CentOS系统升级OpenSSH版本
Posted bluesky-bk
tags:
篇首语：本文由小常识网(cha138.com)小编为大家整理，主要介绍了CentOS系统升级OpenSSH版本相关的知识，希望对你有一定的参考价值。
一 、CentOS 6.x 升级 OpenSSH
1、查看环境：
[[email protected] ~]# lsb_release -a LSB Version: :base-4.0-amd64:base-4.0-noarch:core-4.0-amd64:core-4.0-noarch:graphics-4.0-amd64:graphics-4.0-noarch:printing-4.0-amd64:printing-4.0-noarch Distributor ID: CentOS Description: CentOS release 6.6 (Final) Release: 6.6 Codename: Final [[email protected] ~]# ssh -V OpenSSH_5.3p1, OpenSSL 1.0.1e-fips 11 Feb 2013 [[email protected] ~]# openssl version OpenSSL 1.0.1e-fips 11 Feb 2013
2、备份ssh目录(重要)并安装telnet(避免ssh升级出现问题，导致无法远程管理)
[[email protected] ~]# cp -rf /etc/ssh /etc/ssh.bak
安装并配置telnet
[[email protected] ~]# yum -y install telnet telnet-server [[email protected] ~]# vi /etc/xinetd.d/telnet # default: on # description: The telnet server serves telnet sessions; it uses # unencrypted username/password pairs for authentication. service telnet { flags = REUSE socket_type = stream wait = no user = root server = /usr/sbin/in.telnetd log_on_failure += USERID disable = yes }
默认不允许root用户的登陆，将disable=yes 修改为 no
[[email protected] ~]# vi /etc/securetty // 增加以下内容，如果登录用户较多，需要更多的pts/* pts/0 pts/1 pts/2
配置完成后启动telnet服务
[[email protected] ~]# service xinetd start [[email protected] ~]# service xinetd status xinetd (pid 28430) is running...
注：ssh升级后建议再修改，还原设置
3、OpenSSH安装
3.1 安装依赖包
[[email protected] ~]# yum install -y gcc openssl-devel pam-devel rpm-build
3.2 下载安装包
[[email protected] Downloads]# wget http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-7.8p1.tar.gz
3.3 解压并编译安装
[[email protected] Downloads]# tar -zxvf openssh-7.8p1.tar.gz [[email protected] Downloads]# cd openssh-7.8p1 [[email protected] openssh-7.8p1]# ./configure --prefix=/usr --sysconfdir=/etc/ssh --with-pam --with-zlib --with-md5-passwords --with-tcp-wrappers [[email protected] openssh-7.8p1]# make && make install
3.4 配置OpenSSH
[[email protected] openssh-7.8p1]# vi /etc/ssh/sshd_config // 将 #PermitRootLogin yes 修改为 PermitRootLogin yes // 或者执行如下命令 [[email protected] openssh-7.8p1]# sed -i ‘/^#PermitRootLogin/s/#PermitRootLogin yes/PermitRootLogin yes/‘ /etc/ssh/sshd_config
3.5 重启sshd服务
[[email protected] openssh-7.8p1]# service sshd restart [[email protected] openssh-7.8p1]# service sshd status openssh-daemon (pid 28331) is running...
[[email protected] openssh-7.8p1]# ssh -V
OpenSSH_7.8p1, OpenSSL 1.0.1e-fips 11 Feb 2013
二、CentOS 7.x 升级 OpenSSH
1、查看环境：
[[email protected] ~]# lsb_release -a LSB Version: :core-4.1-amd64:core-4.1-noarch:cxx-4.1-amd64:cxx-4.1-noarch:desktop-4.1-amd64:desktop-4.1-noarch:languages-4.1-amd64:languages-4.1-noarch:printing-4.1-amd64:printing-4.1-noarch Distributor ID: CentOS Description: CentOS Linux release 7.2.1511 (Core) Release: 7.2.1511 Codename: Core [[email protected] ~]# ssh -V OpenSSH_6.6.1p1, OpenSSL 1.0.1e-fips 11 Feb 2013 [[email protected] ~]# openssl version OpenSSL 1.0.2k-fips 26 Jan 2017
2、同上，备份ssh目录(重要)并安装telnet(避免ssh升级出现问题，导致无法远程管理)
[[email protected] ~]# cp -rf /etc/ssh /etc/ssh.bak
安装并配置telnet
[[email protected] ~]# yum -y install telnet telnet-server [[email protected] ~]# vi /etc/xinetd.d/telnet
#default:yes
## description: The telnet server servestelnet sessions; it uses
## unencrypted username/password pairs for authentication.
service telnet
{
flags = REUSE
socket_type = stream
wait = no
user = root
server =/usr/sbin/in.telnetd
log_on_failure += USERID
disable = yes
}
默认不允许root用户的登陆，将disable=yes 修改为 no
[[email protected] ~]# vi /etc/securetty // 增加以下内容，如果登录用户较多，需要更多的pts/* pts/0 pts/1 pts/2
配置完成后启动telnet服务
[[email protected] ~]# systemctl start xinetd [[email protected] ~]# systemctl status xinetd ● xinetd.service - Xinetd A Powerful Replacement For Inetd Loaded: loaded (/usr/lib/systemd/system/xinetd.service; enabled; vendor preset: enabled) Active: active (running) since Mon 2018-12-17 10:45:35 CST; 23h ago Main PID: 4217 (xinetd) CGroup: /system.slice/xinetd.service └─4217 /usr/sbin/xinetd -stayalive -pidfile /var/run/xinetd.pid
注：ssh升级后建议再修改，还原设置
3、OpenSSH安装
3.1 安装依赖包
[[email protected] ~]# yum install -y gcc openssl-devel pam-devel rpm-build
3.2 下载安装包
OpenSSH需要依赖zlib和OpenSSL，因此需要从官网下载三者的源码包。三者源码下载地址：
http://www.zlib.net/
分别下载openssh-7.8p1.tar.gz、openssl-1.0.2m.tar.gz和zlib-1.2.11.tar.gz
[[email protected] Downloads]# wget http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-7.8p1.tar.gz [[email protected] Downloads]# wget https://www.openssl.org/source/old/1.0.2/openssl-1.0.2m.tar.gz [[email protected] Downloads]# wget http://www.zlib.net/zlib-1.2.11.tar.gz [[email protected] Downloads]# ll total 7300 -rw-r--r--. 1 root root 1548026 Aug 24 07:53 openssh-7.8p1.tar.gz -rw-r--r--. 1 root root 5373776 Nov 2 2017 openssl-1.0.2m.tar.gz -rw-r--r--. 1 root root 607698 Jan 16 2017 zlib-1.2.11.tar.gz
3.3 编译并安装配置zlib、openssl
// 编译安装zlib [[email protected] Downloads]# tar -zxvf zlib-1.2.11.tar.gz [[email protected] Downloads]# cd zlib-1.2.11/ [[email protected] zlib-1.2.11]# ./configure --prefix=/usr/local/zlib-1.2.11 -share [[email protected] zlib-1.2.11]# make && make install [[email protected] zlib-1.2.11]# vi /etc/ld.so.conf // 配置库文件搜索路径，在最后加入
/usr/local/zlib-1.2.11/lib [[email protected] zlib-1.2.11]# ldconfig -v // 刷新缓存文件/etc/ld.so.cache [[email protected] zlib-1.2.11]# ln -s /usr/local/zlib-1.2.11 /usr/local/zlib [[email protected] zlib-1.2.11]# cd /root/Downloads/ // 编译安装openssl [[email protected] Downloads]# tar -zxvf openssl-1.0.2m.tar.gz [[email protected] Downloads]# cd openssl-1.0.2m/ [[email protected] openssl-1.0.2m]# ./config --prefix=/usr/local/openssl-1.0.2m --with-zlib-lib=/usr/local/zlib-1.2.11/lib --with-zlib-include=/usr/local/zlib-1.2.11/include [[email protected] openssl-1.0.2m]# make && make install [[email protected] openssl-1.0.2m]# vi /etc/ld.so.conf // 配置库文件搜索路径，在最后加入
/usr/local/openssl-1.0.2m/lib [[email protected] openssl-1.0.2m]# ldconfig -v // 刷新缓存文件/etc/ld.so.cache [[email protected] openssl-1.0.2m]# ln -s /usr/local/openssl-1.0.2m /usr/local/openssl [[email protected] openssl-1.0.2m]# vi /etc/profile // 配置环境变量，在最后加入以下两行 PATH=/usr/local/openssl/bin:$PATH export PATH [[email protected] openssl-1.0.2m]# source /etc/profile // 让配置生效 [[email protected] openssl-1.0.2m]# openssl version -a // 查看openssl版本，验证是否安装成功 OpenSSL 1.0.2m 2 Nov 2017 built on: reproducible build, date unspecified platform: linux-x86_64 options: bn(64,64) rc4(16x,int) des(idx,cisc,16,int) idea(int) blowfish(idx) compiler: gcc -I. -I.. -I../include -I/usr/local/zlib-1.2.11/include -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -Wa,--noexecstack -m64 -DL_ENDIAN -O3 -Wall -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DRC4_ASM -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM OPENSSLDIR: "/usr/local/openssl-1.0.2m/ssl"
3.4 卸载原OpenSSH
[[email protected] Downloads]# rpm -qa |grep openssh openssh-clients-6.6.1p1-22.el7.x86_64 openssh-6.6.1p1-22.el7.x86_64 openssh-server-6.6.1p1-22.el7.x86_64 [[email protected] Downloads]# for i in $(rpm -qa |grep openssh);do rpm -e $i --nodeps;done
3.5 编译安装配置OpenSSH
[[email protected] Downloads]# tar -zxvf openssh-7.8p1.tar.gz [[email protected] Downloads]# cd openssh-7.8p1/ [[email protected] openssh-7.8p1]# ./configure --prefix=/usr --sysconfdir=/etc/ssh --with-pam--with-ssl-dir=/usr/local/openssl --with-md5-passwords --mandir=/usr/share/man --with-zlib=/usr/local/zlib --without-hardening --with-tcp-wrappers [[email protected] openssh-7.8p1]# rm -rf /etc/ssh [[email protected] openssh-7.8p1]# make && make install [[email protected] openssh-7.8p1]# cp contrib/redhat/sshd.init /etc/init.d/sshd [[email protected] openssh-7.8p1]# chkconfig --add sshd [[email protected] openssh-7.8p1]# chkconfig sshd on [[email protected] openssh-7.8p1]# chkconfig --list|grep sshd [[email protected] openssh-7.8p1]# sed -i "32a PermitRootLogin yes" /etc/ssh/sshd_config
3.6 重启sshd服务
[[email protected] openssh-7.8p1]# systemctl restart sshd [[email protected] openssh-7.8p1]# systemctl status sshd ● sshd.service - SYSV: OpenSSH server daemon Loaded: loaded (/etc/rc.d/init.d/sshd) Active: active (running) since Tue 2018-12-18 14:45:59 CST; 11s ago Docs: man:systemd-sysv-generator(8) Process: 16931 ExecStart=/etc/rc.d/init.d/sshd start (code=exited, status=0/SUCCESS) Main PID: 16939 (sshd) CGroup: /system.slice/sshd.service └─16939 /usr/sbin/sshd Dec 18 14:45:59 localhost.localdomain systemd[1]: Starting SYSV: OpenSSH server daemon... Dec 18 14:45:59 localhost.localdomain sshd[16939]: Server listening on 0.0.0.0 port 22. Dec 18 14:45:59 localhost.localdomain sshd[16939]: Server listening on :: port 22. Dec 18 14:45:59 localhost.localdomain sshd[16931]: Starting sshd:[ OK ] Dec 18 14:45:59 localhost.localdomain systemd[1]: Started SYSV: OpenSSH server daemon.
[[email protected] openssh-7.8p1]# ssh -V
OpenSSH_7.8p1, OpenSSL 1.0.2k-fips 26 Jan 2017
参考链接：http://bbs.51cto.com/thread-1547903-1.html
参考链接：https://blog.csdn.net/levy_cui/article/details/53100315
参考链接：https://www.cnblogs.com/liangjingfu/p/9635657.html
以上是关于CentOS系统升级OpenSSH版本的主要内容，如果未能解决你的问题，请参考以下文章