CentOS的Ssh漏洞修复

官方网站下载最新版
http://www.zlib.net/
https://www.openssl.org/source/
http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/

CentOS

• 查看版本

openssl version

ssh -V
sshd -V

cat /etc/os-release

• 升级zlib

cd ./zlib-1.3
./configure --prefix=/usr/local/zlib
make && make install
echo '/usr/local/zlib/lib' >> /etc/ld.so.conf  
ldconfig -v
yum -y install gcc
yum -y install gcc-c++

升级openssl

cd openssl-1.1.1w
./config --prefix=/usr/local/ssl -d shared
make
make install   
echo '/usr/local/ssl/lib' >> /etc/ld.so.conf
ldconfig -v

• 升级openSSH

cd openssh-9.5p1
./configure --prefix=/usr/local/openssh --with-zlib=/usr/local/zlib --with-ssl-dir=/usr/local/ssl --without-openssl-header-check
make
make install

• 配置ssh

echo 'PermitRootLogin yes' >>/usr/local/openssh/etc/sshd_config
echo 'PubkeyAuthentication yes' >>/usr/local/openssh/etc/sshd_config
echo 'PasswordAuthentication yes' >>/usr/local/openssh/etc/sshd_config
mv -f /etc/ssh/sshd_config /etc/ssh/sshd_config.bak
cp -f /usr/local/openssh/etc/sshd_config /etc/ssh/sshd_config
mv -f /usr/sbin/sshd /usr/sbin/sshd.bak
cp -f  /usr/local/openssh/sbin/sshd /usr/sbin/sshd
mv -f /usr/bin/ssh /usr/bin/ssh.bak
cp -f  /usr/local/openssh/bin/ssh /usr/bin/ssh
mv -f /usr/bin/ssh-keygen /usr/bin/ssh-keygen.bak
cp -f /usr/local/openssh/bin/ssh-keygen /usr/bin/ssh-keygen
mv -f /etc/ssh/ssh_host_ecdsa_key.pub /etc/ssh/ssh_host_ecdsa_key.pub.bak
cp -f /usr/local/openssh/etc/ssh_host_ecdsa_key.pub /etc/ssh/ssh_host_ecdsa_key.pub
cp -f contrib/redhat/sshd.init /etc/init.d/sshd
chmod +x /etc/init.d/sshd
chkconfig --add sshd
chkconfig sshd on
chmod 600 /etc/ssh/ssh_host_rsa_key
chmod 600 /etc/ssh/ssh_host_ecdsa_key
chown -R root.root /var/empty/sshd
chmod 744 /var/empty/sshd
rm -f /usr/lib/systemd/system/sshd.service
systemctl enable sshd
systemctl restart sshd  && systemctl status sshd -l && ssh -V