升级OPENSSH踩过的坑

Posted 2020-12-08 bobo137950263

安装三个必要依赖包
yum install gcc zlib-devel openssl-devel
上传安装包，创建一个/tmp目录下，然后解压，将/etc/ssh/目录移动到本地
解压安装包，进入安装目录
./configure --prefix=/usr --sysconfdir=/etc/ssh
卸载老版本 rpm -e --nodeps `rpm -qa | grep openssh`

开始安装
make install
chmod 0600 /etc/ssh/ssh_host_rsa_key
chmod 0600 /etc/ssh/ssh_host_ecdsa_key
chmod 0600 /etc/ssh/ssh_host_ed25519_key

拷贝启动文件
cp contrib/redhat/sshd.init /etc/init.d/sshd
chkconfig --add sshd
sed -i ‘/#PermitRootLogin prohibit-password/c‘"PermitRootLogin yes" /etc/ssh/sshd_config

 

gcc gcc-c++ glibc make autoconf openssl-devel pcre-devel pam-devel rpm-build

yum install -y pam* zlib*
pam-devel-1.1.1-24.el6.x86_64
pam_krb5-2.3.11-9.el6.x86_64
pam_ldap-185-11.el6.x86_64
pam_passwdqc-1.0.5-8.el6.x86_64
pam_pkcs11-0.6.2-15.el6.x86_64
pcsc-lite-libs-1.5.2-16.el6.x86_64

rpm -e --nodeps `rpm -qa | grep openssh`
#/configure --prefix=/usr/ --sysconfdir=/etc/ssh --with-zlib --with-md5-passwords --with-pam --with-tcp-wrappers && make && make install 
下载编译安装openssl，prefix=/usr/local/openssl-1.1.1e

./configure --prefix=/usr/ --sysconfdir=/etc/ssh --with-zlib --with-md5-passwords --with-pam && make install --with-ssl-dir=/usr/local/openssl-1.1.1e

cp -a /tmp/openssh/openssh-8.3p1/contrib/redhat/sshd.init /etc/init.d/sshd && cp -a /tmp/openssh/openssh-8.3p1/contrib/redhat/sshd.pam /etc/pam.d/sshd.pam

no matching key exchange method found.
第二种方法，修改/etc/ssh/sshd_config_config文件，在最末尾加入即可。

KexAlgorithms +diffie-hellman-group1-sha1
PubkeyAuthentication yes
PermitRootLogin yes
PubkeyAuthentication yes
echo "KexAlgorithms +diffie-hellman-group1-sha1">>/etc/ssh/sshd_config
echo "PermitRootLogin yes">>/etc/ssh/sshd_config
echo "PubkeyAuthentication yes">>/etc/ssh/sshd_config

添加开机启动chkconfig sshd on

sed -i ‘/#PermitRootLogin prohibit-password/c‘"PermitRootLogin yes" /etc/ssh/sshd_config
文件管理，安装包 传递到；

https://www.cnblogs.com/xyb930826/p/6077348.html
checking OpenSSL header version... not found configure: error: OpenSSL version header not found.问题
系统没有找到openssl库，需要运行ldconfig。

 

-with-openssl=/usr/local/ssl
‘echo "/usr/local/openssl-1.1.1e/lib">>/etc/ld.so.conf‘
ldconfig

[root@ds1 upgradessh]# salt ‘10.2.87.113‘ cmd.run "/etc/init.d/sshd start"
10.2.87.113:
Starting sshd:/usr/sbin/sshd: error while loading shared libraries: libcrypto.so.1.1: failed to map segment from shared object: Permission denied
[FAILED]
ERROR: Minions returned with non-zero exit code
[root@ds1 upgradessh]# salt ‘10.2.87.113‘ cmd.run "getenforcing"
10.2.87.113:
/bin/bash: getenforcing: command not found
ERROR: Minions returned with non-zero exit code
[root@ds1 upgradessh]# get
getcap getcifsacl getenforce getfacl getkey getopt getpcaps gettext gettext.sh
getcert getconf getent getfattr getkeycodes getopts getsebool gettextize
[root@ds1 upgradessh]# geten
getenforce getent
[root@ds1 upgradessh]# geten
getenforce getent
[root@ds1 upgradessh]# salt ‘10.2.87.113‘ cmd.run "getenforce"
10.2.87.113:
Enforcing

rpm -e --nodeps `rpm -qa | grep openssh` && cd /tmp/openssh && mv /etc/ssh /tmp/openssh/sshbak

downloadzip:
file.managed:
- name: /tmp/openssh-8.3p1.tar.gz
- source: salt://files/openssh/openssh-8.3p1.tar.gz
- mode: 644
- user: root
- group: root
upgrade:
cmd.run:
- name: rm -rf /tmp/openssh && yum clean all && mkdir /tmp/openssh && rpm -e --nodeps `rpm -qa | grep openssh` && cd /tmp/openssh && mv /etc/ssh /tmp/sshbak && cd /tmp/openssh && tar -zxf /tmp/openssh-8.3p1.tar.gz && /tmp/openssh/openssh-8.3p1/configure --prefix=/usr/ --sysconfdir=/etc/ssh --with-zlib --with-md5-passwords --with-pam && make install

upgrade2:
cmd.run:
- name: cp -a /tmp/openssh/openssh-8.3p1/contrib/redhat/sshd.init /etc/init.d/sshd && cp -a /tmp/openssh/openssh-8.3p1/contrib/redhat/sshd.pam /etc/pam.d/sshd.pam && echo "KexAlgorithms +diffie-hellman-group1-sha1">>/etc/ssh/sshd_config && echo "PermitRootLogin yes">>/etc/ssh/sshd_config && echo "PubkeyAuthentication yes">>/etc/ssh/sshd_config && chkconfig sshd on && setenforce 0 && /etc/init.d/sshd start && ssh -V

需要指定openssl目录的
编译升级openssl
rpmcopy:
file.managed:
- name: /tmp/openssl-1.1.1e.tar.gz
- source: salt://files/openssl/openssl-1.1.1e.tar.gz
- user: root
- group: root
- mode: 640
cmd.run:
- name: cd /tmp && tar -zxf openssl-1.1.1e.tar.gz && cd /tmp/openssl-1.1.1e/ && ./config --prefix=/usr/local/openssl-1.1.1e && make && make install && echo "/usr/local/openssl-1.1.1e/lib">>/etc/ld.so.conf && ldconfig

downloadzip:
file.managed:
- name: /tmp/openssh-8.3p1.tar.gz
- source: salt://files/openssh/openssh-8.3p1.tar.gz
- mode: 644
- user: root
- group: root
upgrade:
cmd.run:
- name: rm -rf /tmp/openssh && yum clean all && mkdir /tmp/openssh && rpm -e --nodeps `rpm -qa | grep openssh` && cd /tmp/openssh && mv /etc/ssh /tmp/openssh/sshbak && cd /tmp/openssh && tar -zxf /tmp/openssh-8.3p1.tar.gz && /tmp/openssh/openssh-8.3p1/configure --prefix=/usr/ --sysconfdir=/etc/ssh --with-zlib --with-md5-passwords --with-pam -with-ssl-dir=/usr/local/openssl-1.1.1e && make install
upgrade2:
cmd.run:
- name: cp -a /tmp/openssh/openssh-8.3p1/contrib/redhat/sshd.init /etc/init.d/sshd && cp -a /tmp/openssh/openssh-8.3p1/contrib/redhat/sshd.pam /etc/pam.d/sshd.pam && echo "KexAlgorithms +diffie-hellman-group1-sha1">>/etc/ssh/sshd_config && echo "PermitRootLogin yes">>/etc/ssh/sshd_config && echo "PubkeyAuthentication yes">>/etc/ssh/sshd_config && chkconfig sshd on && setenforce 0 && /etc/init.d/sshd start && ssh -V