当前位置:   article > 正文

Linux Centos7 升级最新版OpenSSH-9.6p1详细步骤(附脚本)_openssh 9.6升级

openssh 9.6升级

        最近公司系统在进行三级等保测评,其中有一项高危漏洞是Linux服务器的SSH版本太低存在安全风险,要求整改升级到最新版本,此篇文章记录SSH升级步骤和脚本。

鸣谢:本文参考文章,在该作者文章的所提供的脚本基础上进行修改而来:Linux OpenSSH-9.0p1最新版升级步骤详细(附脚本)_ssh升级脚本-CSDN博客

环境准备及软件下载相关步骤,请参考以上作者原文章,写的非常详细,这里只对一些优化和改进的地方进行记录。

编写脚本,该脚本在参考原文脚本的基础上修改(完整脚本,直接复制可用)

  1. #!/bin/bash
  2. #
  3. #########################################################
  4. # Function :openssh-9.6p1 update #
  5. # Platform :Centos7.X #
  6. # Version :2.0 #
  7. # Date :2022-05-01 #
  8. #########################################################
  9. clear
  10. export LANG="en_US.UTF-8"
  11. #修改1:此处的zlib原来的版本zlib-1.2提示下载失败,改完最新版本号可正常下载,
  12. #最新版本可在此地址查看:https://www.zlib.net/,截止本文修改日期最新版本为1.3.1
  13. #openssl和openssh下载不同的版本在此处修改版本号即可
  14. zlib_version="zlib-1.3.1"
  15. openssl_version="openssl-1.1.1q"
  16. openssh_version="openssh-9.6p1"
  17. #安装包地址,这里存在一个问题,如果文件夹没有提前建好,后续执行脚本将报错
  18. file="/opt"
  19. #默认编译路径
  20. default="/usr/local"
  21. date_time=`date +%Y-%m-%d—%H:%M`
  22. #安装目录
  23. file_install="$file/openssh_install"
  24. file_backup="$file/openssh_backup"
  25. file_log="$file/openssh_log"
  26. #修改2:为了解决文件夹不存在的问题,我这里添加了创建文件夹的脚本---start
  27. if [ ! -d "$file_install" ]; then
  28. mkdir "$file_install"
  29. fi
  30. if [ ! -d "$file_backup" ]; then
  31. mkdir "$file_backup"
  32. fi
  33. if [ ! -d "$file_log" ]; then
  34. mkdir "$file_log"
  35. fi
  36. if [ ! -d "$file_install/zlib" ]; then
  37. mkdir "$file_install/zlib"
  38. fi
  39. #修改2:为了解决文件夹不存在的问题,我这里添加了创建文件夹的脚本---end
  40. #源码包链接
  41. zlib_download="https://www.zlib.net/$zlib_version.tar.gz"
  42. openssl_download="https://www.openssl.org/source/$openssl_version.tar.gz"
  43. openssh_download="https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/$openssh_version.tar.gz"
  44. Install_make()
  45. {
  46. # Check if user is root
  47. if [ $(id -u) != "0" ]; then
  48. echo -e "\033[33m--------------------------------------------------------------- \033[0m"
  49. echo -e " 当前用户为普通用户,必须使用root用户运行,脚本退出中......" "\033[31m Error\033[0m"
  50. echo -e "\033[33m--------------------------------------------------------------- \033[0m"
  51. echo ""
  52. sleep 4
  53. exit
  54. fi
  55. #判断是否安装wget
  56. echo -e "\033[33m 正在安装Wget...... \033[0m"
  57. sleep 2
  58. echo ""
  59. if ! type wget >/dev/null 2>&1; then
  60. yum install -y wget
  61. else
  62. echo -e "\033[33m--------------------------------------------------------------- \033[0m"
  63. echo -e " wget已经安装了:" "\033[32m Please continue\033[0m"
  64. echo -e "\033[33m--------------------------------------------------------------- \033[0m"
  65. echo ""
  66. fi
  67. #判断是否安装tar
  68. echo -e "\033[33m 正在安装TAR...... \033[0m"
  69. sleep 2
  70. echo ""
  71. if ! type tar >/dev/null 2>&1; then
  72. yum install -y tar
  73. else
  74. echo ""
  75. echo -e "\033[33m--------------------------------------------------------------- \033[0m"
  76. echo -e " tar已经安装了:" "\033[32m Please continue\033[0m"
  77. echo -e "\033[33m--------------------------------------------------------------- \033[0m"
  78. fi
  79. echo ""
  80. #安装相关依赖包
  81. echo -e "\033[33m 正在安装依赖包...... \033[0m"
  82. sleep 3
  83. echo ""
  84. yum install gcc gcc-c++ glibc make autoconf openssl openssl-devel pcre-devel pam-devel zlib-devel tcp_wrappers-devel tcp_wrappers
  85. if [ $? -eq 0 ];then
  86. echo ""
  87. echo -e "\033[33m--------------------------------------------------------------- \033[0m"
  88. echo -e " 安装软件依赖包成功 " "\033[32m Success\033[0m"
  89. echo -e "\033[33m--------------------------------------------------------------- \033[0m"
  90. else
  91. echo -e "\033[33m--------------------------------------------------------------- \033[0m"
  92. echo -e " 解压源码包失败,脚本退出中......" "\033[31m Error\033[0m"
  93. echo -e "\033[33m--------------------------------------------------------------- \033[0m"
  94. sleep 4
  95. exit
  96. fi
  97. echo ""
  98. }
  99. Install_backup()
  100. {
  101. #创建文件(可修改)
  102. mkdir -p $file_install
  103. mkdir -p $file_backup
  104. mkdir -p $file_log
  105. mkdir -p $file_backup/zlib
  106. mkdir -p $file_backup/ssl
  107. mkdir -p $file_backup/ssh
  108. mkdir -p $file_log/zlib
  109. mkdir -p $file_log/ssl
  110. mkdir -p $file_log/ssh
  111. #备份文件(可修改)
  112. cp -rf /usr/bin/openssl $file_backup/ssl/openssl_$date_time.bak > /dev/null
  113. cp -rf /etc/init.d/sshd $file_backup/ssh/sshd_$date_time.bak > /dev/null
  114. cp -rf /etc/ssh $file_backup/ssh/ssh_$date_time.bak > /dev/null
  115. cp -rf /usr/lib/systemd/system/sshd.service $file_backup/ssh/sshd_$date_time.service.bak > /dev/null
  116. cp -rf /etc/pam.d/sshd.pam $file_backup/ssh/sshd_$date_time.pam.bak > /dev/null
  117. }
  118. Remove_openssh()
  119. {
  120. ##并卸载原有的openssh(可修改)
  121. rpm -e --nodeps `rpm -qa | grep openssh`
  122. }
  123. Install_tar()
  124. {
  125. #下载的源码包,检查是否解压(可修改)
  126. # if [ -e $file/$zlib_version.tar.gz ] && [ -e $file/$openssl_version.tar.gz ] && [ -e /$file/$openssh_version.tar.gz ];then
  127. # echo -e " 下载软件源码包已存在 " "\033[32m Please continue\033[0m"
  128. # else
  129. # echo -e "\033[33m 未发现本地源码包,链接检查获取中........... \033[0m "
  130. # echo ""
  131. # cd $file
  132. # wget --no-check-certificate $zlib_download
  133. # wget --no-check-certificate $openssl_download
  134. # wget --no-check-certificate $openssh_download
  135. # echo ""
  136. # fi
  137. #zlib
  138. echo -e "\033[33m 正在下载Zlib软件包...... \033[0m"
  139. sleep 3
  140. echo ""
  141. if [ -e $file/$zlib_version.tar.gz ] ;then
  142. echo -e " 下载软件源码包已存在 " "\033[32m Please continue\033[0m"
  143. else
  144. echo -e "\033[33m 未发现zlib本地源码包,链接检查获取中........... \033[0m "
  145. sleep 1
  146. echo ""
  147. cd $file
  148. wget --no-check-certificate $zlib_download
  149. echo ""
  150. fi
  151. #openssl
  152. echo -e "\033[33m 正在下载Openssl软件包...... \033[0m"
  153. sleep 3
  154. echo ""
  155. if [ -e $file/$openssl_version.tar.gz ] ;then
  156. echo -e " 下载软件源码包已存在 " "\033[32m Please continue\033[0m"
  157. else
  158. echo -e "\033[33m 未发现openssl本地源码包,链接检查获取中........... \033[0m "
  159. echo ""
  160. sleep 1
  161. cd $file
  162. wget --no-check-certificate $openssl_download
  163. echo ""
  164. fi
  165. #openssh
  166. echo -e "\033[33m 正在下载Openssh软件包...... \033[0m"
  167. sleep 3
  168. echo ""
  169. if [ -e /$file/$openssh_version.tar.gz ];then
  170. echo -e " 下载软件源码包已存在 " "\033[32m Please continue\033[0m"
  171. else
  172. echo -e "\033[33m 未发现openssh本地源码包,链接检查获取中........... \033[0m "
  173. echo ""
  174. sleep 1
  175. cd $file
  176. wget --no-check-certificate $openssh_download
  177. fi
  178. }
  179. echo ""
  180. echo ""
  181. #安装zlib
  182. Install_zlib(){
  183. echo -e "\033[33m 1.1-正在解压Zlib软件包...... \033[0m"
  184. sleep 3
  185. echo ""
  186. cd $file && mkdir -p $file_install && tar -xzf zlib*.tar.gz -C $file_install > /dev/null
  187. if [ -d $file_install/$zilb_version ];then
  188. echo -e "\033[33m--------------------------------------------------------------- \033[0m"
  189. echo -e " zilb解压源码包成功" "\033[32m Success\033[0m"
  190. echo -e "\033[33m--------------------------------------------------------------- \033[0m"
  191. echo ""
  192. else
  193. echo -e "\033[33m--------------------------------------------------------------- \033[0m"
  194. echo -e " zilb解压源码包失败,脚本退出中......" "\033[31m Error\033[0m"
  195. echo -e "\033[33m--------------------------------------------------------------- \033[0m"
  196. echo ""
  197. sleep 4
  198. exit
  199. fi
  200. echo -e "\033[33m 1.2-正在编译安装Zlib服务.............. \033[0m"
  201. sleep 3
  202. echo ""
  203. #这里原脚本写法:cd $file_install/zlib*,我遇到了cd目录失败问题,将此处修改如下
  204. cd $file_install/$zlib_version
  205. echo -e "$pwd"
  206. ./configure --prefix=$default/$zlib_version > $file_log/zlib/zlib_configure_$date_time.txt #> /dev/null 2>&1
  207. if [ $? -eq 0 ];then
  208. echo -e "\033[33m make... \033[0m"
  209. make > /dev/null 2>&1
  210. echo $?
  211. echo -e "\033[33m make test... \033[0m"
  212. make test > /dev/null 2>&1
  213. echo $?
  214. echo -e "\033[33m make install... \033[0m"
  215. make install > /dev/null 2>&1
  216. echo $?
  217. else
  218. echo -e "\033[33m--------------------------------------------------------------- \033[0m"
  219. echo -e " 编译安装压缩库失败,脚本退出中..." "\033[31m Error\033[0m"
  220. echo -e "\033[33m--------------------------------------------------------------- \033[0m"
  221. echo ""
  222. sleep 4
  223. exit
  224. fi
  225. if [ -e $default/$zlib_version/lib/libz.so ];then
  226. sed -i '/zlib/'d /etc/ld.so.conf
  227. echo "$default/$zlib_version/lib" >> /etc/ld.so.conf
  228. echo "$default/$zlib_version/lib" >> /etc/ld.so.conf.d/zlib.conf
  229. ldconfig -v > $file_log/zlib/zlib_ldconfig_$date_time.txt > /dev/null 2>&1
  230. /sbin/ldconfig
  231. fi
  232. }
  233. echo ""
  234. echo ""
  235. Install_openssl(){
  236. echo -e "\033[33m 2.1-正在解压Openssl...... \033[0m"
  237. sleep 3
  238. echo ""
  239. cd $file && tar -xvzf openssl*.tar.gz -C $file_install > /dev/null
  240. if [ -d $file_install/$openssl_version ];then
  241. echo -e "\033[33m--------------------------------------------------------------- \033[0m"
  242. echo -e " OpenSSL解压源码包成功" "\033[32m Success\033[0m"
  243. echo -e "\033[33m--------------------------------------------------------------- \033[0m"
  244. else
  245. echo -e "\033[33m--------------------------------------------------------------- \033[0m"
  246. echo -e " OpenSSL解压源码包失败,脚本退出中......" "\033[31m Error\033[0m"
  247. echo -e "\033[33m--------------------------------------------------------------- \033[0m"
  248. echo ""
  249. sleep 4
  250. exit
  251. fi
  252. echo ""
  253. echo -e "\033[33m 2.2-正在编译安装Openssl服务...... \033[0m"
  254. sleep 3
  255. echo ""
  256. cd $file_install/$openssl_version
  257. ./config shared zlib --prefix=$default/$openssl_version > $file_log/ssl/ssl_config_$date_time.txt #> /dev/null 2>&1
  258. if [ $? -eq 0 ];then
  259. echo -e "\033[33m make clean... \033[0m"
  260. make clean > /dev/null 2>&1
  261. echo $?
  262. echo -e "\033[33m make -j 4... \033[0m"
  263. make -j 4 > /dev/null 2>&1
  264. echo $?
  265. echo -e "\033[33m make install... \033[0m"
  266. make install > /dev/null 2>&1
  267. echo $?
  268. else
  269. echo -e "\033[33m--------------------------------------------------------------- \033[0m"
  270. echo -e " 编译安装OpenSSL失败,脚本退出中..." "\033[31m Error\033[0m"
  271. echo -e "\033[33m--------------------------------------------------------------- \033[0m"
  272. echo ""
  273. sleep 4
  274. exit
  275. fi
  276. mv /usr/bin/openssl /usr/bin/openssl_$date_time.bak #先备份
  277. if [ -e $default/$openssl_version/bin/openssl ];then
  278. sed -i '/openssl/'d /etc/ld.so.conf
  279. echo "$default/$openssl_version/lib" >> /etc/ld.so.conf
  280. ln -s $default/$openssl_version/bin/openssl /usr/bin/openssl
  281. ln -s $default/$openssl_version/lib/libssl.so.1.1 /usr/lib64/libssl.so.1.1
  282. ln -s $default/$openssl_version/lib/libcrypto.so.1.1 /usr/lib64/libcrypto.so.1.1
  283. ldconfig -v > $file_log/ssl/ssl_ldconfig_$date_time.txt > /dev/null 2>&1
  284. /sbin/ldconfig
  285. echo -e "\033[33m--------------------------------------------------------------- \033[0m"
  286. echo -e " 编译安装OpenSSL " "\033[32m Success\033[0m"
  287. echo -e "\033[33m--------------------------------------------------------------- \033[0m"
  288. echo ""
  289. echo -e "\033[33m 2.3-正在输出 OpenSSL 版本状态.............. \033[0m"
  290. sleep 3
  291. echo ""
  292. echo -e "\033[32m====================== OpenSSL veriosn ===================== \033[0m"
  293. echo ""
  294. openssl version -a
  295. echo ""
  296. echo -e "\033[32m======================================================= \033[0m"
  297. sleep 2
  298. else
  299. echo ""
  300. echo -e "\033[33m--------------------------------------------------------------- \033[0m"
  301. echo -e " OpenSSL软连接失败,脚本退出中..." "\033[31m Error\033[0m"
  302. echo -e "\033[33m--------------------------------------------------------------- \033[0m"
  303. fi
  304. }
  305. echo ""
  306. echo ""
  307. Install_openssh(){
  308. echo -e "\033[33m 3.1-正在解压OpenSSH...... \033[0m"
  309. sleep 3
  310. echo ""
  311. cd $file && tar -xvzf openssh*.tar.gz -C $file_install > /dev/null
  312. if [ -d $file_install/$openssh_version ];then
  313. echo -e "\033[33m--------------------------------------------------------------- \033[0m"
  314. echo -e " OpenSSh解压源码包成功" "\033[32m Success\033[0m"
  315. echo -e "\033[33m--------------------------------------------------------------- \033[0m"
  316. else
  317. echo -e "\033[33m--------------------------------------------------------------- \033[0m"
  318. echo -e " OpenSSh解压源码包失败,脚本退出中......" "\033[31m Error\033[0m"
  319. echo -e "\033[33m--------------------------------------------------------------- \033[0m"
  320. echo ""
  321. sleep 4
  322. exit
  323. fi
  324. echo ""
  325. echo -e "\033[33m 3.2-正在编译安装OpenSSH服务...... \033[0m"
  326. sleep 3
  327. echo ""
  328. mv /etc/ssh /etc/ssh_$date_time.bak #先备份
  329. cd $file_install/$openssh_version
  330. ./configure --prefix=$default/$openssh_version --sysconfdir=/etc/ssh --with-ssl-dir=$default/$openssl_version --with-zlib=$default/$zlib_version > $file_log/ssh/ssh_configure_$date_time.txt #> /dev/null 2>&1
  331. if [ $? -eq 0 ];then
  332. echo -e "\033[33m make -j 4... \033[0m"
  333. make -j 4 > /dev/null 2>&1
  334. echo $?
  335. echo -e "\033[33m make install... \033[0m"
  336. make install > /dev/null 2>&1
  337. echo $?
  338. else
  339. echo -e "\033[33m--------------------------------------------------------------- \033[0m"
  340. echo -e " 编译安装OpenSSH失败,脚本退出中......" "\033[31m Error\033[0m"
  341. echo -e "\033[33m--------------------------------------------------------------- \033[0m"
  342. echo ""
  343. sleep 4
  344. exit
  345. fi
  346. echo ""
  347. echo -e "\033[33m--------------------------------------------------------------- \033[0m"
  348. echo -e " 编译安装OpenSSH " "\033[32m Success\033[0m"
  349. echo -e "\033[33m--------------------------------------------------------------- \033[0m"
  350. echo ""
  351. sleep 2
  352. echo -e "\033[32m==================== OpenSSH—file veriosn =================== \033[0m"
  353. echo ""
  354. /usr/local/$openssh_version/bin/ssh -V
  355. echo ""
  356. echo -e "\033[32m======================================================= \033[0m"
  357. sleep 3
  358. echo ""
  359. echo -e "\033[33m 3.3-正在迁移OpenSSH配置文件...... \033[0m"
  360. sleep 3
  361. echo ""
  362. #迁移sshd
  363. if [ -f "/etc/init.d/sshd" ];then
  364. mv /etc/init.d/sshd /etc/init.d/sshd_$date_time.bak
  365. else
  366. echo -e " /etc/init.d/sshd不存在 " "\033[31m Not backed up(可忽略)\033[0m"
  367. fi
  368. cp -rf $file_install/$openssh_version/contrib/redhat/sshd.init /etc/init.d/sshd;
  369. chmod u+x /etc/init.d/sshd;
  370. chkconfig --add sshd ##自启动
  371. chkconfig --list |grep sshd;
  372. chkconfig sshd on
  373. #备份启动脚本,不一定有
  374. if [ -f "/usr/lib/systemd/system/sshd.service" ];then
  375. mv /usr/lib/systemd/system/sshd.service /usr/lib/systemd/system/sshd.service_bak
  376. else
  377. echo -e " sshd.service不存在" "\033[31m Not backed up(可忽略)\033[0m"
  378. fi
  379. #备份复制sshd.pam文件
  380. if [ -f "/etc/pam.d/sshd.pam" ];then
  381. mv /etc/pam.d/sshd.pam /etc/pam.d/sshd.pam_$date_time.bak
  382. else
  383. echo -e " sshd.pam不存在" "\033[31m Not backed up(可忽略)\033[0m"
  384. fi
  385. cp -rf $file_install/$openssh_version/contrib/redhat/sshd.pam /etc/pam.d/sshd.pam
  386. #迁移ssh_config
  387. cp -rf $file_install/$openssh_version/sshd_config /etc/ssh/sshd_config
  388. sed -i 's/Subsystem/#Subsystem/g' /etc/ssh/sshd_config
  389. echo "Subsystem sftp $default/$openssh_version/libexec/sftp-server" >> /etc/ssh/sshd_config
  390. cp -rf $default/$openssh_version/sbin/sshd /usr/sbin/sshd
  391. cp -rf /$default/$openssh_version/bin/ssh /usr/bin/ssh
  392. cp -rf $default/$openssh_version/bin/ssh-keygen /usr/bin/ssh-keygen
  393. sed -i 's/#PasswordAuthentication\ yes/PasswordAuthentication\ yes/g' /etc/ssh/sshd_config
  394. #grep -v "[[:space:]]*#" /etc/ssh/sshd_config |grep "PubkeyAuthentication yes"
  395. echo 'PermitRootLogin yes' >> /etc/ssh/sshd_config
  396. #重启sshd
  397. service sshd start > /dev/null 2>&1
  398. if [ $? -eq 0 ];then
  399. echo -e "\033[33m--------------------------------------------------------------- \033[0m"
  400. echo -e " 启动OpenSSH服务成功" "\033[32m Success\033[0m"
  401. echo -e "\033[33m--------------------------------------------------------------- \033[0m"
  402. echo ""
  403. sleep 2
  404. #删除源码包(可修改)
  405. rm -rf $file/*$zlib_version.tar.gz
  406. rm -rf $file/*$openssl_version.tar.gz
  407. rm -rf $file/*$openssh_version.tar.gz
  408. #rm -rf $file_install
  409. echo -e "\033[33m 3.4-正在输出 OpenSSH 版本...... \033[0m"
  410. sleep 3
  411. echo ""
  412. echo -e "\033[32m==================== OpenSSH veriosn =================== \033[0m"
  413. echo ""
  414. ssh -V
  415. echo ""
  416. echo -e "\033[32m======================================================== \033[0m"
  417. else
  418. echo -e "\033[33m--------------------------------------------------------------- \033[0m"
  419. echo -e " 启动OpenSSH服务失败,脚本退出中......" "\033[31m Error\033[0m"
  420. echo -e "\033[33m--------------------------------------------------------------- \033[0m"
  421. sleep 4
  422. exit
  423. fi
  424. echo ""
  425. }
  426. End_install()
  427. {
  428. ##sshd状态
  429. echo ""
  430. echo -e "\033[33m 输出sshd服务状态: \033[33m"
  431. sleep 2
  432. echo ""
  433. systemctl status sshd.service
  434. echo ""
  435. echo ""
  436. echo ""
  437. sleep 1
  438. echo -e "\033[33m==================== OpenSSH file =================== \033[0m"
  439. echo ""
  440. echo -e " Openssh升级安装目录请前往: "
  441. cd $file_install && pwd
  442. cd ~
  443. echo ""
  444. echo -e " Openssh升级备份目录请前往: "
  445. cd $file_backup && pwd
  446. cd ~
  447. echo ""
  448. echo -e " Openssh升级日志目录请前往: "
  449. cd $file_log && pwd
  450. cd ~
  451. echo ""
  452. echo -e "\033[33m======================================================= \033[0m"
  453. }
  454. Install_make
  455. Install_backup
  456. Remove_openssh
  457. Install_tar
  458. Install_zlib
  459. Install_openssl
  460. Install_openssh
  461. End_install
  • 上传脚本到Linux并转换sh脚本文件格式

 windows电脑环境编辑的脚本文件上传到Linux环境可能会遇到的问题

  1. [root@localhost soft]# sh sshupdate.sh
  2. sshupdate.sh: line 120: syntax error near unexpected token `$'\r''
  3. [root@localhost soft]#

原因分析:报错原因是因为脚本window操作系统和Linux操作系统换行符的编码不一样

解决办法:脚本在执行前需使用dos2unix命令转换文件格式

具体步骤:

  1. #dos2unix命令安装:
  2. yum -y install dos2unix
  3. #转换文件格式,sshupdate.sh是你要转换的sh脚本,根据个人文件名称修改:
  4. dos2unix sshupdate.sh
  5. dos2unix: converting file sshupdate.sh to Unix format ...
  • 执行脚本,等待完成

sh ./sshupdate.sh
  • 测试验证

  1. 查看SSH版本
  2. ssh -V

声明:本文内容由网友自发贡献,不代表【wpsshop博客】立场,版权归原作者所有,本站不承担相应法律责任。如您发现有侵权的内容,请联系我们。转载请注明出处:https://www.wpsshop.cn/w/IT小白/article/detail/91451
推荐阅读
相关标签
  

闽ICP备14008679号