CentOS7 升级 openssh 到 openssh-8.0p1版本

时间  2019-11-17 标签 centos7 centos 7 升级 openssh openssh 8.0p1 8 0 p 1 版本

centos7.3和centos7.6升级完毕测试登陆ssh以及重启后登陆ssh均无问题。html

前期请自行配置好yum源（若是不会请百度）node

整个过程不须要卸载原先的openssl包和openssh的rpm包。不影响咱们的操做linux

本文的环境都是系统自带的openssh，没有经历过手动编译安装方式。若是以前有手动编译安装过openssh，请参照本文自行测试是否能成功。c++

若是严格参照本文操做，我保证你升级没问题vim

 

centos7.6升级后的效果centos

1
2
3
4
5
6
7
8
[root@testssh ~] # ssh -V
OpenSSH_8.0p1, OpenSSL 1.0.2r  26 Feb 2019
[root@testssh ~] # openssl version
OpenSSL 1.0.2r  26 Feb 2019
 
[root@testssh ~] # cat /etc/redhat-release
CentOS Linux release 7.6.1810 (Core)
[root@testssh ~] #

　　

centos7.3升级后的效果api

1
2
3
4
5
6
7
[root@linux-node3 ~] # openssl version
OpenSSL 1.0.2r  26 Feb 2019
[root@linux-node3 ~] # ssh -V
OpenSSH_8.0p1, OpenSSL 1.0.2r  26 Feb 2019
[root@linux-node3 ~] # cat /etc/redhat-release
CentOS Linux release 7.3.1611 (Core)
[root@linux-node3 ~] #

　　

若是ssh版本太低，最好先yum update openssh升级下到目前yum仓库默认的openssh7.4p1版本数组

默认centos7.3的ssh是以下版本bash

1
2
3
4
5
[root@linux-node3 ~] # cat /etc/redhat-release
CentOS Linux release 7.3.1611 (Core)
[root@linux-node3 ~] # ssh -V
OpenSSH_6.6.1p1, OpenSSL 1.0.1e-fips 11 Feb 2013
[root@linux-node3 ~] #

　　

执行yum update  openssh先升级下（反正官方提供的这种升级是没问题的。若是以前手动编译操做过openssh的升级，变动了默认配置文件路径什么的请自行测试。）session

（这里准备统一openssh版本为7.4p1以后再统一编译安装升级到openssh8.0p1）

1
2
3
4
5
[root@linux-node3 ~] # yum update openssh -y
 
[root@linux-node3 ~] # ssh -V
OpenSSH_7.4p1, OpenSSL 1.0.2k-fips  26 Jan 2017
[root@linux-node3 ~] #

　

安装telnet-server以及xinetd

1
2
3
4
5
6
7
8
9
10
11
[root@linux-node3 ~] # yum install xinetd telnet-server -y
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
  * base: mirrors.163.com
  * epel: mirrors.aliyun.com
  * extras: mirrors.cn99.com
  * updates: mirrors.cn99.com
Package 2:xinetd-2.3.15-13.el7.x86_64 already installed and latest version
Package 1:telnet-server-0.17-64.el7.x86_64 already installed and latest version
Nothing to  do
[root@linux-node3 ~] #

　　

 

配置telnet

 

如今不少centos7版本安装telnet-server以及xinetd以后没有一个叫telnet的配置文件了。

若是下面telnet文件不存在的话，能够跳过这部分的更改

1
2
[root@linux-node3 ~] # ll /etc/xinetd.d/telnet
ls : cannot access  /etc/xinetd .d /telnet : No such  file  or directory

　　

若是下面文件存在，请更改配置telnet能够root登陆，把disable = yes改为disable = no

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
[root@rhel yum.repos.d] # cat /etc/xinetd.d/telnet
# default: on
# description: The telnet server serves telnet sessions; it uses \
#   unencrypted username/password pairs for authentication.
service telnet
{
     disable = no
     flags       = REUSE
     socket_type = stream       
     wait        = no
     user        = root
     server      =  /usr/sbin/in .telnetd
     log_on_failure  += USERID
}
 
[root@rhel yum.repos.d] # vim /etc/xinetd.d/telnet
[root@rhel yum.repos.d] # cat /etc/xinetd.d/telnet
# default: on
# description: The telnet server serves telnet sessions; it uses \
#   unencrypted username/password pairs for authentication.
service telnet
{
     disable =  yes
     flags       = REUSE
     socket_type = stream       
     wait        = no
     user        = root
     server      =  /usr/sbin/in .telnetd
     log_on_failure  += USERID
}

　　

配置telnet登陆的终端类型，在/etc/securetty文件末尾增长一些pts终端，以下

1
2
3
4
pts /0
pts /1
pts /2
pts /3

 

配置以后的显示

1
2
3
4
5
6
7
8
[root@linux-node3 ~] # vim /etc/securetty
[root@linux-node3 ~] # tail -5 /etc/securetty
xvc0
pts /0
pts /1
pts /2
pts /3
[root@linux-node3 ~] #

　　

启动telnet服务，并设置开机自动启动

1
2
3
4
5
6
7
8
9
10
11
[root@linux-node3 ~] # systemctl enable xinetd
  
[root@linux-node3 ~] # systemctl enable telnet.socket
Created  symlink  from  /etc/systemd/system/sockets .target.wants /telnet .socket to  /usr/lib/systemd/system/telnet .socket.
[root@linux-node3 ~] #
 
[root@linux-node3 ~] # systemctl start telnet.socket
[root@linux-node3 ~] # systemctl start xinetd
[root@linux-node3 ~] # netstat -lntp|grep 23
tcp6       0      0 :::23                   :::*                    LISTEN      1 /systemd          
[root@linux-node3 ~] #

　　

切换到telnet方式登陆，之后的操做都在telnet终端下操做，防止ssh链接意外中断形成升级失败

telnet方式登陆 

 

 安装依赖包

 

 升级须要几个组件，有些是和编译相关的等

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
[root@linux-node3 ~] # yum install  -y gcc gcc-c++ glibc make autoconf openssl openssl-devel pcre-devel  pam-devel
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
  * base: mirrors.163.com
  * epel: mirrors.aliyun.com
  * extras: mirrors.cn99.com
  * updates: mirrors.cn99.com
Package  gcc -4.8.5-36.el7_6.1.x86_64 already installed and latest version
Package  gcc -c++-4.8.5-36.el7_6.1.x86_64 already installed and latest version
Package glibc-2.17-260.el7_6.4.x86_64 already installed and latest version
Package 1: make -3.82-23.el7.x86_64 already installed and latest version
Package autoconf-2.69-11.el7.noarch already installed and latest version
Package 1:openssl-1.0.2k-16.el7_6.1.x86_64 already installed and latest version
Package 1:openssl-devel-1.0.2k-16.el7_6.1.x86_64 already installed and latest version
Package pcre-devel-8.32-17.el7.x86_64 already installed and latest version
Package pam-devel-1.1.8-22.el7.x86_64 already installed and latest version
Nothing to  do
[root@linux-node3 ~] #

　　

 安装pam和zlib等（后面的升级操做可能没用到pam，安装上也没啥影响，若是不想安装pam请自行测试）

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
[root@linux-node3 ~] # yum install  -y pam* zlib*
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
  * base: mirrors.163.com
  * epel: mirrors.aliyun.com
  * extras: mirrors.cn99.com
  * updates: mirrors.cn99.com
Package pam_yubico-2.26-1.el7.x86_64 already installed and latest version
Package pam_script-1.1.8-1.el7.x86_64 already installed and latest version
Package pam_oath-2.4.1-9.el7.x86_64 already installed and latest version
Package pam_snapper-0.2.8-4.el7.x86_64 already installed and latest version
Package pam_ssh_agent_auth-0.10.3-2.16.el7.x86_64 already installed and latest version
Package pam_2fa-1.0-1.el7.x86_64 already installed and latest version
Package pam_mapi-0.3.4-1.el7.x86_64 already installed and latest version
Package pam_ssh_user_auth-1.0-1.el7.x86_64 already installed and latest version
Package pam_mount-2.16-5.el7.x86_64 already installed and latest version
Package pam_radius-1.4.0-3.el7.x86_64 already installed and latest version
Package pamtester-0.1.2-4.el7.x86_64 already installed and latest version
Package pam_afs_session-2.6-5.el7.x86_64 already installed and latest version
Package pam_pkcs11-0.6.2-30.el7.x86_64 already installed and latest version
Package pam-1.1.8-22.el7.x86_64 already installed and latest version
Package pam_ssh-2.3-1.el7.x86_64 already installed and latest version
Package 1:pam_url-0.3.3-4.el7.x86_64 already installed and latest version
Package pam_wrapper-1.0.7-2.el7.x86_64 already installed and latest version
Package pam-kwallet-5.5.2-1.el7.x86_64 already installed and latest version
Package pam-devel-1.1.8-22.el7.x86_64 already installed and latest version
Package pam_krb5-2.4.8-6.el7.x86_64 already installed and latest version
Package zlib-devel-1.2.7-18.el7.x86_64 already installed and latest version
Package zlib-static-1.2.7-18.el7.x86_64 already installed and latest version
Package zlib-1.2.7-18.el7.x86_64 already installed and latest version
Package zlib-ada-1.4-0.5.20120830CVS.el7.x86_64 already installed and latest version
Package zlib-ada-devel-1.4-0.5.20120830CVS.el7.x86_64 already installed and latest version
Nothing to  do
[root@linux-node3 ~] #

　　

下载openssh包和openssl的包

 咱们都下载最新版本，下载箭头指的包

https://openbsd.hk/pub/OpenBSD/OpenSSH/portable/

 

 

https://ftp.openssl.org/source/

 

 

 

 

 

 开始安装openssl

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
[root@linux-node3 ~] # mkdir /data/tools -p
[root@linux-node3 ~] # cd /data/tools/
[root@linux-node3  /data/tools ] # rz -E
rz waiting to receive.
[root@linux-node3  /data/tools ] # ll
total 5224
-rw-r--r-- 1 root root 5348369 Apr 27 12:19 openssl-1.0.2r. tar .gz
 
 
 
解压文件
[root@linux-node3  /data/tools ] # tar xfz openssl-1.0.2r.tar.gz
[root@linux-node3  /data/tools ] # ll
total 5228
drwxr-xr-x 20 root root    4096 Apr 27 12:20 openssl-1.0.2r
-rw-r--r--  1 root root 5348369 Apr 27 12:19 openssl-1.0.2r. tar .gz
[root@linux-node3  /data/tools ] # cd
[root@linux-node3 ~] #
 
 
如今是系统默认的版本，等会升级完毕对比下
[root@linux-node3 ~] # openssl version
OpenSSL 1.0.2k-fips  26 Jan 2017
[root@linux-node3 ~] #

　　

　　

 备份下面2个文件或目录（若是存在的话就执行）

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
[root@linux-node3 ~] # ll /usr/bin/openssl
-rwxr-xr-x 1 root root 555248 Mar 12 18:12  /usr/bin/openssl
[root@linux-node3 ~] # mv /usr/bin/openssl /usr/bin/openssl_bak
 
[root@linux-node3 ~] # ll /usr/include/openssl
total 1864
-rw-r--r-- 1 root root   6146 Mar 12 18:12 aes.h
-rw-r--r-- 1 root root  63204 Mar 12 18:12 asn1.h
-rw-r--r-- 1 root root  24435 Mar 12 18:12 asn1_mac.h
-rw-r--r-- 1 root root  34475 Mar 12 18:12 asn1t.h
-rw-r--r-- 1 root root  38742 Mar 12 18:12 bio.h
-rw-r--r-- 1 root root   5351 Mar 12 18:12 blowfish.h
......
 
[root@linux-node3 ~] # mv /usr/include/openssl /usr/include/openssl_bak
[root@linux-node3 ~] #

　　

　　

编译安装新版本的openssl

配置、编译、安装3个命令一块儿执行

&&符号表示前面的执行成功才会执行后面的

1
2
3
[root@linux-node3 ~] # cd /data/tools/openssl-1.0.2r/
 
[root@linux-node3  /data/tools/openssl-1 .0.2r] # ./config shared && make && make install

　　

以上命令执行完毕，echo $?查看下最后的make install是否有报错，0表示没有问题

 

 

 下面2个文件或者目录作软连接 （刚才前面的步骤mv备份过原来的）

1
2
3
4
5
6
7
[root@linux-node3 ~] # ln -s /usr/local/ssl/bin/openssl /usr/bin/openssl
[root@linux-node3 ~] # ln -s /usr/local/ssl/include/openssl /usr/include/openssl
[root@linux-node3 ~] # ll /usr/bin/openssl
lrwxrwxrwx 1 root root 26 Apr 27 12:31  /usr/bin/openssl  ->  /usr/local/ssl/bin/openssl
[root@linux-node3 ~] # ll /usr/include/openssl -ld
lrwxrwxrwx 1 root root 30 Apr 27 12:31  /usr/include/openssl  ->  /usr/local/ssl/include/openssl
[root@linux-node3 ~] #

　　

命令行执行下面2个命令加载新配置

1
2
3
echo  "/usr/local/ssl/lib"  >>  /etc/ld .so.conf
 
/sbin/ldconfig

　　

 查看确认版本。没问题

1
2
[root@testssh ~] # openssl version
OpenSSL 1.0.2r  26 Feb 2019

　　

 

 安装openssh 

 

上传openssh的tar包并解压

1
2
3
4
5
6
7
8
9
10
11
12
13
[root@testssh ~] # cd /data/tools/
[root@testssh tools] # ll
total 7628
-rw-r--r--  1 root root 1597697 Apr 18 07:02 openssh-8.0p1. tar .gz
drwxr-xr-x 20 root root    4096 Apr 23 23:12 openssl-1.0.2r
-rw-r--r--  1 root root 5348369 Feb 26 22:34 openssl-1.0.2r. tar .gz
-rwxr-xr-x  1 root root  853040 Apr 11  2018 sshd
[root@testssh tools] # tar xfz openssh-8.0p1.tar.gz
[root@testssh tools] # cd openssh-8.0p1
 
 
可能文件默认显示uid和gid数组都是1000，这里从新受权下。不受权可能也不影响安装（请自行测试）
[root@testssh tools] # chown -R root.root /data/tools/openssh-8.0p1

　　

 

　　

 命令行删除原先ssh的配置文件和目录

而后配置、编译、安装

注意下面编译安装的命令是一行，请把第一行末尾的 \ 去掉，而后在文本里弄成一行以后放命令行执行

1
2
3
4
rm  -rf  /etc/ssh/ *
 
. /configure  --prefix= /usr/  --sysconfdir= /etc/ssh   --with-openssl-includes= /usr/local/ssl/include  \
  --with-ssl- dir = /usr/local/ssl    --with-zlib   --with-md5-passwords   --with-pam  &&  make  &&  make  install

　　

 

 参考下个人截图

 

 安装完毕 检查下结果

 

 修改配置文件最终为以下内容，其余的不要动

1
2
3
4
5
[root@linux-node3 ~] # grep "^PermitRootLogin"  /etc/ssh/sshd_config
PermitRootLogin  yes
[root@linux-node3 ~] # grep  "UseDNS"  /etc/ssh/sshd_config
UseDNS no
[root@linux-node3 ~] #

　　

 从原先的解压的包中拷贝一些文件到目标位置（若是目标目录存在就覆盖）

(可能下面的ssh.pam文件都没用到，由于sshd_config配置文件貌似没使用它，请自行测试。我这边是拷贝了)

1
2
3
4
5
6
7
[root@linux-node3  /data/tools/openssh-8 .0p1] # cp -a contrib/redhat/sshd.init /etc/init.d/sshd
[root@linux-node3  /data/tools/openssh-8 .0p1] # cp -a contrib/redhat/sshd.pam /etc/pam.d/sshd.pam
[root@linux-node3  /data/tools/openssh-8 .0p1] # chmod +x /etc/init.d/sshd
 
[root@linux-node3  /data/tools/openssh-8 .0p1] # chkconfig --add sshd
[root@linux-node3  /data/tools/openssh-8 .0p1] # systemctl enable sshd
[root@linux-node3  /data/tools/openssh-8 .0p1] #

　　

 把原先的systemd管理的sshd文件删除或者移走或者删除，不移走的话影响咱们重启sshd服务

 

1
2
[root@linux-node3 ~] # mv  /usr/lib/systemd/system/sshd.service  /data1
[root@linux-node3 ~] # mv  /usr/lib/systemd/system/sshd.socket  /data2

　　

设置sshd服务开机启动

1
2
3
[root@linux-node3 ~] # chkconfig sshd on
Note: Forwarding request to  'systemctl enable sshd.socket' .
Created  symlink  from  /etc/systemd/system/sockets .target.wants /sshd .socket to  /usr/lib/systemd/system/sshd .socket.

　　

 接下来测试启停服务。都正常

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
之后管理sshd经过下面方式了
[root@linux-node3 ~] # /etc/init.d/sshd restart
Restarting sshd (via systemctl):                           [  OK  ]
[root@linux-node3 ~] #
[root@linux-node3 ~] #
[root@linux-node3 ~] # netstat -lntp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID /Program  name   
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      31800 /sshd         
tcp6       0      0 :::22                   :::*                    LISTEN      31800 /sshd         
tcp6       0      0 :::23                   :::*                    LISTEN      1 /systemd          
[root@linux-node3 ~] # /etc/init.d/sshd stop
Stopping sshd (via systemctl):                             [  OK  ]
[root@linux-node3 ~] # netstat -lntp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID /Program  name   
tcp6       0      0 :::23                   :::*                    LISTEN      1 /systemd          
[root@linux-node3 ~] # /etc/init.d/sshd start
Starting sshd (via systemctl):                            [  OK  ]
[root@linux-node3 ~] #
[root@linux-node3 ~] #

　　

 使用systemd方式也行

 

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
[root@linux-node3 ~] # systemctl stop sshd
[root@linux-node3 ~] # netstat -lntp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID /Program  name   
tcp6       0      0 :::23                   :::*                    LISTEN      1 /systemd          
[root@linux-node3 ~] # systemctl start sshd
[root@linux-node3 ~] # netstat -lntp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID /Program  name   
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      31958 /sshd         
tcp6       0      0 :::22                   :::*                    LISTEN      31958 /sshd         
tcp6       0      0 :::23                   :::*                    LISTEN      1 /systemd          
[root@linux-node3 ~] # systemctl restart sshd
[root@linux-node3 ~] # netstat -lntp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID /Program  name   
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      31999 /sshd         
tcp6       0      0 :::22                   :::*                    LISTEN      31999 /sshd         
tcp6       0      0 :::23                   :::*                    LISTEN      1 /systemd          
[root@linux-node3 ~] #

　　

 测试版本。都正常

1
2
3
4
5
6
7
8
9
[root@linux-node3 ~] # ssh -V
OpenSSH_8.0p1, OpenSSL 1.0.2r  26 Feb 2019
[root@linux-node3 ~] #
 
[root@linux-node3 ~] # telnet 127.0.0.1 22
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is  '^]' .
SSH-2.0-OpenSSH_8.0

　　

 若是不是生产机器。能够试着重启机器测试下登陆sshd是否正常。我这边测试都没问题

测试没问题后能够把telnet服务关闭了

1
2
3
4
5
6
[root@linux-node3 ~] # systemctl disable xinetd.service
Removed  symlink  /etc/systemd/system/multi-user .target.wants /xinetd .service.
[root@linux-node3 ~] # systemctl stop xinetd.service
[root@linux-node3 ~] # systemctl disable telnet.socket
[root@linux-node3 ~] # systemctl stop telnet.socket
[root@linux-node3 ~] # netstat -lntp

注：转载请注明出处

本文转载至：https://www.cnblogs.com/nmap/p/10779658.html ，并对其中错误进行了更正。

联系我们 沪ICP备2021010478号-7