主要是上个月openssl出现了漏洞,因此要对服务器的进行升级。建议如果没问题还是尽量别升级。主要步骤是2,脚本内容也只包含升级。1和3是开启和关闭telnet,不建议使用telnet。
实际中我没使用telnet,开启有一定的风险。
建议服务器的快照创建实例测试先,可以多开几个ssh远程连接,这样一般问题也不大。
yum -y install xinetd
yum -y install telnet-server
yum -y install vsftpd
flags = REUSE
socket_type = stream
wait = no
user = root
server = /usr/sbin/in.telnetd
log_on_failure += USERID
#disable = yes
disable = no
service xinetd restart
service vsftpd restart
systemctl start telnet.socket && systemctl enable telnet.socket
firewall-cmd --zone=public --add-port=23/tcp --permanent
# 添加用户并设置密码(centos7为用户名,密码ruijie123,>可修改)
useradd centos7
echo ruijie123 | passwd --stdin centos7
# 增加centos7账号的sudo权限
# 在配置文件 /etc/sudoers 中添加配置,但该文件默认是没>有写权限的,因此需要先增加写权限
chmod u+w /etc/sudoers
vi /etc/sudoers
centos7 ALL=(ALL) ALL
telnet ip地址 23
进行脚本文件,脚本文件在4,其他三个压缩包自己下载就好了,也可也不下载,脚本会自动下载。
sh upopenssh.sh
升级失败就备份好配置,直接使用yum重装自带的ssh,确认好配置。
chkconfig --list sshd
# sshd 0:关闭 1:关闭 2:启用 3:启用 4:启用 5:启用 6:关闭
service xinetd stop && service vsftpd stop
systemctl stop telnet.socket && systemctl disable telnet.socket
firewall-cmd --remove-port=23/tcp --permanent
##### 3.2 卸载telnet
rpm -e telnet-server
# 删除用户
userdel -r centos7
# 编辑sudo配置文件,去除对应配置段
vi /etc/sudoers
# 恢复sudo配置文件的权限
chmod u-w /etc/sudoers
注意这里的openssl不能用3.0的,3.0需要的依赖是不一样的,会报错;1.x的版本应该都是可以的。
都有做备份处理,升级编译过程失败会还原,不过这个还原效果只是手动测试过,没有实际验证,我都成功了。
ssh配置是保留的,有些地方还需要你们自行修改。
脚本来源Linux OpenSSH-9.0p1最新版升级步骤详细(附脚本)
我自己做了修改,主要就是保留配置和多加一些失败操作的处理。
#!/bin/bash
#
#########################################################
# Function :openssh-9.1p1 and openssl 1.1.1s update #
# Platform :Centos7.X #
# Version :1.0 #
# Date :2022-12-12 #
#########################################################
echo ------------------------------------------
echo openssh-9.1p1 and openssl 1.1.1s update
echo ------------------------------------------
sleep 2
clear
export LANG="en_US.UTF-8"
#版本号(目前最新)
zlib_version="zlib-1.2.13"
openssl_version="openssl-1.1.1s"
openssh_version="openssh-9.1p1"
#安装包地址
file="/opt"
#默认编译路径
default="/usr/local"
date_time=`date +%Y-%m-%d—%H:%M`
#安装目录
file_install="$file/openssh_install"
file_backup="$file/openssh_backup"
file_log="$file/openssh_log"
#源码包链接
zlib_download="https://www.zlib.net/$zlib_version.tar.gz"
openssl_download="https://www.openssl.org/source/$openssl_version.tar.gz"
openssh_download="https://mirrors.aliyun.com/openssh/portable/$openssh_version.tar.gz"
Install_make() {
echo 安装进程开始
sleep 1s
clear
Check if user is root
if [ $(id -u) != "0" ];then
echo -e "\033[33m--------------------------------------------------------------- \033[0m"
echo -e " 当前用户为普通用户,必须使用root用户运行,脚本退出中......" "\033[31m Error\033[0m"
echo -e "\033[33m--------------------------------------------------------------- \033[0m"
echo ""
sleep 3
exit
fi
# Check telnet server is enable
# systemctl restart telnet.socket && systemctl restart xinetd
# ps -ef |grep xinetd | egrep -v grep > /dev/null
# if [ $? -eq 0 ];then
# echo 检测到telnet服务已启动……
# systemctl enable telnet.socket
# systemctl enable xinetd
# echo $(date +%F-%T) 检测到telnet服务并启动…… >> update.log
# sleep 2
# else
# echo -e " 请务必启动telnet服务后运行脚本(防止更新失败),脚本退出中......" "\033[31m Error\033[0m"
# sleep 3
# exit
# fi
#判断是否安装wget
echo -e "\033[33m 正在安装Wget...... \033[0m"
sleep 2
echo ""
if ! type wget >/dev/null 2>&1;then
yum install -y wget
else
echo -e "\033[33m--------------------------------------------------------------- \033[0m"
echo -e " wget已经安装了:" "\033[32m Please continue\033[0m"
echo -e "\033[33m--------------------------------------------------------------- \033[0m"
echo ""
fi
#判断是否安装tar
echo -e "\033[33m 正在安装TAR...... \033[0m"
sleep 2
echo ""
if ! type tar >/dev/null 2>&1;then
yum install -y tar
else
echo ""
echo -e "\033[33m--------------------------------------------------------------- \033[0m"
echo -e " tar已经安装了:" "\033[32m Please continue\033[0m"
echo -e "\033[33m--------------------------------------------------------------- \033[0m"
echo ""
fi
#安装相关依赖包
echo -e "\033[33m 正在安装依赖包...... \033[0m"
sleep 3
echo ""
yum -y install gcc gcc-c++ glibc make autoconf openssl openssl-devel pcre-devel pam-devel zlib-devel tcp_wrappers-devel tcp_wrappers
if [ $? -eq 0 ];then
echo ""
echo -e "\033[33m--------------------------------------------------------------- \033[0m"
echo -e " 安装软件依赖包成功 " "\033[32m Success\033[0m"
echo -e "\033[33m--------------------------------------------------------------- \033[0m"
else
echo -e "\033[33m--------------------------------------------------------------- \033[0m"
echo -e " 解压源码包失败,脚本退出中......" "\033[31m Error\033[0m"
echo -e "\033[33m--------------------------------------------------------------- \033[0m"
echo ""
sleep 4
exit
fi
}
Install_backup() {
#创建文件(可修改)
mkdir -p $file_install
mkdir -p $file_backup
mkdir -p $file_log
mkdir -p $file_backup/zlib
mkdir -p $file_backup/ssl
mkdir -p $file_backup/ssh
mkdir -p $file_log/zlib
mkdir -p $file_log/ssl
mkdir -p $file_log/ssh
#备份文件(可修改)
cp -rf /usr/bin/openssl $file_backup/ssl/openssl_$date_time.bak > /dev/null
cp -rf /usr/include/openssl /usr/include/openssl.bak //这个有些场景不存在
cp -rf /etc/ssh $file_backup/ssh/ssh_$date_time.bak > /dev/null
cp -rf /etc/pam.d/sshd.pam $file_backup/ssh/sshd_$date_time.pam.bak > /dev/null
cp -rf /etc/init.d/sshd $file_backup/ssh/sshd_$date_time.bak > /dev/null
cp -rf /usr/lib/systemd/system/sshd.service $file_backup/ssh/sshd_$date_time.service.bak > /dev/null
}
Install_tar() {
#下载的源码包,检查是否解压(可修改)
# if [ -e $file/$zlib_version.tar.gz ] && [ -e $file/$openssl_version.tar.gz ] && [ -e /$file/$openssh_version.tar.gz ];then
# echo -e " 下载软件源码包已存在 " "\033[32m Please continue\033[0m"
# else
# echo -e "\033[33m 未发现本地源码包,链接检查获取中........... \033[0m "
# echo ""
# cd $file
# wget --no-check-certificate $zlib_download
# wget --no-check-certificate $openssl_download
# wget --no-check-certificate $openssh_download
# echo ""
# fi
#zlib
echo -e "\033[33m 正在下载Zlib软件包...... \033[0m"
sleep 3
echo ""
if [ -e $file/$zlib_version.tar.gz ];then
echo -e " Zlib软件包已存在 " "\033[32m Please continue\033[0m"
else
echo -e "\033[33m 未发现zlib本地源码包,链接检查获取中........... \033[0m "
sleep 1
echo ""
cd $file
wget --no-check-certificate $zlib_download
echo ""
fi
#openssl
echo -e "\033[33m 正在下载Openssl软件包...... \033[0m"
sleep 3
echo ""
if [ -e $file/$openssl_version.tar.gz ];then
echo -e " Openssl软件包已存在 " "\033[32m Please continue\033[0m"
else
echo -e "\033[33m 未发现openssl本地源码包,链接检查获取中........... \033[0m "
echo ""
sleep 1
cd $file
wget --no-check-certificate $openssl_download
echo ""
fi
#openssh
echo -e "\033[33m 正在下载Openssh软件包...... \033[0m"
sleep 3
echo ""
if [ -e /$file/$openssh_version.tar.gz ];then
echo -e " Openssh软件包已存在 " "\033[32m Please continue\033[0m"
else
echo -e "\033[33m 未发现openssh本地源码包,链接检查获取中........... \033[0m "
echo ""
sleep 1
cd $file
wget --no-check-certificate $openssh_download
fi
}
echo ""
#安装zlib
Install_zlib() {
echo -e "\033[33m 1.1-正在解压Zlib软件包...... \033[0m"
sleep 3
echo ""
cd $file && mkdir -p $file_install && tar -xzf zlib*.tar.gz -C $file_install > /dev/null
if [ -d $file_install/$zilb_version ];then
echo -e "\033[33m--------------------------------------------------------------- \033[0m"
echo -e " zilb解压源码包成功" "\033[32m Success\033[0m"
echo -e "\033[33m--------------------------------------------------------------- \033[0m"
echo ""
else
echo -e "\033[33m--------------------------------------------------------------- \033[0m"
echo -e " zilb解压源码包失败,脚本退出中......" "\033[31m Error\033[0m"
echo -e "\033[33m--------------------------------------------------------------- \033[0m"
echo ""
sleep 4
exit
fi
echo -e "\033[33m 1.2-正在编译安装Zlib服务.............. \033[0m"
sleep 3
echo ""
cd $file_install/zlib*
./configure --prefix=$default/$zlib_version > $file_log/zlib/zlib_configure_$date_time.txt #> /dev/null 2>&1
if [ $? -eq 0 ];then
echo -e "\033[33m make... \033[0m"
make > /dev/null 2>&1
echo $?
echo -e "\033[33m make test... \033[0m"
make test > /dev/null 2>&1
echo $?
echo -e "\033[33m make install... \033[0m"
make install > /dev/null 2>&1
echo $?
else
echo -e "\033[33m--------------------------------------------------------------- \033[0m"
echo -e " 编译安装压缩库失败,脚本退出中..." "\033[31m Error\033[0m"
echo -e "\033[33m--------------------------------------------------------------- \033[0m"
echo ""
sleep 4
exit
fi
if [ -e $default/$zlib_version/lib/libz.so ];then
sed -i '/zlib/'d /etc/ld.so.conf
echo "$default/$zlib_version/lib" >> /etc/ld.so.conf
echo "$default/$zlib_version/lib" >> /etc/ld.so.conf.d/zlib.conf
ldconfig -v > $file_log/zlib/zlib_ldconfig_$date_tim
/sbin/ldconfig
fi
}
echo ""
Install_openssl() {
echo -e "\033[33m 2.1-正在解压Openssl...... \033[0m"
sleep 3
echo ""
cd $file && tar -xvzf openssl*.tar.gz -C $file_install > /dev/null
if [ -d $file_install/$openssl_version ];then
echo -e "\033[33m--------------------------------------------------------------- \033[0m"
echo -e " OpenSSL解压源码包成功" "\033[32m Success\033[0m"
echo -e "\033[33m--------------------------------------------------------------- \033[0m"
else
echo -e "\033[33m--------------------------------------------------------------- \033[0m"
echo -e " OpenSSL解压源码包失败,脚本退出中......" "\033[31m Error\033[0m"
echo -e "\033[33m--------------------------------------------------------------- \033[0m"
echo ""
sleep 4
exit
fi
echo ""
echo -e "\033[33m 2.2-正在编译安装Openssl服务...... \033[0m"
sleep 3
echo ""
cd $file_install/$openssl_version
./config shared zlib --prefix=$default/$openssl_version > $file_log/ssl/ssl_config_$date_time.txt #> /dev/null 2>&1
if [ $? -eq 0 ];then
echo -e "\033[33m make clean... \033[0m"
make clean > /dev/null 2>&1
echo $?
echo -e "\033[33m make install... \033[0m"
make install > /dev/null 2>&1
echo $?
else
echo -e "\033[33m--------------------------------------------------------------- \033[0m"
echo -e " 编译安装OpenSSL失败,脚本退出中..." "\033[31m Error\033[0m"
echo -e "\033[33m--------------------------------------------------------------- \033[0m"
echo ""
sleep 4
exit
fi
mv /usr/bin/openssl /usr/bin/openssl_$date_time.bak #先备份
mv /usr/include/openssl /usr/include/openssl_$date_time.bak #有些不存在
if [ -e $default/$openssl_version/bin/openssl ];then
sed -i '/openssl/'d /etc/ld.so.conf
echo "$default/$openssl_version/lib" >> /etc/ld.so.conf
ln -s $default/$openssl_version/bin/openssl /usr/bin/openssl
ln -s $default/$openssl_version/lib/libssl.so.1.1 /usr/lib64/libssl.so.1.1
ln -s $default/$openssl_version/lib/libcrypto.so.1.1 /usr/lib64/libcrypto.so.1.1
ldconfig -v > $file_log/ssl/ssl_ldconfig_$date_time.txt > /dev/null 2>&1
/sbin/ldconfig
echo -e "\033[33m--------------------------------------------------------------- \033[0m"
echo -e " 编译安装OpenSSL " "\033[32m Success\033[0m"
echo -e "\033[33m--------------------------------------------------------------- \033[0m"
echo ""
echo -e "\033[33m 2.3-正在输出 OpenSSL 版本状态.............. \033[0m"
sleep 3
echo ""
echo -e "\033[32m====================== OpenSSL veriosn ===================== \033[0m"
echo ""
openssl version -a
echo ""
echo -e "\033[32m======================================================= \033[0m"
sleep 2
else
echo ""
echo -e "\033[33m 2.3.1-正在还原OpenSSL中...... \033[0m"
rm -rf /usr/bin/openssl
mv /usr/bin/openssl_$date_time.bak /usr/bin/openssl
rm -rf /usr/include/openssl
mv /usr/include/openssl_$date_time.bak /usr/include/openssl
echo -e "\033[33m--------------------------------------------------------------- \033[0m"
echo -e " 还原成功 " "\033[32m Success\033[0m"
echo -e "\033[33m--------------------------------------------------------------- \033[0m"
echo ""
echo -e "\033[32m====================== OpenSSL veriosn ===================== \033[0m"
openssl version
echo ""
sleep 3
echo -e "\033[33m--------------------------------------------------------------- \033[0m"
echo -e " OpenSSL软连接失败,脚本退出中..." "\033[31m Error\033[0m"
echo -e "\033[33m--------------------------------------------------------------- \033[0m"
echo ""
sleep 4
exit
fi
}
echo ""
Install_openssh() {
echo -e "\033[33m 3.1-正在解压OpenSSH...... \033[0m"
sleep 3
echo ""
cd $file && tar -xvzf openssh*.tar.gz -C $file_install > /dev/null
if [ -d $file_install/$openssh_version ];then
echo -e "\033[33m--------------------------------------------------------------- \033[0m"
echo -e " OpenSSh解压源码包成功" "\033[32m Success\033[0m"
echo -e "\033[33m--------------------------------------------------------------- \033[0m"
else
echo -e "\033[33m--------------------------------------------------------------- \033[0m"
echo -e " OpenSSh解压源码包失败,脚本退出中......" "\033[31m Error\033[0m"
echo -e "\033[33m--------------------------------------------------------------- \033[0m"
echo ""
sleep 4
exit
fi
cp -rf /etc/ssh /etc/ssh_$date_time.bak #cp安装时,不会覆盖原配置
echo ""
echo -e "\033[33m 3.2-正在卸载OpenSSH服务...... \033[0m"
sleep 3
echo ""
rpm -e --nodeps `rpm -qa | grep openssh`> /dev/null 2>&1
if [ $? -eq 0 ];then
echo -e "\033[33m--------------------------------------------------------------- \033[0m"
echo -e " 卸载OpenSSH服务成功" "\033[32m Success\033[0m"
echo -e "\033[33m--------------------------------------------------------------- \033[0m"
echo ""
sleep 2
else
echo -e "\033[33m--------------------------------------------------------------- \033[0m"
echo -e " 卸载OpenSSH服务失败,脚本退出中......" "\033[31m Error\033[0m"
echo -e "\033[33m--------------------------------------------------------------- \033[0m"
echo ""
sleep 4
exit
fi
echo ""
echo -e "\033[33m 3.3-正在编译安装OpenSSH服务...... \033[0m"
sleep 3
echo ""
cd $file_install/$openssh_version
./configure --prefix=$default/$openssh_version --sysconfdir=/etc/ssh --with-ssl-dir=$default/$openssl_version --with-zlib=$default/$zlib_version > $file_log/ssh/ssh_configure_$date_time.txt #> /dev/null 2>&1
if [ $? -eq 0 ];then
echo -e "\033[33m make clean... \033[0m"
make clean > /dev/null 2>&1
echo $?
echo -e "\033[33m make install... \033[0m"
make install > /dev/null 2>&1
echo $?
else
echo ""
echo -e "\033[33m 3.3.1-正在重装OpenSSH中...... \033[0m"
yum -y install openssh openssh-clients openssh-server
# 还原配置
rm -rf /etc/ssh
mv /etc/ssh_$date_time.bak /etc/ssh
# 修改密钥权限
chmod 600 /etc/ssh/ssh_host_rsa_key
chmod 600 /etc/ssh/ssh_host_dsa_key
chmod 600 /etc/ssh/ssh_host_ecdsa_key
chmod 600 /etc/ssh/ssh_host_ed25519_key
# 启动
systemctl start sshd
echo ""
echo -e "\033[33m 输出sshd服务状态: \033[33m"
systemctl status sshd.service
echo ""
echo -e " 重装openssh版本信息: "
echo ""
ssh -V
sleep 1
echo ""
echo -e "\033[33m--------------------------------------------------------------- \033[0m"
echo -e " 重装成功,请确认配置后再重启ssh! " "\033[32m Success\033[0m"
echo -e "\033[33m--------------------------------------------------------------- \033[0m"
echo ""
sleep 3
echo -e "\033[33m--------------------------------------------------------------- \033[0m"
echo -e " 编译安装OpenSSH失败,脚本退出中......" "\033[31m Error\033[0m"
echo -e "\033[33m--------------------------------------------------------------- \033[0m"
echo ""
sleep 4
exit
fi
echo ""
echo -e "\033[33m--------------------------------------------------------------- \033[0m"
echo -e " 编译安装OpenSSH " "\033[32m Success\033[0m"
echo -e "\033[33m--------------------------------------------------------------- \033[0m"
echo ""
sleep 2
echo -e "\033[32m==================== OpenSSH—file veriosn =================== \033[0m"
echo ""
/usr/local/$openssh_version/bin/ssh -V
echo ""
echo -e "\033[32m======================================================= \033[0m"
sleep 3
echo ""
echo -e "\033[33m 3.4-正在迁移OpenSSH配置文件...... \033[0m"
sleep 3
echo ""
# 还原配置
rm -rf /etc/ssh
mv /etc/ssh_$date_time.bak /etc/ssh
#迁移sshd
if [ -f "/etc/init.d/sshd" ];then
mv /etc/init.d/sshd /etc/init.d/sshd_$date_time.bak
else
echo -e " /etc/init.d/sshd不存在 " "\033[31m Not backed up(可忽略)\033[0m"
fi
cp -rf $file_install/$openssh_version/contrib/redhat/sshd.init /etc/init.d/sshd;
chmod u+x /etc/init.d/sshd;
chkconfig --add sshd #自启动
chkconfig --list |grep sshd;
chkconfig sshd on
#备份启动脚本,不一定有
if [ -f "/usr/lib/systemd/system/sshd.service" ];then
mv /usr/lib/systemd/system/sshd.service /usr/lib/systemd/system/sshd.service_bak
else
echo -e " sshd.service不存在" "\033[31m Not backed up(可忽略)\033[0m"
fi
#备份复制sshd.pam文件
if [ -f "/etc/pam.d/sshd.pam" ];then
mv /etc/pam.d/sshd.pam /etc/pam.d/sshd.pam_$date_time.bak
else
echo -e " sshd.pam不存在" "\033[31m Not backed up(可忽略)\033[0m"
fi
cp -rf $file_install/$openssh_version/contrib/redhat/sshd.pam /etc/pam.d/sshd.pam
#还原配置ssh_config
# cp -rf $file_install/$openssh_version/sshd_config /etc/ssh/sshd_config
sed -i 's/Subsystem/#Subsystem/g' /etc/ssh/sshd_config
echo "Subsystem sftp $default/$openssh_version/libexec/sftp-server" >> /etc/ssh/sshd_config
# sed -i 's/#PasswordAuthentication\ yes/PasswordAuthentication\ yes/g' /etc/ssh/sshd_config
cp -rf $default/$openssh_version/sbin/sshd /usr/sbin/sshd
cp -rf /$default/$openssh_version/bin/ssh /usr/bin/ssh
cp -rf $default/$openssh_version/bin/ssh-keygen /usr/bin/ssh-keygen
#grep -v "[[:space:]]*#" /etc/ssh/sshd_config |grep "PubkeyAuthentication yes"
# echo 'PermitRootLogin no' >> /etc/ssh/sshd_config
# 修改秘钥的权限
chmod 600 /etc/ssh/ssh_host_rsa_key
chmod 600 /etc/ssh/ssh_host_dsa_key
chmod 600 /etc/ssh/ssh_host_ecdsa_key
chmod 600 /etc/ssh/ssh_host_ed25519_key
#重启sshd
service sshd start > /dev/null 2>&1
if [ $? -eq 0 ];then
echo -e "\033[33m--------------------------------------------------------------- \033[0m"
echo -e " 启动OpenSSH服务成功" "\033[32m Success\033[0m"
echo -e "\033[33m--------------------------------------------------------------- \033[0m"
echo ""
sleep 2
#删除源码包(可修改)
# rm -rf $file/*$zlib_version.tar.gz
# rm -rf $file/*$openssl_version.tar.gz
# rm -rf $file/*$openssh_version.tar.gz
#rm -rf $file_install
echo -e "\033[33m 3.5-正在输出 OpenSSH 版本...... \033[0m"
sleep 3
echo ""
echo -e "\033[32m==================== OpenSSH veriosn =================== \033[0m"
echo ""
ssh -V
echo ""
echo -e "\033[32m======================================================== \033[0m"
else
echo -e "\033[33m--------------------------------------------------------------- \033[0m"
echo -e " 启动OpenSSH服务失败,脚本退出中......" "\033[31m Error\033[0m"
echo -e "\033[33m--------------------------------------------------------------- \033[0m"
sleep 4
exit
fi
echo ""
}
End_install() {
##sshd状态
echo ""
echo -e "\033[33m 输出sshd服务状态: \033[33m"
sleep 2
echo ""
systemctl status sshd.service
echo ""
echo ""
echo ""
sleep 1
echo -e "\033[33m==================== OpenSSH file =================== \033[0m"
echo ""
echo -e " 当前openssh版本信息: "
echo ""
ssh -V
echo ""
echo -e " 当前openssl版本信息: "
echo ""
openssl version
echo ""
echo -e " Openssh升级备份目录: "
cd $file_backup && pwd
cd ~
echo ""
echo -e " 升级日志目录请前往: "
cd $file_log && pwd
cd ~
echo ""
echo -e "\033[33m======================================================= \033[0m"
}
Install_make
Install_backup
Install_tar
Install_zlib
Install_openssl
Install_openssh
End_install