --prefix=/usr/local/openssl shared
Operating system: x86_64-whatever-linux2
Configuring OpenSSL version 1.1.1g (0x1010107fL) for linux-x86_64
Using os-specific seed configuration
Creating configdata.pm
Creating Makefile
**********************************************************************
*** ***
*** OpenSSL has been successfully configured ***
*** ***
*** If you encounter a problem while building, please open an ***
*** issue on GitHub ***
*** and include the output from the following command: ***
*** ***
*** perl configdata.pm --dump ***
*** ***
*** (If you are new to OpenSSL, you might want to consult the ***
*** 'Troubleshooting' section in the INSTALL file first) ***
*** ***
**********************************************************************
[root@localhost ~]# make
[root@localhost ~]# make test
[root@localhost ~]# make install （1）.若 ./config 出现如下错误，则说明没有安装到 perl 依赖
[root@localhost ~]# cd openssl-1.1.1g
[root@localhost openssl-1.1.1g]# ./config --prefix=/usr/local/openssl shared
Operating system: x86_64-whatever-linux2
You need Perl 5.
[root@localhost openssl-1.1.1g]# yum install -y perl
There was a problem importing one of the Python modules
required to run yum. The error leading to this problem was:
libcrypto.so.10: cannot open shared object file: No such file or directory
Please install a package which provides this module, or
verify that the module is installed correctly.
It's possible that the above module doesn't match the
current version of Python, which is:
2.6.6 (r266:84292, Nov 22 2013, 12:16:22)
[GCC 4.4.7 20120313 (Red Hat 4.4.7-4)]
If you cannot solve this problem yourself, please go to
the yum faq at:
http://yum.baseurl.org/wiki/Faq（2）若 make test 出现以下错误，则说明 expat 没有安装
make[1]: Leaving directory `/root/openssl-1.1.1g'
[root@localhost openssl-1.1.1g]# make test
make depend && make _tests
make[1]: Entering directory `/root/openssl-1.1.1g'
make[1]: Leaving directory `/root/openssl-1.1.1g'
make[1]: Entering directory `/root/openssl-1.1.1g'
( cd test; \
mkdir -p test-runs; \
SRCTOP=../. \
BLDTOP=../. \
RESULT_D=test-runs \
PERL="/usr/bin/perl" \
EXE_EXT= \
OPENSSL_ENGINES=`cd .././engines 2>/dev/null && pwd` \
OPENSSL_DEBUG_MEMORY=on \
/usr/bin/perl .././test/run_tests.pl )
Can't locate Test/Harness.pm in @INC (@INC contains: /root/openssl-1.1.1g/test/../util/perl /usr/local/lib64/perl5 /usr/local/share/perl5 /usr/lib64/perl5/vendor_perl /usr/share/perl5/vendor_perl /usr/lib64/perl5 /usr/share/perl5 .) at .././test/run_tests.pl line 112.
BEGIN failed--compilation aborted at .././test/run_tests.pl line 112.
make[1]: *** [_tests] Error 2
make[1]: Leaving directory `/root/openssl-1.1.1g'
make: *** [tests] Error 2（3）若 make test 出现如下错误，则说明 perl-Time-HiRes 没有安装
make depend && make _tests
make[1]: Entering directory `/root/openssl-1.1.1g'
make[1]: Leaving directory `/root/openssl-1.1.1g'
make[1]: Entering directory `/root/openssl-1.1.1g'
( cd test; \
mkdir -p test-runs; \
SRCTOP=../. \
BLDTOP=../. \
RESULT_D=test-runs \
PERL="/usr/bin/perl" \
EXE_EXT= \
OPENSSL_ENGINES=`cd .././engines 2>/dev/null && pwd` \
OPENSSL_DEBUG_MEMORY=on \
/usr/bin/perl .././test/run_tests.pl )
Can't locate Test/Harness.pm in @INC (@INC contains: /root/openssl-1.1.1g/test/../util/perl /usr/local/lib64/perl5 /usr/local/share/perl5 /usr/lib64/perl5/vendor_perl /usr/share/perl5/vendor_perl /usr/lib64/perl5 /usr/share/perl5 .) at .././test/run_tests.pl line 112.
BEGIN failed--compilation aborted at .././test/run_tests.pl line 112.
make[1]: *** [_tests] Error 2
make[1]: Leaving directory `/root/openssl-1.1.1g'
make: *** [tests] Error 2（4）若 make test 出现如下错误，则说明 perl-Test-Harness 没有安装
[root@localhost openssl-1.1.1g]# make test
make depend && make _tests
make[1]: Entering directory `/root/openssl-1.1.1g'
make[1]: Leaving directory `/root/openssl-1.1.1g'
make[1]: Entering directory `/root/openssl-1.1.1g'
( cd test; \
mkdir -p test-runs; \
SRCTOP=../. \
BLDTOP=../. \
RESULT_D=test-runs \
PERL="/usr/bin/perl" \
EXE_EXT= \
OPENSSL_ENGINES=`cd .././engines 2>/dev/null && pwd` \
OPENSSL_DEBUG_MEMORY=on \
/usr/bin/perl .././test/run_tests.pl )
Can't locate Test/Harness.pm in @INC (@INC contains: /root/openssl-1.1.1g/test/../util/perl /usr/local/lib64/perl5 /usr/local/share/perl5 /usr/lib64/perl5/vendor_perl /usr/share/perl5/vendor_perl /usr/lib64/perl5 /usr/share/perl5 .) at .././test/run_tests.pl line 112.
BEGIN failed--compilation aborted at .././test/run_tests.pl line 112.
make[1]: *** [_tests] Error 2
make[1]: Leaving directory `/root/openssl-1.1.1g'（5）若 make test 出现如下错误，则说明 perl-Test-Simple 没有安装（若已经安装还是提示该错误，说明安装的版本太低，默认 yum 安装的版本是 perl-Test-Simple-0.92-144 ），这里解决我是在网上找了一个高版本的进行rpm安装后解决的：perl-Test-Simple-1.302162-79.1.noarch.rpm
make depend && make _tests
make[1]: Entering directory `/root/openssl-1.1.1g'
make[1]: Leaving directory `/root/openssl-1.1.1g'
make[1]: Entering directory `/root/openssl-1.1.1g'
( cd test; \
mkdir -p test-runs; \
SRCTOP=../. \
BLDTOP=../. \
RESULT_D=test-runs \
PERL="/usr/bin/perl" \
EXE_EXT= \
OPENSSL_ENGINES=`cd .././engines 2>/dev/null && pwd` \
OPENSSL_DEBUG_MEMORY=on \
/usr/bin/perl .././test/run_tests.pl )
../test/recipes/01-test_abort.t .................... Dubious, test returned 2 (wstat 512, 0x200)
No subtests run
../test/recipes/01-test_sanity.t ................... Dubious, test returned 2 (wstat 512, 0x200)
No subtests run
../test/recipes/01-test_symbol_presence.t .......... Dubious, test returned 2 (wstat 512, 0x200)
No subtests run
../test/recipes/01-test_test.t ..................... Dubious, test returned 2 (wstat 512, 0x200)
No subtests run
../test/recipes/02-test_errstr.t ................... Dubious, test returned 2 (wstat 512, 0x200)
No subtests run
../test/recipes/02-test_internal_ctype.t ........... Dubious, test returned 2 (wstat 512, 0x200)
No subtests run
../test/recipes/02-test_lhash.t .................... Dubious, test returned 2 (wstat 512, 0x200)
No subtests run
../test/recipes/02-test_ordinals.t ................. Dubious, test returned 2 (wstat 512, 0x200)
No subtests run
../test/recipes/02-test_stack.t .................... Dubious, test returned 2 (wstat 512, 0x200)
No subtests run
../test/recipes/03-test_exdata.t ................... Dubious, test returned 2 (wstat 512, 0x200)
No subtests run
../test/recipes/03-test_internal_asn1.t ............ Dubious, test returned 2 (wstat 512, 0x200)
No subtests run
../test/recipes/03-test_internal_chacha.t .......... Dubious, test returned 2 (wstat 512, 0x200)
No subtests run
../test/recipes/03-test_internal_curve448.t ........ Dubious, test returned 2 (wstat 512, 0x200)
No subtests run
../test/recipes/03-test_internal_ec.t .............. Dubious, test returned 2 (wstat 512, 0x200)
No subtests run
../test/recipes/03-test_internal_mdc2.t ............ Dubious, test returned 2 (wstat 512, 0x200)
No subtests run
../test/recipes/03-test_internal_modes.t ........... Dubious, test returned 2 (wstat 512, 0x200)
No subtests run
../test/recipes/03-test_internal_poly1305.t ........ Dubious, test returned 2 (wstat 512, 0x200)
No subtests run
../test/recipes/03-test_internal_siphash.t ......... Dubious, test returned 2 (wstat 512, 0x200)
No subtests run
../test/recipes/03-test_internal_sm2.t ............. Dubious, test returned 2 (wstat 512, 0x200)
No subtests run
../test/recipes/03-test_internal_sm4.t ............. Dubious, test returned 2 (wstat 512, 0x200)
No subtests run
../test/recipes/03-test_internal_ssl_cert_table.t .. Dubious, test returned 2 (wstat 512, 0x200)
No subtests run
../test/recipes/03-test_internal_x509.t ............ Dubious, test returned 2 (wstat 512, 0x200)
No subtests run
../test/recipes/03-test_ui.t ....................... Dubious, test returned 2 (wstat 512, 0x200)
No subtests run
../test/recipes/04-test_asn1_decode.t .............. Dubious, test returned 2 (wstat 512, 0x200)
No subtests run
../test/recipes/04-test_asn1_encode.t .............. Dubious, test returned 2 (wstat 512, 0x200)
No subtests run
../test/recipes/04-test_asn1_string_table.t ........ Dubious, test returned 2 (wstat 512, 0x200)
No subtests run
../test/recipes/04-test_bio_callback.t ............. Dubious, test returned 2 (wstat 512, 0x200
.....省略...........................................
Parse errors: No plan found in TAP output
../test/recipes/80-test_ca.t (Wstat: 512 Tests: 0 Failed: 0)
Non-zero exit status: 2
Parse errors: No plan found in TAP output
../test/recipes/80-test_cipherbytes.t (Wstat: 512 Tests: 0 Failed: 0)
Non-zero exit status: 2
Parse errors: No plan found in TAP output
../test/recipes/80-test_cipherlist.t (Wstat: 512 Tests: 0 Failed: 0)
Non-zero exit status: 2
Parse errors: No plan found in TAP output
../test/recipes/80-test_ciphername.t (Wstat: 512 Tests: 0 Failed: 0)
Non-zero exit status: 2
Parse errors: No plan found in TAP output
../test/recipes/80-test_cms.t (Wstat: 512 Tests: 0 Failed: 0)
Non-zero exit status: 2
Parse errors: No plan found in TAP output
../test/recipes/80-test_cmsapi.t (Wstat: 512 Tests: 0 Failed: 0)
Non-zero exit status: 2
Parse errors: No plan found in TAP output
../test/recipes/80-test_ct.t (Wstat: 512 Tests: 0 Failed: 0)
Non-zero exit status: 2
Parse errors: No plan found in TAP output
../test/recipes/80-test_dane.t (Wstat: 512 Tests: 0 Failed: 0)
Non-zero exit status: 2
Parse errors: No plan found in TAP output
../test/recipes/80-test_dtls.t (Wstat: 512 Tests: 0 Failed: 0)
Non-zero exit status: 2
Parse errors: No plan found in TAP output
../test/recipes/80-test_dtls_mtu.t (Wstat: 512 Tests: 0 Failed: 0)
Non-zero exit status: 2
Parse errors: No plan found in TAP output
../test/recipes/80-test_dtlsv1listen.t (Wstat: 512 Tests: 0 Failed: 0)
Non-zero exit status: 2
Parse errors: No plan found in TAP output
../test/recipes/80-test_ocsp.t (Wstat: 512 Tests: 0 Failed: 0)
Non-zero exit status: 2
Parse errors: No plan found in TAP output
../test/recipes/80-test_pkcs12.t (Wstat: 512 Tests: 0 Failed: 0)
Non-zero exit status: 2
Parse errors: No plan found in TAP output
../test/recipes/80-test_ssl_new.t (Wstat: 512 Tests: 0 Failed: 0)
Non-zero exit status: 2
Parse errors: No plan found in TAP output
../test/recipes/80-test_ssl_old.t (Wstat: 512 Tests: 0 Failed: 0)
Non-zero exit status: 2
Parse errors: No plan found in TAP output
../test/recipes/80-test_ssl_test_ctx.t (Wstat: 512 Tests: 0 Failed: 0)
Non-zero exit status: 2
Parse errors: No plan found in TAP output
../test/recipes/80-test_sslcorrupt.t (Wstat: 512 Tests: 0 Failed: 0)
Non-zero exit status: 2
Parse errors: No plan found in TAP output
../test/recipes/80-test_tsa.t (Wstat: 512 Tests: 0 Failed: 0)
Non-zero exit status: 2
Parse errors: No plan found in TAP output
../test/recipes/80-test_x509aux.t (Wstat: 512 Tests: 0 Failed: 0)
Non-zero exit status: 2
Parse errors: No plan found in TAP output
../test/recipes/90-test_asn1_time.t (Wstat: 512 Tests: 0 Failed: 0)
Non-zero exit status: 2
Parse errors: No plan found in TAP output
../test/recipes/90-test_async.t (Wstat: 512 Tests: 0 Failed: 0)
Non-zero exit status: 2
Parse errors: No plan found in TAP output
../test/recipes/90-test_bio_enc.t (Wstat: 512 Tests: 0 Failed: 0)
Non-zero exit status: 2
Parse errors: No plan found in TAP output
../test/recipes/90-test_bio_memleak.t (Wstat: 512 Tests: 0 Failed: 0)
Non-zero exit status: 2
Parse errors: No plan found in TAP output
../test/recipes/90-test_constant_time.t (Wstat: 512 Tests: 0 Failed: 0)
Non-zero exit status: 2
Parse errors: No plan found in TAP output
../test/recipes/90-test_fatalerr.t (Wstat: 512 Tests: 0 Failed: 0)
Non-zero exit status: 2
Parse errors: No plan found in TAP output
../test/recipes/90-test_gmdiff.t (Wstat: 512 Tests: 0 Failed: 0)
Non-zero exit status: 2
Parse errors: No plan found in TAP output
../test/recipes/90-test_gost.t (Wstat: 512 Tests: 0 Failed: 0)
Non-zero exit status: 2
Parse errors: No plan found in TAP output
../test/recipes/90-test_ige.t (Wstat: 512 Tests: 0 Failed: 0)
Non-zero exit status: 2
Parse errors: No plan found in TAP output
../test/recipes/90-test_includes.t (Wstat: 512 Tests: 0 Failed: 0)
Non-zero exit status: 2
Parse errors: No plan found in TAP output
../test/recipes/90-test_memleak.t (Wstat: 512 Tests: 0 Failed: 0)
Non-zero exit status: 2
Parse errors: No plan found in TAP output
../test/recipes/90-test_overhead.t (Wstat: 512 Tests: 0 Failed: 0)
Non-zero exit status: 2
Parse errors: No plan found in TAP output
../test/recipes/90-test_secmem.t (Wstat: 512 Tests: 0 Failed: 0)
Non-zero exit status: 2
Parse errors: No plan found in TAP output
../test/recipes/90-test_shlibload.t (Wstat: 512 Tests: 0 Failed: 0)
Non-zero exit status: 2
Parse errors: No plan found in TAP output
../test/recipes/90-test_srp.t (Wstat: 512 Tests: 0 Failed: 0)
Non-zero exit status: 2
Parse errors: No plan found in TAP output
../test/recipes/90-test_sslapi.t (Wstat: 512 Tests: 0 Failed: 0)
Non-zero exit status: 2
Parse errors: No plan found in TAP output
../test/recipes/90-test_sslbuffers.t (Wstat: 512 Tests: 0 Failed: 0)
Non-zero exit status: 2
Parse errors: No plan found in TAP output
../test/recipes/90-test_store.t (Wstat: 512 Tests: 0 Failed: 0)
Non-zero exit status: 2
Parse errors: No plan found in TAP output
../test/recipes/90-test_sysdefault.t (Wstat: 512 Tests: 0 Failed: 0)
Non-zero exit status: 2
Parse errors: No plan found in TAP output
../test/recipes/90-test_threads.t (Wstat: 512 Tests: 0 Failed: 0)
Non-zero exit status: 2
Parse errors: No plan found in TAP output
../test/recipes/90-test_time_offset.t (Wstat: 512 Tests: 0 Failed: 0)
Non-zero exit status: 2
Parse errors: No plan found in TAP output
../test/recipes/90-test_tls13ccs.t (Wstat: 512 Tests: 0 Failed: 0)
Non-zero exit status: 2
Parse errors: No plan found in TAP output
../test/recipes/90-test_tls13encryption.t (Wstat: 512 Tests: 0 Failed: 0)
Non-zero exit status: 2
Parse errors: No plan found in TAP output
../test/recipes/90-test_tls13secrets.t (Wstat: 512 Tests: 0 Failed: 0)
Non-zero exit status: 2
Parse errors: No plan found in TAP output
../test/recipes/90-test_v3name.t (Wstat: 512 Tests: 0 Failed: 0)
Non-zero exit status: 2
Parse errors: No plan found in TAP output
../test/recipes/95-test_external_boringssl.t (Wstat: 512 Tests: 0 Failed: 0)
Non-zero exit status: 2
Parse errors: No plan found in TAP output
../test/recipes/95-test_external_krb5.t (Wstat: 512 Tests: 0 Failed: 0)
Non-zero exit status: 2
Parse errors: No plan found in TAP output
../test/recipes/95-test_external_pyca.t (Wstat: 512 Tests: 0 Failed: 0)
Non-zero exit status: 2
Parse errors: No plan found in TAP output
../test/recipes/99-test_ecstress.t (Wstat: 512 Tests: 0 Failed: 0)
Non-zero exit status: 2
Parse errors: No plan found in TAP output
../test/recipes/99-test_fuzz.t (Wstat: 512 Tests: 0 Failed: 0)
Non-zero exit status: 2
Parse errors: No plan found in TAP output
Files=155, Tests=0, 2 wallclock secs ( 0.26 usr 0.22 sys + 0.53 cusr 0.21 csys = 1.22 CPU)
Result: FAIL
make[1]: *** [_tests] Error 1
make[1]: Leaving directory `/root/openssl-1.1.1g'
make: *** [tests] Error 24.链接与配置
# （1）设置软连接
[root@localhost openssl-1.1.1g]# ln -s /usr/local/openssl/bin/openssl /usr/bin/openssl
[root@localhost openssl-1.1.1g]# ln -s /usr/local/openssl/include/openssl /usr/include/openssl
[root@localhost openssl-1.1.1g]# ln -s /usr/local/openssl/lib/libssl.so.1.0.0 /usr/lib64/libssl.so
[root@localhost openssl-1.1.1g]# ln -s /usr/local/openssl/lib/libssl.so.1.0.0 /usr/lib64/libssl.so.10
[root@localhost openssl-1.1.1g]# ln -s /usr/local/openssl/lib/libcrypto.so.1.0.0 /usr/lib64/libcrypto.so.10
# （2）将 OpenSSL 的动态链接库地址写入动态链接装入器（dynamic loader）
[root@localhost openssl-1.1.1g]# echo "/usr/local/openssl/lib" >> /etc/ld.so.conf
# （3）重新加载动态链接库
[root@localhost openssl-1.1.1g]# ldconfig -v5.最后查看 openssl 版本
[root@localhost openssl-1.1.1g]# openssl version -a
OpenSSL 1.1.1g 21 Apr 2020
built on: Fri Jun 4 01:56:09 2021 UTC
platform: linux-x86_64
options: bn(64,64) rc4(16x,int) des(int) idea(int) blowfish(ptr)
compiler: gcc -fPIC -pthread -m64 -Wa,--noexecstack -Wall -O3 -DOPENSSL_USE_NODELETE -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM -DNDEBUG
OPENSSLDIR: "/usr/local/openssl/ssl"
ENGINESDIR: "/usr/local/openssl/lib/engines-1.1"
Seeding source: os-specific三、升级openssh8.6p1
1.卸载旧版本 openssh
[root@localhost ~]# rpm -e --nodeps `rpm -qa | grep openssh`2.安装相关依赖
[root@localhost ~]# yum install -y libICE libSM libX11 libXt atk cairo gtk23.安装新版本openssh
[root@localhost openssh]# ll
total 10824
-rw-r--r--. 1 root root 5491570 Jun 1 11:01 openssh8.6-c6.zip
-rw-r--r--. 1 root root 611856 May 10 20:58 openssh-8.6p1-1.el6.x86_64.rpm
-rw-r--r--. 1 root root 42728 May 10 20:58 openssh-askpass-8.6p1-1.el6.x86_64.rpm
-rw-r--r--. 1 root root 24512 May 10 20:58 openssh-askpass-gnome-8.6p1-1.el6.x86_64.rpm
-rw-r--r--. 1 root root 735316 May 10 20:58 openssh-clients-8.6p1-1.el6.x86_64.rpm
-rw-r--r--. 1 root root 3690132 May 10 20:58 openssh-debuginfo-8.6p1-1.el6.x86_64.rpm
-rw-r--r--. 1 root root 477096 May 10 20:58 openssh-server-8.6p1-1.el6.x86_64.rpm
[root@localhost openssh]# rpm -ivh ./*.rpm
Preparing... ########################################### [100%]
1:openssh ########################################### [ 17%]
2:openssh-askpass ########################################### [ 33%]
3:openssh-askpass-gnome ########################################### [ 50%]
4:openssh-clients ########################################### [ 67%]
5:openssh-server ########################################### [ 83%]
6:openssh-debuginfo ########################################### [100%]（1）若不卸载就版本直接更新 ，需要修改以下文件权限
cd /etc/ssh
chmod 400 ssh_host_ecdsa_key ssh_host_ed25519_key ssh_host_rsa_key（2）配置 /etc/ssh/sshd_config 文件（安装后 sshd_config 为默认状态）
[root@localhost ssh]# echo "PermitRootLogin yes" >> /etc/ssh/sshd_config
[root@localhost ssh]# echo "PasswordAuthentication yes" >> /etc/ssh/sshd_config（3）重启 sshd（若发现重启后ssh断了，则需要用到 telnet 去操作，可以先做后面的步骤后再重启 sshd）
[root@localhost ssh]# service sshd restart（4）重新配置配还原的 /etc/pam.d/sshd 文件
[root@localhost ~]# >/etc/pam.d/sshd # 先清空，后配置
[root@localhost ~]# echo '#%PAM-1.0
> auth required pam_sepermit.so
> auth include password-auth
> account required pam_nologin.so
> account include password-auth
> password include password-auth
> # pam_selinux.so close should be the first session rule
> session required pam_selinux.so close
> session required pam_loginuid.so
> # pam_selinux.so open should only be followed by sessions to be executed in the user context
> session required pam_selinux.so open env_params
> session optional pam_keyinit.so force revoke
> session include password-auth'>/etc/pam.d/sshda.重新登录 ssh 你会发现无法连接，报以下第一段错误，只需要在 sshd_config 文件中最后加入如下第二段配置，并重启即可
Key exchange failed.
No compatible key exchange method. The server supports these methods: curve25519-sha256,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256[root@localhost ~]# vi /etc/ssh/sshd_config # 末尾加入如下内容
KexAlgorithms [email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1
[root@localhost ~]# service sshd restartb.若输入正确密码后还是不能登录 ssh ，说明是 selinux 限制，上面有提到，关闭即可。
四、小结
1.上述升级过程为比较规范的升级过程，升级过程中所出现的错误也是我不断百度并实验得以解决，若升级过程有其他的错误已经解决方案也请评论，或者给个链接，大家一起学习学习。
其中 openssl 升级也可以忽略不做 make test 那一步，升级就会很顺畅，但是后续有什么后果，或者导致某些服务不可用的情况还不可知，所以是否要忽略这一步大家自行判断，因为有些环境完全外网隔离的，安装依赖等相对麻烦。
以下是我参考其他链接的执行步骤（该方法可行，在 centos6 版本中测试了均没出现问题），参考地址：CentOS升级Openssl至1.1.1g_乐大师的博客-CSDN博客
# 解压文件，并安装
# tar xfz openssl-1.1.1g.tar.gz
# cd openssl-1.1.1g
# ./config --prefix=/usr/local/openssl
# make && make install
# 备份源文件及目录
# mv /usr/bin/openssl /usr/bin/openssl.old
# mv /usr/include/openssl/ /usr/include/openssl.old
# 设置相关软链接
ln -s /usr/local/openssl/bin/openssl /usr/bin/openssl
ln -s /usr/local/openssl/include/openssl /usr/include/openssl
ln -s /usr/local/openssl/lib/libssl.so /usr/local/lib64/libssl.so
# 将 OpenSSL 的动态链接库地址写入动态链接装入器（dynamic loader）
echo "/usr/local/openssl/lib" >> /etc/ld.so.conf
# 重新加载动态链接库
ldconfig -v
# 测试升级后版本
openssl version -v2.还有一个大家可能关注的问题，使用 ssh -V 查看的版本和 openssl version 查出的 openssl 版本不一致。其原因是 ssh -V 显示的是 openssh 编译成 rpm 包时使用的 openssl ，不是当前部署的 openssl ，这个其实不影响实际版本，若一定要求版本一致，可以使用编译安装 openssh，可参考下这篇 centos7 编译安装的：Centos 7.3 下 编译Openssh 8.6 RPM （使用Openssl 1.1.1k）_centos openssl rpm_lijq3370的博客-CSDN博客