CentOS 7升级openssh9.6p1
一、环境情况
[root@localhost ~]# cat /etc/redhat-release
CentOS Linux release 7.9.2009 (Core)
[root@localhost ~]# ssh -V
OpenSSH_7.4p1, OpenSSL 1.0.2k-fips 26 Jan 2017
二、准备
1. 开启telnet
主要是在安装过程中，需要卸载老版本openssh，临时启用telnet，方便操作。其中还要临时关闭防火墙，放通telnet访问
[root@localhost ~]# yum install xinetd
[root@localhost ~]# yum install telnet-server
[root@localhost ~]# yum install telnet
[root@localhost ~]# systemctl enable xinetd
[root@localhost ~]# systemctl start xinetd
[root@localhost ~]# systemctl enable telnet.socket
[root@localhost ~]# systemctl start telnet.socket
[root@localhost ~]# systemctl stop firewalld
[root@localhost ~]# systemctl disable firewalld
2. 安装一些包
yum -y install zlib-devel
yum -y install perl-Test-Simple
yum -y install pam-devel三、安装openssl
从openssh9.3p2开始，要求LibreSSL >= 3.1.0或OpenSSL >= 1.1.1.，不再支持老版本的
libcrypto。因此新装openssl 1.1.1。在生产环境下，已部署程序多会已使用老版本的ssl,所以新装ssl不覆盖本机上的老版本openssl，避免已有程序出错。
[root@localhost ~]# pwd
/root
[root@localhost ~]# tar zxvf openssl-1.1.1w.tar.gz
[root@localhost ~]# cd openssl-1.1.1w
[root@localhost openssl-1.1.1w]# ./config shared zlib-dynamic --prefix=/usr/local/openssl-1.1.1w
Operating system: x86_64-whatever-linux2
Configuring OpenSSL version 1.1.1w (0x1010117fL) for linux-x86_64
Using os-specific seed configuration
Creating configdata.pm
Creating Makefile
**********************************************************************
*** ***
*** OpenSSL has been successfully configured ***
*** ***
*** If you encounter a problem while building, please open an ***
*** issue on GitHub ***
*** and include the output from the following command: ***
*** ***
*** perl configdata.pm --dump ***
*** ***
*** (If you are new to OpenSSL, you might want to consult the ***
*** 'Troubleshooting' section in the INSTALL file first) ***
*** ***
**********************************************************************
[root@localhost openssl-1.1.1w]# make
[root@localhost openssl-1.1.1w]# make test
All tests successful.
Files=159, Tests=2657, 239 wallclock secs ( 3.17 usr 0.34 sys + 170.97 cusr 59.68 csys = 234.16 CPU)
Result: PASS
[root@localhost openssl-1.1.1w]# make install
[root@localhost openssl-1.1.1w]# echo "/usr/local/openssl-1.1.1w/lib" >> /etc/ld.so.conf
[root@localhost openssl-1.1.1w]# /sbin/ldconfig -v
[root@localhost openssl-1.1.1w]# cd /usr/local/openssl*
[root@localhost openssl-1.1.1w]# pwd
/usr/local/openssl-1.1.1w
[root@localhost openssl-1.1.1w]# ./bin/openssl version -a
OpenSSL 1.1.1w 11 Sep 2023
built on: Sat Mar 9 02:05:16 2024 UTC
platform: linux-x86_64
options: bn(64,64) rc4(16x,int) des(int) idea(int) blowfish(ptr)
compiler: gcc -fPIC -pthread -m64 -Wa,--noexecstack -Wall -O3 -DOPENSSL_USE_NODELETE -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM -DZLIB -DZLIB_SHARED -DNDEBUG
OPENSSLDIR: "/usr/local/openssl-1.1.1w/ssl"
ENGINESDIR: "/usr/local/openssl-1.1.1w/lib/engines-1.1"
Seeding source: os-specific
[root@localhost openssl-1.1.1w]#
四、安装openssh
1. 通过telnet连接服务器。关闭sshd
[root@localhost ~]# systemctl stop sshd
[root@localhost ~]# systemctl disable sshd
Removed symlink /etc/systemd/system/multi-user.target.wants/sshd.service.2. 安装
[root@localhost ~]# tar zxvf openssh-9.6p1.tar.gz
[root@localhost ~]# cd openssh*
[root@localhost openssh-9.6p1]#./configure --prefix=/usr/local/openssh-9.6p1 --with-ssl-dir=/usr/local/openssl-1.1.1w/ --with-pam --with-zlib
[root@localhost openssh-9.6p1]#make && make install
[root@localhost openssh-9.6p1]# /usr/local/openssh-9.6p1/sbin/sshd -V
OpenSSH_9.6p1, OpenSSL 1.1.1w 11 Sep 20233.配置参数
编辑启动文件sshd9.service，然后拷贝到对应目录
[root@localhost ~]# vi sshd9.service
[Unit]
Description=OpenSSH 9.6p1 server daemon
Documentation=man:sshd(8) man:sshd_config(5)
After=network.target sshd-keygen.service
Wants=sshd-keygen.service
[Service]
Type=simple
EnvironmentFile=/etc/sysconfig/sshd
ExecStart=/usr/local/openssh-9.6p1/sbin/sshd -D $OPTIONS
ExecReload=/bin/kill -HUP $MAINPID
KillMode=process
Restart=on-failure
RestartSec=42s
[Install]
WantedBy=multi-user.target
[root@localhost ~]# cp sshd9.service /usr/lib/systemd/system/修改/usr/local/openssh-9.6p1/etc/sshd_config
Port 22
#HostKey /usr/local/openssh-9.6p1/etc/ssh_host_rsa_key
#HostKey /usr/local/openssh-9.6p1/etc/ssh_host_ecdsa_key
#HostKey /usr/local/openssh-9.6p1/etc/ssh_host_ed25519_key
改为
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key加固下key的权限
[root@localhost openssh-9.6p1]# chmod go-r /etc/ssh/ssh_host_ed25519_key
[root@localhost openssh-9.6p1]# chmod go-r /etc/ssh/ssh_host_ecdsa_key
[root@localhost openssh-9.6p1]# chmod go-r /etc/ssh/ssh_host_rsa_key4.启动服务
[root@localhost openssh-9.6p1]# systemctl enable sshd9
[root@localhost openssh-9.6p1]# systemctl start sshd9
[root@localhost openssh-9.6p1]# systemctl status sshd9
● sshd9.service - OpenSSH 9 server daemon
Loaded: loaded (/usr/lib/systemd/system/sshd9.service; enabled; vendor preset: disabled)
Active: active (running) since Sat 2024-03-09 00:19:44 PST; 2s ago
Docs: man:sshd(8)
man:sshd_config(5)
Main PID: 11944 (sshd)
Tasks: 1
CGroup: /system.slice/sshd9.service
└─11944 sshd: /usr/local/openssh-9.6p1/sbin/sshd -D [listener] 0 of 10-100 startups
Mar 09 00:19:44 localhost.localdomain systemd[1]: Started OpenSSH 9 server daemon.
Mar 09 00:19:44 localhost.localdomain sshd[11944]: Server listening on 0.0.0.0 port 22.
Mar 09 00:19:44 localhost.localdomain sshd[11944]: Server listening on :: port 22.
[root@localhost openssh-9.6p1]#这时，要在命令行使用ssh,得带上路径，否则还是老版本的。
[root@localhost ~]# ssh -V
OpenSSH_7.4p1, OpenSSL 1.0.2k-fips 26 Jan 2017
[root@localhost ~]# /usr/local/openssh*/bin/ssh -V
OpenSSH_9.6p1, OpenSSL 1.1.1w 11 Sep 2023
五、收尾
关闭telnet, 启动防火墙