Centos7升级OpenSSH到OpenSSH_8.0p1版本

Centos7升级OpenSSH到OpenSSH_8.0p1版本

1、升级要求

升级至openssl 1.1.1版本
升级至openssh 8.0版本
ssh -V 当前查看版本

2、安装telnet （以防升级失败，连不上服务器，建议弄）

    4  2020-11-01 16:34:22 rpm -qa | grep telnet     
    5  2020-11-01 16:34:24 rpm -qa | grep xinetd   
    6  2020-11-01 16:34:34 yum -y install telnet* 
    7  2020-11-01 16:34:42 yum -y install xinetd   
    8  2020-11-01 16:34:56 systemctl enable xinetd.service
    9  2020-11-01 16:35:13 systemctl enable telnet.socket
   10  2020-11-01 16:35:24 systemctl enable telnet.sockesystemctl enable telnet.sockett
   11  2020-11-01 16:35:34 systemctl start telnet.socket  
   12  2020-11-01 16:35:47 systemctl start xinetd
   13  2020-11-01 16:36:02  vi /etc/securetty
   在最后添加两行 pts/0    pts/1
   14  2020-11-01 16:36:32 systemctl restart xinetd
   15  2020-11-01 16:36:42 netstat -plnt |grep 23 # 确认下是否启动成功

3、升级OpenSSl

cd /opt/
scp  root@62.234.150.127:/tmp/open* ./ #上传软件
[root@VM-39-10-centos ~]# cd /opt/
[root@VM-39-10-centos opt]# ls
mellanox  openssh-8.0p1  openssh-8.0p1.tar.gz  openssl-1.1.1c  openssl-1.1.1c.tar.gz  rh
[root@VM-39-10-centos opt]# 

tar zxvf openssl-1.1.1c.tar.gz
cd openssl-1.1.1c
./config --prefix=/usr/local/openssl  #检查环境
./config –t
make     #编译
make install      #编译安装

cd /usr/local
ldd /usr/local/openssl/bin/openssl    #检查函数库
echo "/usr/local/openssl/lib" >> /etc/ld.so.conf    #添加所缺函数库
ldconfig -v        #更新函数库
openssl/bin/openssl version      #查看新安装的版本
 
which openssl           #查看旧版本openssl命令在哪里
mv /bin/openssl /usr/bin/openssl.old      #将旧版本openssl移除
ln -s /usr/local/openssl/bin/openssl /usr/bin/openssl           #新版本制作软链接
openssl version         最后查看版本，更新完毕

[root@VM-39-10-centos opt]# openssl version  
OpenSSL 1.1.1c  28 May 2019
[root@VM-39-10-centos opt]#  #更新完毕

4、升级openssh

mv /etc/ssh /etc/ssh.old
### 需要注意，移除之后，不能退出当前终端，若退出，只能通过telnet连了
 cd /opt/
 tar -zxvf  openssh-8.0p1.tar.gz 
 cd openssh-8.0p1/
 yum install -y gcc gcc-c++ glibc make autoconf openssl openssl-devel pcre-devel pam-devel pam* zlib*
 ./configure --prefix=/usr/local/openssh --sysconfdir=/etc/ssh --with-pam --with-ssl-dir=/usr/local/openssl --with-md5-passwords --mandir=/usr/share/man --with-zlib=/usr/local/zlib --without-hardening
echo $?
make && make install 
echo $?
 s -l ./contrib/redhat/sshd.init

# 拷贝启动脚本
cp ./contrib/redhat/sshd.init /etc/init.d/sshd
# 修改启动脚本
vim /etc/init.d/sshd
# 按如下修改,需要注意，此路径是你安装新版本的openssh路径，根据你的实际情况修改
SSHD=/usr/local/openssh/sbin/sshd

### 注意根据自身情况修改路径
/usr/local/openssh/bin/ssh-keygen –A
/sbin/restorecon /etc/ssh/ssh_host_key.pub
/sbin/restorecon /etc/ssh/ssh_host_rsa_key.pub
/sbin/restorecon /etc/ssh/ssh_host_dsa_key.pub
/sbin/restorecon /etc/ssh/ssh_host_ecdsa_key.pub

[root@VM-39-10-centos openssh-8.0p1]# echo "PermitRootLogin yes" >> /etc/ssh/sshd_config
[root@VM-39-10-centos openssh-8.0p1]# echo 'X11Forwarding yes' >> /etc/ssh/sshd_config
[root@VM-39-10-centos openssh-8.0p1]# echo "PasswordAuthentication yes" >> /etc/ssh/sshd_config 
[root@VM-39-10-centos openssh-8.0p1]# for  i   in  $(rpm  -qa  |grep  openssh);do  rpm  -e  $i  --nodeps ;done
警告：/etc/ssh/moduli 已另存为 /etc/ssh/moduli.rpmsave
警告：/etc/ssh/ssh_config 已另存为 /etc/ssh/ssh_config.rpmsave
警告：/etc/ssh/sshd_config 已另存为 /etc/ssh/sshd_config.rpmsave
[root@VM-39-10-centos openssh-8.0p1]# mv /etc/ssh/sshd_config.rpmsave /etc/ssh/sshd_config
[root@VM-39-10-centos openssh-8.0p1]# 
[root@VM-39-10-centos openssh-8.0p1]# mv /etc/ssh/ssh_config.rpmsave /etc/ssh/ssh_config
[root@VM-39-10-centos openssh-8.0p1]# 
[root@VM-39-10-centos openssh-8.0p1]# mv /etc/ssh/moduli.rpmsave /etc/ssh/moduli
[root@VM-39-10-centos openssh-8.0p1]# cp -arp /usr/local/openssh/bin/* /usr/bin/
[root@VM-39-10-centos openssh-8.0p1]# service sshd restart
Restarting sshd (via systemctl):                           [  OK  ]
[root@VM-39-10-centos openssh-8.0p1]# ssh -V 
OpenSSH_8.0p1, OpenSSL 1.1.1c  28 May 2019
[root@VM-39-10-centos openssh-8.0p1]# chkconfig --add sshd
[root@VM-39-10-centos openssh-8.0p1]# chkconfig --level 2345 sshd on
[root@VM-39-10-centos openssh-8.0p1]# systemctl stop telnet.socket  
[root@VM-39-10-centos openssh-8.0p1]# ssh 49.232.141.113
The authenticity of host '49.232.141.113 (49.232.141.113)' can't be established.
ECDSA key fingerprint is SHA256:YURCHUWDH7YGwNetYX5iduAJhwC5DJclN/1akV2l9t0.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '49.232.141.113' (ECDSA) to the list of known hosts.
root@49.232.141.113's password: 
Last login: Sun Nov  1 16:33:34 2020 from 223.20.102.110
[root@VM-39-10-centos ~]#