Linux更新操作系統(tǒng)Openssh版本9.3p1(源碼編譯安裝)

部署前準(zhǔn)備

• 安裝依賴
  • yum install -y gcc gcc-c++ glibc make autoconf openssl openssl-devel pcre-devel pam-devel
  • yum install -y pam* zlib*
• openssh-9.3p1.tar.gz
• openssl-3.1.0.tar.gz
• 備份文件
  • cp /etc/pam.d/sshd /etc/pam.d/sshd.bak

升級(jí)Openssl

解壓安裝包

• tar zxvf openssl-3.1.0.tar.gz
• cd openssl-3.1.0

備份舊Openssl

• mv /usr/bin/openssl /usr/bin/openssl_old
• mv /usr/include/openssl /usr/include/openssl_old

編譯安裝Openssl

• ./config --prefix=/usr/local/openssl && make && make install

創(chuàng)建操作系統(tǒng)軟鏈接

• ln -s /usr/local/openssl/bin/openssl /usr/bin/openssl
• ln -s /usr/local/openssl/include/openssl /usr/include/openssl

設(shè)置加載庫

• 注意：lib庫名稱，舊版本是’lib’，新版本編譯后是’lib64’,故 編譯完成后檢查自己安裝的路徑lib庫名稱
• echo "/usr/local/openssl/lib64" >> /etc/ld.so.conf
• ldconfig -v

檢查Openssl版本

• openssl version

升級(jí)Openssh

解壓openssh安裝包

• tar zxvf openssh-9.3p1.tar.gz
• cd openssh-9.3p1/

備份舊openssl目錄

• mv /etc/ssh /etc/ssh_old

編譯安裝Openssh

• ./configure --prefix=/usr/local/openssh --sysconfdir=/etc/ssh --with-md5-passwords --with-pam --with-tcp-wrappers --with-ssl-dir=/usr/local/openssl --with-zlib=/usr/local/lib64 --without-hardening
• make && make install

備份舊文件

• mv /usr/sbin/sshd /usr/sbin/sshd_old
• mv /etc/sysconfig/sshd /etc/sysconfig/sshd_old
• mv /usr/lib/systemd/system/sshd.service /usr/lib/systemd/system/sshd.service_old

卸載openssh

• for i in $(rpm -qa |grep openssh);do rpm -e $i --nodeps ;done

還原openssh配置文件

• cp -a /etc/ssh_old/sshd_config /etc/ssh/sshd_config
• mv /etc/ssh/moduli.rpmsave /etc/ssh/moduli
• mv /etc/pam.d/sshd.bak /etc/pam.d/sshd

替換新版本openssh相關(guān)命令

• cp -arf /usr/local/openssh/bin/* /usr/bin/
• cp -arf /usr/local/openssh/sbin/sshd /usr/sbin/sshd

拷貝啟動(dòng)腳本

• cp -a contrib/redhat/sshd.init /etc/init.d/sshd
• cp -a contrib/redhat/sshd.pam /etc/pam.d/sshd.pam
• chmod +x /etc/init.d/sshd

# 此處如果是SUSE操作系統(tǒng),對(duì)應(yīng)的目錄是contrib/susu/
cp -a contrib/suse/rc.sshd /etc/init.d/sshd
cp -a contrib/suse/sysconfig.ssh /etc/sysconfig/ssh

設(shè)置開機(jī)啟動(dòng),并驗(yàn)證版本

• systemctl daemon-reload
• chkconfig --add sshd && chkconfig sshd on
• systemctl start sshd
• ssh -V

設(shè)置安全性

• sed -ie ''$(grep -rn 'Ciphers and keying' /etc/ssh/sshd_config | cut -d ':' -f1)'a Ciphers aes128-ctr,aes192-ctr,aes256-ctr \n\nMACs hmac-sha2-256,hmac-sha2-512,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com \n\nKexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521 \n' /etc/ssh/sshd_config

檢查配置并注釋不支持的參數(shù)

• sshd -t

踩坑

• /etc/pam.d/sshd配置內(nèi)容

#%PAM-1.0
auth       substack     password-auth
auth       include      postlogin
account    required     pam_sepermit.so
account    required     pam_nologin.so
account    include      password-auth
password   include      password-auth
# pam_selinux.so close should be the first session rule
session    required     pam_selinux.so close
session    required     pam_loginuid.so
# pam_selinux.so open should only be followed by sessions to be executed in the user context
session    required     pam_selinux.so open env_params
session    required     pam_namespace.so
session    optional     pam_keyinit.so force revoke
session    optional     pam_motd.so
session    include      password-auth
session    include      postlogin

• ssh遠(yuǎn)程其他機(jī)器報(bào)錯(cuò)

mv /etc/ssh/ssh_config /etc/ssh/ssh_config_new
mv /etc/ssh/ssh_config.rpmsave /etc/ssh/ssh_config
systemctl restart sshd

• Anolis操作系統(tǒng)

  • 需要單獨(dú)安裝pcre和perl

• 更新完成之后其他服務(wù)器無法使用scp向更新后的服務(wù)器傳輸數(shù)據(jù)文章來源地址http://www.zghlxwxcb.cn/news/detail-526054.html

  • 使用scp -O 強(qiáng)制使用舊版本scp即可

到了這里，關(guān)于Linux更新操作系統(tǒng)Openssh版本9.3p1(源碼編譯安裝)的文章就介紹完了。如果您還想了解更多內(nèi)容，請(qǐng)?jiān)谟疑辖撬阉鱐OY模板網(wǎng)以前的文章或繼續(xù)瀏覽下面的相關(guān)文章，希望大家以后多多支持TOY模板網(wǎng)！