Linux升级OpenSSH

环境：CentOS7.9，虚拟机
升级OpenSSL和OpenSSH修复安全漏洞

一、软件包准备

zlib-1.2.13.tar.gz
openssl-3.0.5.tar.gz
openssh-9.1p1.tar.gz

二、安装软件包

1.解压升级包

安装包上传到/opt目录

cd /opt
tar -zxvf zlib-1.2.13.tar.gz
tar -zxvf openssl-3.0.5.tar.gz
tar -zxvf openssh-9.1p1.tar.gz
1
2
3
4

2.编译安装zlib

cd /opt/zlib-1.2.13
./configure --prefix=/usr/local/zlib
make && make install
echo '/usr/local/zlib/lib' >> /etc/ld.so.conf  
ldconfig -v
1
2
3
4
5

若编译zlib出错，请安装gcc
验证zlib安装是否成功，/usrlocal/zlib要包含include、lib、share三个目录。

3.编译安装openssl

cd /opt/openssl-3.0.5
./config --prefix=/usr/local/ssl -d shared
make && make install   

# 将原有openssl备份
mv /usr/bin/openssl /usr/bin/openssl.bak
mv /usr/include/openssl /usr/include/openssl.bak 

# 添加新openssl软连接
ln -s /usr/local/ssl/bin/openssl /usr/bin/openssl
ln -s /usr/local/ssl/include/openssl/ /usr/include/openssl

echo '/usr/local/ssl/lib64' >> /etc/ld.so.conf
ldconfig -v
1
2
3
4
5
6
7
8
9
10
11
12
13
14

这里要注意看下目录是lib64还是lib，不同版本可能会不一样，选错会导致后面ssh配置configure时报错

4.升级openSSH

备份ssh目录文件

cp -r /etc/ssh /etc/ssh.bak
1

查看系统原有openssh包，卸载包及其依赖包

rpm -qa | grep openssh  # 一般有三个包，全部卸载
rpm -e --nodeps openssh-server-7.4p1-22.el7_9.x86_64
rpm -e --nodeps openssh-7.4p1-22.el7_9.x86_64
rpm -e --nodeps openssh-clients-7.4p1-22.el7_9.x86_64
rpm -qa | grep openssh  # 确保删除干净
1
2
3
4
5

5.安装openssh

cd /opt/openssh-9.1p1
./configure --prefix=/usr/local/openssh --with-zlib=/usr/local/zlib --with-ssl-dir=/usr/local/ssl
make && make install
1
2
3

6.sshd_config文件修改

echo 'PermitRootLogin yes' >>/usr/local/openssh/etc/sshd_config
echo 'PermitEmptyLogin no' >>/usr/local/openssh/etc/sshd_config
echo 'PubkeyAuthentication yes' >>/usr/local/openssh/etc/sshd_config
echo 'PasswordAuthentication yes' >>/usr/local/openssh/etc/sshd_config
1
2
3
4

备份原有sshd_config文件，并将新的配置复制到指定目录
由于/etc/ssh/已经备份，我这里直接覆盖

cp /usr/local/openssh/etc/sshd_config /etc/ssh/sshd_config
cp /usr/local/openssh/sbin/sshd /usr/sbin/sshd
cp /usr/local/openssh/bin/ssh /usr/bin/ssh
cp /usr/local/openssh/bin/ssh-keygen /usr/bin/ssh-keygen
 
mv /etc/ssh/ssh_host_ecdsa_key.pub /etc/ssh/ssh_host_ecdsa_key.pub.bak
cp /usr/local/openssh/etc/ssh_host_ecdsa_key.pub /etc/ssh/ssh_host_ecdsa_key.pub

cp -p contrib/redhat/sshd.init /etc/init.d/sshd
chmod +x /etc/init.d/sshd  # ssh服务必须开机自启动，因此要进行一些设置
chkconfig --add sshd
chkconfig sshd on
systemctl restart sshd  # 重启sshd服务
systemctl status sshd # 查看sshd服务状态
ssh -V  # 验证ssh版本
reboot  # 重启服务器，测试ssh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

重启也能完成登录，且OpenSSL和OpenSSH均已升级
完成！