redhat6.4升级openssh至6.7

1:简介
最近浙江电信对线上服务器进行漏洞扫描,暴露出原有的openssh有漏洞,建议升级openssh版本;
2:操作环境
Red Hat Enterprise Linux Server release 6.4
3:所需软件包
(1)gcc zlib zlib-devel make pam pam-devel  (升级过程中所需依赖包)
(2)dropbear-2014.66.tar.bz2(代替原有用pm包安装openssh环境)
(3)openssh-6.7.tar.gz(升级的软件包)
4:操作过程
(1)安装dropbear包代替openssh
[root@localhost ~]#tar -xvf dropbear-2014.66.tar.bz2 
[root@localhost ~]# cd dropbear-2014.66
[root@localhost dropbear-2014.66]#./configure --prefix=/usr/local/dropbear
[root@localhost dropbear-2014.66]# make
[root@localhost dropbear-2014.66]#make install
[root@localhost ~]# mkdir /etc/dropbear
[root@localhost ~]#/usr/local/dropbear/bin/dropbearkey -t rsa -s 2048 -f /etc/dropbear/dropbear_rsa_host_key
Generating key, this may take a while...
Public key portion is:
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCCBQJeoEhvNKkoEO3Y43++TOJl6dneodImEqnfyrfeFpjPQatYH5aQTxghO71KptR5pWYitdRarUcBJGw1fKsfhpwa6is6n6/YyQ2VljqFV+2caHSM3MxmPUHx+A6fzBbvw8u9kDFBz22xXKKSeNpmUyzqvXw8xxt2iu24kkvUYfGfxcHUyauFyiwEDBtz3JbfxlNpTO7eggMi0FT1Q8ndpgf2rg1FbflPweYjjuEtJwqEP6z0CHBsK5/KOAeanlhrkGiJ7EtyP19JxLinNWQeenknERA9IOWox928BjE3ZQ8Fa3JqAQg/w9jNNaugTgxedeLxn897DQBe9lgaatwR [email protected]
Fingerprint: md5 dd:75:10:cf:a0:0f:19:96:bd:49:69:05:ab:d6:d6:51
[root@localhost ~]# /usr/local/dropbear/sbin/dropbear -p 1213
[root@localhost ~]# netstat -tunlp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address               Foreign Address             State       PID/Program name  
tcp        0      0 0.0.0.0:111                 0.0.0.0:*                   LISTEN      809/rpcbind        
tcp        0      0 192.168.122.1:53            0.0.0.0:*                   LISTEN      1281/dnsmasq       
tcp        0      0 0.0.0.0:22                  0.0.0.0:*                   LISTEN      1651/sshd          
tcp        0      0 127.0.0.1:25                0.0.0.0:*                   LISTEN      1123/master        
tcp        0      0 0.0.0.0:1213                0.0.0.0:*                   LISTEN      8037/dropbear      
tcp        0      0 0.0.0.0:40328               0.0.0.0:*                   LISTEN      827/rpc.statd      
tcp        0      0 :::111                      :::*                        LISTEN      809/rpcbind        
tcp        0      0 :::59889                    :::*                        LISTEN      827/rpc.statd      
tcp        0      0 :::22                       :::*                        LISTEN      1651/sshd          
tcp        0      0 ::1:25                      :::*                        LISTEN      1123/master        
tcp        0      0 :::1213                     :::*                        LISTEN      8037/dropbear      
tcp        0      0 :::3306                     :::*                        LISTEN      14315/mysqld       
udp        0      0 0.0.0.0:1003                0.0.0.0:*                               827/rpc.statd      
udp        0      0 0.0.0.0:111                 0.0.0.0:*                               809/rpcbind        
udp        0      0 0.0.0.0:38790               0.0.0.0:*                               827/rpc.statd      
udp        0      0 192.168.122.1:53            0.0.0.0:*                               1281/dnsmasq       
udp        0      0 0.0.0.0:67                  0.0.0.0:*                               1281/dnsmasq       
udp        0      0 0.0.0.0:984                 0.0.0.0:*                               809/rpcbind        
udp        0      0 :::111                      :::*                                    809/rpcbind        
udp        0      0 :::40854                    :::*                                    827/rpc.statd      
udp        0      0 :::984                      :::*                                    809/rpcbind    
注:以上操作,已经做到替代原有的openssh软件,还需要注意的是关闭防火墙;或者放行1213端口,该端口是我们任意指定;
5:dropbear环境测试
操作方法:
登陆别的主机对该主机进行ssh登陆
[root@localhost ~]# ssh -p1213 192.168.10.120
The authenticity of host '192.168.10.120 (192.168.10.120)' can't be established.
RSA key fingerprint is 46:de:1b:14:42:5d:83:56:d6:29:15:13:c2:b2:d6:05.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.10.120' (RSA) to the list of known hosts.
[email protected]'s password:
Last login: Tue Feb  3 10:18:15 2015 from 192.168.10.130
说明:测试主机地址:192.168.10.130,升级主机地址:192.168.10.120
6:升级openssh
(1)操作步骤
[root@localhost ~]# mv /etc/ssh /etc/ssh.bak
[root@localhost ~]# rpm -qa |grep openssh
openssh-server-5.3p1-84.1.el6.x86_64
openssh-5.3p1-84.1.el6.x86_64
openssh-clients-5.3p1-84.1.el6.x86_64
[root@localhost ~]# rpm -e --nodeps `rpm -qa |grep openssh`
[root@localhost ~]# tar -xvf openssh-6.7p1.tar.gz
[root@localhost openssh-6.7p1]# ./configure --prefix=/usr --sysconfdir=/etc/ssh --with-pam --with-zlib --with-md5-passwords
[root@localhost openssh-6.7p1]#make
[root@localhost openssh-6.7p1]#make install
[root@localhost ~]# /usr/sbin/sshd -t -f /etc/ssh/sshd_config
[root@localhost openssh-6.7p1]# ssh -V
OpenSSH_6.7p1, OpenSSL 1.0.0-fips 29 Mar 2010
[root@localhost openssh-6.7p1]# cp contrib/redhat/sshd.init /etc/init.d/sshd
[root@localhost openssh-6.7p1]# /etc/init.d/sshd start
[root@localhost ~]# killall dropbear
[root@localhost ~]# netstat -tunlp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address               Foreign Address             State       PID/Program name  
tcp        0      0 0.0.0.0:111                 0.0.0.0:*                   LISTEN      809/rpcbind        
tcp        0      0 192.168.122.1:53            0.0.0.0:*                   LISTEN      1281/dnsmasq       
tcp        0      0 0.0.0.0:22                  0.0.0.0:*                   LISTEN      20720/sshd         
tcp        0      0 127.0.0.1:25                0.0.0.0:*                   LISTEN      1123/master        
tcp        0      0 0.0.0.0:40328               0.0.0.0:*                   LISTEN      827/rpc.statd      
tcp        0      0 :::111                      :::*                        LISTEN      809/rpcbind        
tcp        0      0 :::59889                    :::*                        LISTEN      827/rpc.statd      
tcp        0      0 :::22                       :::*                        LISTEN      20720/sshd         
tcp        0      0 ::1:25                      :::*                        LISTEN      1123/master        
tcp        0      0 :::3306                     :::*                        LISTEN      14315/mysqld       
udp        0      0 0.0.0.0:1003                0.0.0.0:*                               827/rpc.statd      
udp        0      0 0.0.0.0:111                 0.0.0.0:*                               809/rpcbind        
udp        0      0 0.0.0.0:38790               0.0.0.0:*                               827/rpc.statd      
udp        0      0 192.168.122.1:53            0.0.0.0:*                               1281/dnsmasq       
udp        0      0 0.0.0.0:67                  0.0.0.0:*                               1281/dnsmasq       
udp        0      0 0.0.0.0:984                 0.0.0.0:*                               809/rpcbind        
udp        0      0 :::111                      :::*                                    809/rpcbind        
udp        0      0 :::40854                    :::*                                    827/rpc.statd      
udp        0      0 :::984                      :::*                                    809/rpcbind  
      
[root@localhost openssh-6.7p1]# /etc/init.d/sshd start
/sbin/restorecon:  lstat(/etc/ssh/ssh_host_ecdsa_key.pub) failed:  No such file or directory
Starting sshd:[  OK  ]
[root@localhost openssh-6.7p1]# service sshd start
/sbin/restorecon:  lstat(/etc/ssh/ssh_host_ecdsa_key.pub) failed:  No such file or directory
Starting sshd:[  OK  ]
[root@localhost openssh-6.7p1]# service sshd status
sshd (pid  20720) is running...
[root@localhost openssh-6.7p1]# chkconfig --add sshd
[root@localhost openssh-6.7p1]# chkconfig --list sshd
sshd            0:off   1:off   2:on    3:on    4:on    5:on    6:off
常见问题:
编译openssh时报错如下:
/etc/ssh/ssh_config already exists, install will not overwrite
/etc/ssh/sshd_config already exists, install will not overwrite
/etc/ssh/moduli already exists, install will not overwrite
/etc/ssh/ssh_host_key already exists, skipping.
/etc/ssh/ssh_host_dsa_key already exists, skipping.
/etc/ssh/ssh_host_rsa_key already exists, skipping.
/etc/ssh/ssh_host_ed25519_key already exists, skipping.
/usr/sbin/sshd -t -f /etc/ssh/sshd_config
/var/empty must be owned by root and not group or world-writable.
make: [check-config] 错误 255 (忽略
)
解决方法:
mkdir -p /var/empty
chown root:sys /var/empty
chmod 700 /var/empty
 
希望渎者多提意见,
联系方式QQ:1486483698
QQ交流群:431392633
redhat6.4升级openssh至6.7

你可能感兴趣的:(openssh)