红帽系列离线升级 OpenSSH

声明此文档只应用于CentOS 6.x、CentOS 7.x及RedHat 6.x、RedHat 7.x 其它操作系统升级OpenSSh请自行测试。升级失败可能会导致业务受到影响影响范围请根据业务自行评估。已知受到的影响有: scpsftpssh等注意升级版本之前请保证telnet或vnc开启并保持端口常开如有防火墙配置请自行放行telnet及vnc端口升级前确定telnet及vnc服务可以正常使用1.安装包准备名称版本zlib1.3.2OpenSSL1.1.1wOpenSSH10.4p12.安装必要的依赖包[rootlocalhost ~]# yum -y install wget gcc make perl pam-devel libselinux-develOpenSSH下载地址OpenSSHOpenSSL下载地址OpenSSLZlib下载地址Zlib上传 zlib、OpenSSL、OpenSSH 至 /opt 目录下3.安装 zlib 1.3.2[rootlocalhost ~]# cd /opt[rootlocalhost opt]# tar -xf zlib-1.3.2.tar.gz[rootlocalhost opt]# cd zlib-1.3.2[rootlocalhost zlib-1.3.2]# ./configure --prefix/usr/local/zlib --libdir/lib64[rootlocalhost zlib-1.3.2]# make -j cat /proc/cpuinfo|grep processor|wc -l[rootlocalhost zlib-1.3.2]# make install4.安装 OpenSSL 1.1.1.w[rootlocalhost ~]# cd /opt/[rootlocalhost opt]# tar -xf openssl-1.1.1w.tar.gz[rootlocalhost opt]# cd openssl-1.1.1w/[rootlocalhost openssl-1.1.1w]# ./config --prefix/usr/local/openssl shared zlib \--with-zlib-lib/usr/local/zlib/lib\--with-zlib-include/usr/local/zlib/include[rootlocalhost openssl-1.1.1w]# make -j cat /proc/cpuinfo|grep processor|wc -l[rootlocalhost openssl-1.1.1w]# make install[rootlocalhost openssl-1.1.1w]# mv -f /usr/bin/openssl /usr/bin/openssl.bak[rootlocalhost openssl-1.1.1w]# ln -s /usr/local/openssl/bin/openssl /usr/bin/openssl[rootlocalhost openssl-1.1.1w]# mv -f /usr/lib64/libssl.so.1.1 /usr/lib64/libssl.so.1.1.bak[rootlocalhost openssl-1.1.1w]# ln -s /usr/local/openssl/lib/libssl.so.1.1 /usr/lib64/libssl.so.1.1[rootlocalhost openssl-1.1.1w]# mv -f /usr/lib64/libcrypto.so.1.1 /usr/lib64/libcrypto.so.1.1.bak[rootlocalhost openssl-1.1.1q]# ln -s /usr/local/openssl/lib/libcrypto.so.1.1 /usr/lib64/libcrypto.so.1.1[rootlocalhost openssl-1.1.1q]# vim /etc/ld.so.conf[rootlocalhost openssl-1.1.1q]# cat /etc/ld.so.confinclude ld.so.conf.d/*.conf /usr/local/openssl/lib[rootlocalhost openssl-1.1.1q]# ldconfig[rootlocalhost openssl-1.1.1q]# openssl version5.安装 OpenSSH 10.4p1[rootlocalhost ~]# rpm -qa |grep openssh |xargs rpm -e --nodeps[rootlocalhost ~]# mv /usr/bin/ssh /usr/bin/ssh.bak[rootlocalhost ~]# mv /usr/sbin/sshd /usr/sbin/sshd.bak[rootlocalhost ~]# mv /etc/ssh/ /etc/ssh.bak[rootlocalhost ~]# cd /opt/[rootlocalhost opt]# tar -zxvf openssh-10.3p1.tar.gz[rootlocalhost opt]# cd openssh-10.3p1[rootlocalhost openssh-10.4p1]# ./configure --prefix/usr/local/openssh \--sysconfdir/etc/ssh\--with-ssl-dir/usr/local/openssl\--with-zlib/usr/local/zlib\--with-pam\--with-md5-passwords\--without-hardening\--with-ldflags[rootlocalhost openssh-10.4p1]# make -j cat /proc/cpuinfo|grep processor|wc -l[rootlocalhost openssh-10.4p1]# make isntall[rootlocalhost openssh-10.4p1]# ln -s /usr/local/openssh/sbin/sshd /usr/sbin/sshd[rootlocalhost openssh-10.4p1]# ln -s /usr/local/openssh/bin/ssh /usr/bin/ssh[rootlocalhost openssh-10.4p1]# rm -rf /usr/bin/scp[rootlocalhost openssh-10.4p1]# ln -s /usr/local/openssh/bin/scp /usr/bin/scp[rootlocalhost openssh-10.4p1]# rm -rf /usr/bin/ssh-keygen /usr/bin/ssh-keygen[rootlocalhost openssh-10.4p1]# ln -s /usr/local/openssh/bin/ssh-keygen /usr/bin/ssh-keygen[rootlocalhost openssh-10.4p1]# rm -rf /etc/init.d/sshd[rootlocalhost openssh-10.4p1]# rm -rf /usr/lib/system/system/sshd.servece[rootlocalhost openssh-10.4p1]# cat EOF /etc/systemd/system/sshd.service[Unit]DescriptionOpenSSH server daemonDocumentationman:sshd(8)man:sshd_config(5)Afternetwork.target sshd-keygen.serviceWantssshd-keygen.service[Service]TypenotifyEnvironmentFile-/etc/sysconfig/sshdExecStart/usr/local/openssh/sbin/sshd-D$OPTIONSExecReload/bin/kill-HUP$MAINPIDKillModeprocessRestarton-failureRestartSec42s[Install]WantedBymulti-user.target EOF[rootlocalhost openssh-10.4p1]# systemctl daemon-reload[rootlocalhost openssh-10.4p1]# systemctl restart sshd[rootlocalhost openssh-10.4p1]# systemctl enable sshd[rootlocalhost openssh-10.4p1]#sed -i $aCiphers aes128-cbc,aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr,3des-cbc\nMACs hmac-md5,hmac-sha1,umac-64openssh.com,hmac-sha1-96,hmac-md5-96\nKexAlgorithms diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,curve25519-sha256libssh.org /etc/ssh/sshd_config[rootlocalhost openssh-10.4p1]# sed -i /PermitRootLogin/s/^#//g /etc/ssh/sshd_config[rootlocalhost openssh-10.4p1]# sed -i s/^PermitRootLogin.*/PermitRootLogin yes/ /etc/ssh/sshd_config[rootlocalhost openssh-10.4p1]# sed -i s/^#\?Port .*/Port 10022/ /etc/ssh/sshd_config[rootlocalhost openssh-10.4p1]# chmod 400 /etc/ssh/ssh_*_key[rootlocalhost openssh-10.4p1]# ssh -V