1.下载openssh8.6p1升级包
下载积分都调整为0了！！
centos6/7/8/stream系列: https://download.csdn.net/download/ChongDanYiQieHuiYi/17463848
centos7 用这个修复版本: https://download.csdn.net/download/ChongDanYiQieHuiYi/18630330
├── Centos6
│ ├── ROOT用户登录版本
│ │ ├── openssh-8.6p1-1.el6.x86_64.rpm
│ │ ├── openssh-askpass-8.6p1-1.el6.x86_64.rpm
│ │ ├── openssh-clients-8.6p1-1.el6.x86_64.rpm
│ │ ├── openssh-server-8.6p1-1.el6.x86_64.rpm
│ │ ├── openssl-1.0.1e-57.el6.x86_64.rpm
│ │ ├── openssl-devel-1.0.1e-57.el6.x86_64.rpm
│ │ └── readme.txt
│ └── 禁止ROOT用户登录版本
│ ├── openssh-8.6p1-1.el6.x86_64.rpm
│ ├── openssh-askpass-8.6p1-1.el6.x86_64.rpm
│ ├── openssh-clients-8.6p1-1.el6.x86_64.rpm
│ ├── openssh-server-8.6p1-1.el6.x86_64.rpm
│ ├── openssl-1.0.1e-57.el6.x86_64.rpm
│ ├── openssl-devel-1.0.1e-57.el6.x86_64.rpm
│ └── readme.txt
├── Centos7
│ ├── ROOT用户登录版本
│ │ ├── openssh-8.6p1-1.el7.x86_64.rpm
│ │ ├── openssh-askpass-8.6p1-1.el7.x86_64.rpm
│ │ ├── openssh-askpass-gnome-8.6p1-1.el7.x86_64.rpm
│ │ ├── openssh-clients-8.6p1-1.el7.x86_64.rpm
│ │ ├── openssh-debuginfo-8.6p1-1.el7.x86_64.rpm
│ │ ├── openssh-server-8.6p1-1.el7.x86_64.rpm
│ │ ├── openssl-1.0.2k-19.el7.x86_64.rpm
│ │ ├── openssl-devel-1.0.2k-19.el7.x86_64.rpm
│ │ ├── openssl-libs-1.0.2k-19.el7.x86_64.rpm
│ │ └── readme.txt
│ └── 禁止ROOT用户登录版本
│ ├── openssh-8.6p1-1.el7.x86_64.rpm
│ ├── openssh-askpass-8.6p1-1.el7.x86_64.rpm
│ ├── openssh-askpass-gnome-8.6p1-1.el7.x86_64.rpm
│ ├── openssh-clients-8.6p1-1.el7.x86_64.rpm
│ ├── openssh-debuginfo-8.6p1-1.el7.x86_64.rpm
│ ├── openssh-server-8.6p1-1.el7.x86_64.rpm
│ ├── openssl-1.0.2k-19.el7.x86_64.rpm
│ ├── openssl-devel-1.0.2k-19.el7.x86_64.rpm
│ ├── openssl-libs-1.0.2k-19.el7.x86_64.rpm
│ └── readme.txt
└── Centos8
├── ROOT用户登录版本
│ ├── openssh-8.6p1-1.el8.x86_64.rpm
│ ├── openssh-askpass-8.6p1-1.el8.x86_64.rpm
│ ├── openssh-askpass-debuginfo-8.6p1-1.el8.x86_64.rpm
│ ├── openssh-askpass-gnome-8.6p1-1.el8.x86_64.rpm
│ ├── openssh-askpass-gnome-debuginfo-8.6p1-1.el8.x86_64.rpm
│ ├── openssh-clients-8.6p1-1.el8.x86_64.rpm
│ ├── openssh-clients-debuginfo-8.6p1-1.el8.x86_64.rpm
│ ├── openssh-debuginfo-8.6p1-1.el8.x86_64.rpm
│ ├── openssh-debugsource-8.6p1-1.el8.x86_64.rpm
│ ├── openssh-server-8.6p1-1.el8.x86_64.rpm
│ ├── openssh-server-debuginfo-8.6p1-1.el8.x86_64.rpm
│ ├── openssl-1.1.1g-12.el8_3.x86_64.rpm
│ ├── openssl-devel-1.1.1g-12.el8_3.x86_64.rpm
│ ├── openssl-ibmpkcs11-1.0.2-1.el8.x86_64.rpm
│ ├── openssl-libs-1.1.1g-12.el8_3.x86_64.rpm
│ ├── openssl-perl-1.1.1g-12.el8_3.x86_64.rpm
│ ├── openssl-pkcs11-0.4.10-2.el8.x86_64.rpm
│ └── readme.txt
└── 禁止ROOT用户登录版本
├── openssh-8.6p1-1.el8.x86_64.rpm
├── openssh-askpass-8.6p1-1.el8.x86_64.rpm
├── openssh-askpass-debuginfo-8.6p1-1.el8.x86_64.rpm
├── openssh-askpass-gnome-8.6p1-1.el8.x86_64.rpm
├── openssh-askpass-gnome-debuginfo-8.6p1-1.el8.x86_64.rpm
├── openssh-clients-8.6p1-1.el8.x86_64.rpm
├── openssh-clients-debuginfo-8.6p1-1.el8.x86_64.rpm
├── openssh-debuginfo-8.6p1-1.el8.x86_64.rpm
├── openssh-debugsource-8.6p1-1.el8.x86_64.rpm
├── openssh-server-8.6p1-1.el8.x86_64.rpm
├── openssh-server-debuginfo-8.6p1-1.el8.x86_64.rpm
├── openssl-1.1.1g-12.el8_3.x86_64.rpm
├── openssl-devel-1.1.1g-12.el8_3.x86_64.rpm
├── openssl-ibmpkcs11-1.0.2-1.el8.x86_64.rpm
├── openssl-libs-1.1.1g-12.el8_3.x86_64.rpm
├── openssl-perl-1.1.1g-12.el8_3.x86_64.rpm
├── openssl-pkcs11-0.4.10-2.el8.x86_64.rpm
└── readme.txt
9 directories, 70 files
注意事项:
1.目前测试redhat6/7/8/stream版本没有异常，有问题及时发给我修复bug
2.建议先备份/etc/ssh/sshd_config
3.每个centos6/7/8/stream系列分为(root用户登录版)及(禁止root用户登录版)
a.root用户登录版: 可以直接使用登录工具直接用root用户登录
b.禁止root用户登录版: 前提需要有一个普通用户并且设置密码，使用终端工具使用普通登录登录之后利用su - root进行切换登录root！！
2.升级步骤
升级openssl
- centos6.5以下升级openssl至最新版本
- centos6.5-6.10/7/8/stream 以上建议升级至最新版本
# centos6
[root@localhost ****]# rpm -Uvh openssl-1.0.1e-57.el6.x86_64.rpm openssl-devel-1.0.1e-57.el6.x86_64.rpm
warning: openssl-1.0.1e-57.el6.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID fd431d51: NOKEY
Preparing... ########################################### [100%]
1:openssl ########################################### [ 50%]
2:openssl-devel ########################################### [100%]
# centos7
[root@localhost ~]# rpm -Uvh openssl-1.0.2k-19.el7.x86_64.rpm openssl-libs-1.0.2k-19.el7.x86_64.rpm openssl-devel-1.0.2k-19.el7.x86_64.rpm
warning: openssl-1.0.2k-19.el7.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID f4a80eb5: NOKEY
Preparing... ################################# [100%]
Updating / installing...
1:openssl-libs-1:1.0.2k-19.el7 ################################# [ 17%]
2:openssl-1:1.0.2k-19.el7 ################################# [ 33%]
3:openssl-devel-1:1.0.2k-19.el7 ################################# [ 50%]
Cleaning up / removing...
4:openssl-devel-1:1.0.1e-42.el7_1.9################################# [ 67%]
5:openssl-1:1.0.1e-42.el7_1.9 ################################# [ 83%]
6:openssl-libs-1:1.0.1e-42.el7_1.9 ################################# [100%]
# centos8
[root@localhost ****]# rpm -Uvh openssl-1.1.1g-12.el8_3.x86_64.rpm openssl-devel-1.1.1g-12.el8_3.x86_64.rpm openssl-libs-1.1.1g-12.el8_3.x86_64.rpm
Verifying... ################################# [100%]
Preparing... ################################# [100%]
Updating / installing...
1:openssl-libs-1:1.1.1g-12.el8_3 ################################# [ 17%]
2:openssl-1:1.1.1g-12.el8_3 ################################# [ 33%]
3:openssl-devel-1:1.1.1g-12.el8_3 ################################# [ 50%]
Cleaning up / removing...
4:openssl-1:1.1.1-8.el8 ################################# [ 67%]
5:openssl-devel-1:1.1.1-8.el8 ################################# [ 83%]
6:openssl-libs-1:1.1.1-8.el8 ################################# [100%]
# centos stream
[root@localhost ****]# rpm -Uvh openssl-1.1.1g-12.el8_3.x86_64.rpm openssl-devel-1.1.1g-12.el8_3.x86_64.rpm openssl-libs-1.1.1g-12.el8_3.x86_64.rpm
Verifying... ################################# [100%]
Preparing... ################################# [100%]
Updating / installing...
1:openssl-libs-1:1.1.1g-12.el8_3 ################################# [ 17%]
2:openssl-1:1.1.1g-12.el8_3 ################################# [ 33%]
3:openssl-devel-1:1.1.1g-12.el8_3 ################################# [ 50%]
Cleaning up / removing...
4:openssl-1:1.1.1-8.el8 ################################# [ 67%]
5:openssl-devel-1:1.1.1-8.el8 ################################# [ 83%]
6:openssl-libs-1:1.1.1-8.el8 ################################# [100%]
升级openssh
# centos6
[root@loaclhost Desktop]# ls
openssh-8.6p1-1.el6.x86_64.rpm openssh-clients-8.6p1-1.el6.x86_64.rpm
openssh-askpass-8.6p1-1.el6.x86_64.rpm openssh-server-8.6p1-1.el6.x86_64.rpm
[root@loaclhost Desktop]# rpm -Uvh openssh-8.6p1-1.el6.x86_64.rpm openssh-clients-8.6p1-1.el6.x86_64.rpm openssh-server-8.6p1-1.el6.x86_64.rpm openssh-askpass-8.6p1-1.el6.x86_64.rpm
Preparing... ########################################### [100%]
1:openssh ########################################### [ 25%]
2:openssh-clients ########################################### [ 50%]
3:openssh-server ########################################### [ 75%]
/var/tmp/rpm-tmp.rchI3M: line 18: /usr/bin/chmod: No such file or directory
4:openssh-askpass ########################################### [100%]
[root@loaclhost Desktop]#
[root@loaclhost Desktop]# sshd -V
unknown option -- V
OpenSSH_8.6p1, OpenSSL 1.0.1e-fips 11 Feb 2013
usage: sshd [-46DdeiqTt] [-C connection_spec] [-c host_cert_file]
[-E log_file] [-f config_file] [-g login_grace_time]
[-h host_key_file] [-o option] [-p port] [-u len]
# centos7
[root@localhost ~]# rpm -Uvh openssh-8.6p1-1.el7.x86_64.rpm openssh-clients-8.6p1-1.el7.x86_64.rpm openssh-server-8.6p1-1.el7.x86_64.rpm
Preparing... ################################# [100%]
Updating / installing...
1:openssh-8.6p1-1.el7 ################################# [ 17%]
2:openssh-clients-8.6p1-1.el7 ################################# [ 33%]
3:openssh-server-8.6p1-1.el7 ################################# [ 50%]
Cleaning up / removing...
4:openssh-server-7.4p1-21.el7 ################################# [ 67%]
5:openssh-clients-7.4p1-21.el7 ################################# [ 83%]
6:openssh-7.4p1-21.el7 ################################# [100%]
# centos8
[root@localhost noroot]# rpm -Uvh openssh-8.6p1-1.el8.x86_64.rpm openssh-clients-8.6p1-1.el8.x86_64.rpm openssh-server-8.6p1-1.el8.x86_64.rpm openssh-askpass-8.6p1-1.el8.x86_64.rpm
Verifying... ################################# [100%]
Preparing... ################################# [100%]
Updating / installing...
1:openssh-8.6p1-1.el8 ################################# [ 14%]
2:openssh-clients-8.6p1-1.el8 ################################# [ 29%]
3:openssh-server-8.6p1-1.el8 ################################# [ 43%]
4:openssh-askpass-8.6p1-1.el8 ################################# [ 57%]
Cleaning up / removing...
5:openssh-server-7.8p1-4.el8 ################################# [ 71%]
6:openssh-clients-7.8p1-4.el8 ################################# [ 86%]
7:openssh-7.8p1-4.el8 ################################# [100%]
# centos stream
[root@localhost noroot]# rpm -Uvh openssh-8.6p1-1.el8.x86_64.rpm openssh-clients-8.6p1-1.el8.x86_64.rpm openssh-server-8.6p1-1.el8.x86_64.rpm openssh-askpass-8.6p1-1.el8.x86_64.rpm
Verifying... ################################# [100%]
Preparing... ################################# [100%]
Updating / installing...
1:openssh-8.6p1-1.el8 ################################# [ 14%]
2:openssh-clients-8.6p1-1.el8 ################################# [ 29%]
3:openssh-server-8.6p1-1.el8 ################################# [ 43%]
4:openssh-askpass-8.6p1-1.el8 ################################# [ 57%]
Cleaning up / removing...
5:openssh-server-7.8p1-4.el8 ################################# [ 71%]
6:openssh-clients-7.8p1-4.el8 ################################# [ 86%]
7:openssh-7.8p1-4.el8 ################################# [100%]
验证版本
[root@localhost noroot]# sshd -v
unknown option -- v
OpenSSH_8.6p1, OpenSSL 1.1.1 FIPS 11 Sep 2018
usage: sshd [-46DdeiqTt] [-C connection_spec] [-c host_cert_file]
[-E log_file] [-f config_file] [-g login_grace_time]
[-h host_key_file] [-o option] [-p port] [-u len]
3.异常处理
# CRT和跳板机,由于sshd升级弱算法将不采用
Key exchange failed.
No compatible key exchange method. The server supports these methods: curve25519-sha256,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256
No compatible hostkey. The server supports these methods: ssh-ed25519
一般不建议添加此项配置
cat >>/etc/ssh/sshd_config <<-EOF
KexAlgorithms diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256
EOF
# centos7/8/stream
systemctl restart sshd
# centos6
service sshd restart
本文为转载
原文链接：https://blog.csdn.net/ChongDanYiQieHuiYi/article/details/116087613
卸载openssl后，升级安装后，执行某些命令时，可能会遇到一些错误
6.1 libcrypto.so.10错误#
错误提示：error while loading shared libraries: libcrypto.so.10: cannot open shared object file: No such file or directory
原因：软链接/usr/lib64/libcrypto.so.10不存在
解决方法：ln -s /usr/lib64/libcrypto.so.1.0.0 /usr/lib64/libcrypto.so.10，或者是 ln -s /usr/local/openssl/lib/libcrypto.so.1.0.0 /usr/lib64/libcrypto.so.10（根据openssl的实际安装路径来决定）
6.2 libssl.so.10错误#
错误提示：libssl.so.10: cannot open shared object file: No such file or directory
原因：软链接/usr/lib64/libssl.so.10不存在
解决方法：ln -s /usr/lib64/libssl.so.1.0.0 /usr/lib64/libssl.so.10，或者是ln -s /usr/local/openssl/lib/libssl.so.1.0.0 /usr/lib64/libssl.so.10（根据openssl的实际安装路径来决定）
6.3 OpenSSL version mismatch错误#
错误提示：sshd：OpenSSL version mismatch. Built against 10000003, you have 100020cf（注意：由于安装的ssl版本不同，错误提示可能不同，表现在10000003、100020cf上）
原因：ssh和ssl版本不匹配
解决方法：卸载系统自带的openssh，安装和现有openssl版本匹配的openssh
可以借鉴 https://www.cnblogs.com/redcoder54/p/9557205.html