环境介绍node
centos7.3和centos7.6升级完毕测试登陆ssh以及重启后登陆ssh均无问题。linux
前期请自行配置好yum源(若是不会请百度)c++
整个过程不须要卸载原先的openssl包和openssh的rpm包。不影响咱们的操做vim
本文的环境都是系统自带的openssh,没有经历过手动编译安装方式。若是以前有手动编译安装过openssh,请参照本文自行测试是否能成功。centos
若是严格参照本文操做,我保证你升级没问题api
centos7.6升级后的效果数组
[root@testssh ~]# ssh -V OpenSSH_8.0p1, OpenSSL 1.0.2r 26 Feb 2019 [root@testssh ~]# openssl version OpenSSL 1.0.2r 26 Feb 2019 [root@testssh ~]# cat /etc/redhat-release CentOS Linux release 7.6.1810 (Core) [root@testssh ~]#
centos7.3升级后的效果bash
[root@linux-node3 ~]# openssl version OpenSSL 1.0.2r 26 Feb 2019 [root@linux-node3 ~]# ssh -V OpenSSH_8.0p1, OpenSSL 1.0.2r 26 Feb 2019 [root@linux-node3 ~]# cat /etc/redhat-release CentOS Linux release 7.3.1611 (Core) [root@linux-node3 ~]#
若是ssh版本太低,最好先yum update openssh升级下到目前yum仓库默认的openssh7.4p1版本session
默认centos7.3的ssh是以下版本app
[root@linux-node3 ~]# cat /etc/redhat-release CentOS Linux release 7.3.1611 (Core) [root@linux-node3 ~]# ssh -V OpenSSH_6.6.1p1, OpenSSL 1.0.1e-fips 11 Feb 2013 [root@linux-node3 ~]#
执行yum update openssh先升级下(反正官方提供的这种升级是没问题的。若是以前手动编译操做过openssh的升级,变动了默认配置文件路径什么的请自行测试。)
(这里准备统一openssh版本为7.4p1以后再统一编译安装升级到openssh8.0p1)
[root@linux-node3 ~]# yum update openssh -y [root@linux-node3 ~]# ssh -V OpenSSH_7.4p1, OpenSSL 1.0.2k-fips 26 Jan 2017 [root@linux-node3 ~]#
安装telnet-server以及xinetd
[root@linux-node3 ~]# yum install xinetd telnet-server -y Loaded plugins: fastestmirror Loading mirror speeds from cached hostfile * base: mirrors.163.com * epel: mirrors.aliyun.com * extras: mirrors.cn99.com * updates: mirrors.cn99.com Package 2:xinetd-2.3.15-13.el7.x86_64 already installed and latest version Package 1:telnet-server-0.17-64.el7.x86_64 already installed and latest version Nothing to do [root@linux-node3 ~]#
配置telnet
如今不少centos7版本安装telnet-server以及xinetd以后没有一个叫telnet的配置文件了。
若是下面telnet文件不存在的话,能够跳过这部分的更改
[root@linux-node3 ~]# ll /etc/xinetd.d/telnet ls: cannot access /etc/xinetd.d/telnet: No such file or directory
若是下面文件存在,请更改配置telnet能够root登陆,把disable = no改为disable = yes
[root@rhel yum.repos.d]# cat /etc/xinetd.d/telnet # default: on # description: The telnet server serves telnet sessions; it uses \ # unencrypted username/password pairs for authentication. service telnet { disable = no flags = REUSE socket_type = stream wait = no user = root server = /usr/sbin/in.telnetd log_on_failure += USERID } [root@rhel yum.repos.d]# vim /etc/xinetd.d/telnet [root@rhel yum.repos.d]# cat /etc/xinetd.d/telnet # default: on # description: The telnet server serves telnet sessions; it uses \ # unencrypted username/password pairs for authentication. service telnet { disable = yes flags = REUSE socket_type = stream wait = no user = root server = /usr/sbin/in.telnetd log_on_failure += USERID }
配置telnet登陆的终端类型,在/etc/securetty文件末尾增长一些pts终端,以下
pts/0 pts/1 pts/2 pts/3
配置以后的显示
[root@linux-node3 ~]# vim /etc/securetty [root@linux-node3 ~]# tail -5 /etc/securetty xvc0 pts/0 pts/1 pts/2 pts/3 [root@linux-node3 ~]#
启动telnet服务,并设置开机自动启动
[root@linux-node3 ~]# systemctl enable xinetd [root@linux-node3 ~]# systemctl enable telnet.socket Created symlink from /etc/systemd/system/sockets.target.wants/telnet.socket to /usr/lib/systemd/system/telnet.socket. [root@linux-node3 ~]# [root@linux-node3 ~]# systemctl start telnet.socket [root@linux-node3 ~]# systemctl start xinetd [root@linux-node3 ~]# netstat -lntp|grep 23 tcp6 0 0 :::23 :::* LISTEN 1/systemd [root@linux-node3 ~]#
切换到telnet方式登陆,之后的操做都在telnet终端下操做,防止ssh链接意外中断形成升级失败
telnet方式登陆
安装依赖包
升级须要几个组件,有些是和编译相关的等
[root@linux-node3 ~]# yum install -y gcc gcc-c++ glibc make autoconf openssl openssl-devel pcre-devel pam-devel Loaded plugins: fastestmirror Loading mirror speeds from cached hostfile * base: mirrors.163.com * epel: mirrors.aliyun.com * extras: mirrors.cn99.com * updates: mirrors.cn99.com Package gcc-4.8.5-36.el7_6.1.x86_64 already installed and latest version Package gcc-c++-4.8.5-36.el7_6.1.x86_64 already installed and latest version Package glibc-2.17-260.el7_6.4.x86_64 already installed and latest version Package 1:make-3.82-23.el7.x86_64 already installed and latest version Package autoconf-2.69-11.el7.noarch already installed and latest version Package 1:openssl-1.0.2k-16.el7_6.1.x86_64 already installed and latest version Package 1:openssl-devel-1.0.2k-16.el7_6.1.x86_64 already installed and latest version Package pcre-devel-8.32-17.el7.x86_64 already installed and latest version Package pam-devel-1.1.8-22.el7.x86_64 already installed and latest version Nothing to do [root@linux-node3 ~]#
安装pam和zlib等(后面的升级操做可能没用到pam,安装上也没啥影响,若是不想安装pam请自行测试)
[root@linux-node3 ~]# yum install -y pam* zlib* Loaded plugins: fastestmirror Loading mirror speeds from cached hostfile * base: mirrors.163.com * epel: mirrors.aliyun.com * extras: mirrors.cn99.com * updates: mirrors.cn99.com Package pam_yubico-2.26-1.el7.x86_64 already installed and latest version Package pam_script-1.1.8-1.el7.x86_64 already installed and latest version Package pam_oath-2.4.1-9.el7.x86_64 already installed and latest version Package pam_snapper-0.2.8-4.el7.x86_64 already installed and latest version Package pam_ssh_agent_auth-0.10.3-2.16.el7.x86_64 already installed and latest version Package pam_2fa-1.0-1.el7.x86_64 already installed and latest version Package pam_mapi-0.3.4-1.el7.x86_64 already installed and latest version Package pam_ssh_user_auth-1.0-1.el7.x86_64 already installed and latest version Package pam_mount-2.16-5.el7.x86_64 already installed and latest version Package pam_radius-1.4.0-3.el7.x86_64 already installed and latest version Package pamtester-0.1.2-4.el7.x86_64 already installed and latest version Package pam_afs_session-2.6-5.el7.x86_64 already installed and latest version Package pam_pkcs11-0.6.2-30.el7.x86_64 already installed and latest version Package pam-1.1.8-22.el7.x86_64 already installed and latest version Package pam_ssh-2.3-1.el7.x86_64 already installed and latest version Package 1:pam_url-0.3.3-4.el7.x86_64 already installed and latest version Package pam_wrapper-1.0.7-2.el7.x86_64 already installed and latest version Package pam-kwallet-5.5.2-1.el7.x86_64 already installed and latest version Package pam-devel-1.1.8-22.el7.x86_64 already installed and latest version Package pam_krb5-2.4.8-6.el7.x86_64 already installed and latest version Package zlib-devel-1.2.7-18.el7.x86_64 already installed and latest version Package zlib-static-1.2.7-18.el7.x86_64 already installed and latest version Package zlib-1.2.7-18.el7.x86_64 already installed and latest version Package zlib-ada-1.4-0.5.20120830CVS.el7.x86_64 already installed and latest version Package zlib-ada-devel-1.4-0.5.20120830CVS.el7.x86_64 already installed and latest version Nothing to do [root@linux-node3 ~]#
下载openssh包和openssl的包
咱们都下载最新版本,下载箭头指的包
https://openbsd.hk/pub/OpenBSD/OpenSSH/portable/
https://ftp.openssl.org/source/
开始安装openssl
我的习惯把安装包或者工具之类的放下面目录。根据我的喜爱随便放,不影响安装
[root@linux-node3 ~]# mkdir /data/tools -p [root@linux-node3 ~]# cd /data/tools/ [root@linux-node3 /data/tools]# rz -E rz waiting to receive. [root@linux-node3 /data/tools]# ll total 5224 -rw-r--r-- 1 root root 5348369 Apr 27 12:19 openssl-1.0.2r.tar.gz 解压文件 [root@linux-node3 /data/tools]# tar xfz openssl-1.0.2r.tar.gz [root@linux-node3 /data/tools]# ll total 5228 drwxr-xr-x 20 root root 4096 Apr 27 12:20 openssl-1.0.2r -rw-r--r-- 1 root root 5348369 Apr 27 12:19 openssl-1.0.2r.tar.gz [root@linux-node3 /data/tools]# cd [root@linux-node3 ~]# 如今是系统默认的版本,等会升级完毕对比下 [root@linux-node3 ~]# openssl version OpenSSL 1.0.2k-fips 26 Jan 2017 [root@linux-node3 ~]#
备份下面2个文件或目录(若是存在的话就执行)
[root@linux-node3 ~]# ll /usr/bin/openssl -rwxr-xr-x 1 root root 555248 Mar 12 18:12 /usr/bin/openssl [root@linux-node3 ~]# mv /usr/bin/openssl /usr/bin/openssl_bak [root@linux-node3 ~]# ll /usr/include/openssl total 1864 -rw-r--r-- 1 root root 6146 Mar 12 18:12 aes.h -rw-r--r-- 1 root root 63204 Mar 12 18:12 asn1.h -rw-r--r-- 1 root root 24435 Mar 12 18:12 asn1_mac.h -rw-r--r-- 1 root root 34475 Mar 12 18:12 asn1t.h -rw-r--r-- 1 root root 38742 Mar 12 18:12 bio.h -rw-r--r-- 1 root root 5351 Mar 12 18:12 blowfish.h ...... [root@linux-node3 ~]# mv /usr/include/openssl /usr/include/openssl_bak [root@linux-node3 ~]#
编译安装新版本的openssl
配置、编译、安装3个命令一块儿执行
&&符号表示前面的执行成功才会执行后面的
[root@linux-node3 ~]# cd /data/tools/openssl-1.0.2r/ [root@linux-node3 /data/tools/openssl-1.0.2r]# ./config shared && make && make install
以上命令执行完毕,echo $?查看下最后的make install是否有报错,0表示没有问题
下面2个文件或者目录作软连接 (刚才前面的步骤mv备份过原来的)
[root@linux-node3 ~]# ln -s /usr/local/ssl/bin/openssl /usr/bin/openssl [root@linux-node3 ~]# ln -s /usr/local/ssl/include/openssl /usr/include/openssl [root@linux-node3 ~]# ll /usr/bin/openssl lrwxrwxrwx 1 root root 26 Apr 27 12:31 /usr/bin/openssl -> /usr/local/ssl/bin/openssl [root@linux-node3 ~]# ll /usr/include/openssl -ld lrwxrwxrwx 1 root root 30 Apr 27 12:31 /usr/include/openssl -> /usr/local/ssl/include/openssl [root@linux-node3 ~]#
命令行执行下面2个命令加载新配置
echo "/usr/local/ssl/lib" >> /etc/ld.so.conf /sbin/ldconfig
查看确认版本。没问题
[root@testssh ~]# openssl version OpenSSL 1.0.2r 26 Feb 2019
安装openssh
上传openssh的tar包并解压
[root@testssh ~]# cd /data/tools/ [root@testssh tools]# ll total 7628 -rw-r--r-- 1 root root 1597697 Apr 18 07:02 openssh-8.0p1.tar.gz drwxr-xr-x 20 root root 4096 Apr 23 23:12 openssl-1.0.2r -rw-r--r-- 1 root root 5348369 Feb 26 22:34 openssl-1.0.2r.tar.gz -rwxr-xr-x 1 root root 853040 Apr 11 2018 sshd [root@testssh tools]# tar xfz openssh-8.0p1.tar.gz [root@testssh tools]# cd openssh-8.0p1 可能文件默认显示uid和gid数组都是1000,这里从新受权下。不受权可能也不影响安装(请自行测试) [root@testssh tools]# chown -R root.root /data/tools/openssh-8.0p1
命令行删除原先ssh的配置文件和目录
而后配置、编译、安装
注意下面编译安装的命令是一行,请把第一行末尾的 \ 去掉,而后在文本里弄成一行以后放命令行执行
rm -rf /etc/ssh/* ./configure --prefix=/usr/ --sysconfdir=/etc/ssh --with-openssl-includes=/usr/local/ssl/include \ --with-ssl-dir=/usr/local/ssl --with-zlib --with-md5-passwords --with-pam && make && make install
参考下个人截图
安装完毕 检查下结果
修改配置文件最终为以下内容,其余的不要动
[root@linux-node3 ~]# grep "^PermitRootLogin" /etc/ssh/sshd_config PermitRootLogin yes [root@linux-node3 ~]# grep "UseDNS" /etc/ssh/sshd_config UseDNS no [root@linux-node3 ~]#
从原先的解压的包中拷贝一些文件到目标位置(若是目标目录存在就覆盖)
(可能下面的ssh.pam文件都没用到,由于sshd_config配置文件貌似没使用它,请自行测试。我这边是拷贝了)
[root@linux-node3 /data/tools/openssh-8.0p1]# cp -a contrib/redhat/sshd.init /etc/init.d/sshd [root@linux-node3 /data/tools/openssh-8.0p1]# cp -a contrib/redhat/sshd.pam /etc/pam.d/sshd.pam [root@linux-node3 /data/tools/openssh-8.0p1]# chmod +x /etc/init.d/sshd [root@linux-node3 /data/tools/openssh-8.0p1]# chkconfig --add sshd [root@linux-node3 /data/tools/openssh-8.0p1]# systemctl enable sshd [root@linux-node3 /data/tools/openssh-8.0p1]#
把原先的systemd管理的sshd文件删除或者移走或者删除,不移走的话影响咱们重启sshd服务
[root@linux-node3 ~]# mv /usr/lib/systemd/system/sshd.service /data/
设置sshd服务开机启动
[root@linux-node3 ~]# chkconfig sshd on Note: Forwarding request to 'systemctl enable sshd.socket'. Created symlink from /etc/systemd/system/sockets.target.wants/sshd.socket to /usr/lib/systemd/system/sshd.socket.
接下来测试启停服务。都正常
之后管理sshd经过下面方式了 [root@linux-node3 ~]# /etc/init.d/sshd restart Restarting sshd (via systemctl): [ OK ] [root@linux-node3 ~]# [root@linux-node3 ~]# [root@linux-node3 ~]# netstat -lntp Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 31800/sshd tcp6 0 0 :::22 :::* LISTEN 31800/sshd tcp6 0 0 :::23 :::* LISTEN 1/systemd [root@linux-node3 ~]# /etc/init.d/sshd stop Stopping sshd (via systemctl): [ OK ] [root@linux-node3 ~]# netstat -lntp Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp6 0 0 :::23 :::* LISTEN 1/systemd [root@linux-node3 ~]# /etc/init.d/sshd start Starting sshd (via systemctl): [ OK ] [root@linux-node3 ~]# [root@linux-node3 ~]#
使用systemd方式也行
[root@linux-node3 ~]# systemctl stop sshd [root@linux-node3 ~]# netstat -lntp Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp6 0 0 :::23 :::* LISTEN 1/systemd [root@linux-node3 ~]# systemctl start sshd [root@linux-node3 ~]# netstat -lntp Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 31958/sshd tcp6 0 0 :::22 :::* LISTEN 31958/sshd tcp6 0 0 :::23 :::* LISTEN 1/systemd [root@linux-node3 ~]# systemctl restart sshd [root@linux-node3 ~]# netstat -lntp Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 31999/sshd tcp6 0 0 :::22 :::* LISTEN 31999/sshd tcp6 0 0 :::23 :::* LISTEN 1/systemd [root@linux-node3 ~]#
测试版本。都正常
[root@linux-node3 ~]# ssh -V OpenSSH_8.0p1, OpenSSL 1.0.2r 26 Feb 2019 [root@linux-node3 ~]# [root@linux-node3 ~]# telnet 127.0.0.1 22 Trying 127.0.0.1... Connected to 127.0.0.1. Escape character is '^]'. SSH-2.0-OpenSSH_8.0
若是不是生产机器。能够试着重启机器测试下登陆sshd是否正常。我这边测试都没问题
测试没问题后能够把telnet服务关闭了
[root@linux-node3 ~]# systemctl disable xinetd.service Removed symlink /etc/systemd/system/multi-user.target.wants/xinetd.service. [root@linux-node3 ~]# systemctl stop xinetd.service [root@linux-node3 ~]# systemctl disable telnet.socket [root@linux-node3 ~]# systemctl stop telnet.socket [root@linux-node3 ~]# netstat -lntp
下面有一个神奇的二维码,扫一下您可能失去2元钱!