openssh升级流程

1、先查看当前openssl和openssh版本

[root@VMServer ~]# cat /etc/redhat-release CentOS Linux release 7.7.1908 (Core) [root@VMServer ~]# openssl version OpenSSL 1.0.2k-fips 26 Jan 2017 [root@VMServer ~]# ssh -V OpenSSH_7.4p1, OpenSSL 1.0.2k-fips 26 Jan 2017 [root@VMServer ~]# rpm -qa | grep openss openssl098e-0.9.8e-29.el7.centos.3.x86_64 openssh-7.4p1-21.el7.x86_64 openssl-1.0.2k-19.el7.x86_64 openssh-server-7.4p1-21.el7.x86_64 openssh-clients-7.4p1-21.el7.x86_64 openssl-libs-1.0.2k-19.el7.x86_64 xmlsec1-openssl-1.2.20-7.el7_4.x86_64 

2、先升级openssl

mv openssl-1.1.1g.tar.gz /opt cd /opt #解压openssl-1.1.1g源码包 tar -zxvf openssl-1.1.1g.tar.gz cd openssl-1.1.1g/ #编译前环境配置 ./config --prefix=/usr/local/openssl ./config -t #make编译 make #make install编译安装 make install #检查函数库 ldd /usr/local/openssl/bin/openssl #添加所缺函数库 echo "/usr/local/openssl/lib" >>/etc/ld.so.conf #更新函数库 ldconfig -v #将旧版本openssl移除 mv /usr/bin/openssl /usr/bin/openssl_old_bak #将新版本openssl软链接到/usr/bin/目录下 ln -s /usr/local/openssl/bin/openssl /usr/bin/openssl #检查版本 which openssl openssl version -a #升级openssl后查看版本信息 

3、再升级openssh

#拷贝openssh-8.2p1.tar.gz的源码包到/opt目录下 cp /root/openssh-8.2p1.tar.gz /opt cd /opt #若可以访问外网，可以直接yum install zlib-devel pam-devel #yum -y install zlib-devel #yum -y install pam-devel #若不可以访问外网，提前下载好zlib-devel和pam-devel所需的rpm包，本地rpm -ivh --force 的方式安装 rpm -ivh --force zlib*.rpm rpm -ivh --force pam*.rpm #解压openssh-8.2p1.tar.gz源码包 tar -zxvf openssh-8.2p1.tar.gz cd openssh-8.2p1/ #备份旧版本 mv /etc/ssh /etc/ssh_bak sleep 1 #编译前环境配置 ./configure --prefix=/usr/local/openssh --sysconfdir=/etc/ssh --with-pam --with-ssl-dir=/usr/local/openssl --with-md5-passwords --mandir=/usr/share/man --with-zlib=/usr/local/zlib --without-hardening #make编译 make #make install编译安装 make install #修改/etc/ssh/sshd_config配置，允许root用户SSH登录，因为openssh-8.2p1配置中无此选项 echo "PermitRootLogin yes" >> /etc/ssh/sshd_config #备份旧版本sshd mv /usr/sbin/sshd /usr/sbin/sshd_bak mv /etc/sysconfig/sshd /opt mv /usr/lib/systemd/system/sshd.service /opt #拷贝新版本sshd到/usr/sbin/ cp -arf /usr/local/openssh/sbin/sshd /usr/sbin/sshd #卸载原有openssh for i in $(rpm -qa |grep openssh);do rpm -e $i --nodeps ;done #卸载后openssh配置文件会变成rpmsave后缀，还原到原来目录下 mv /etc/ssh/sshd_config.rpmsave /etc/ssh/sshd_config mv /etc/ssh/ssh_config.rpmsave /etc/ssh/ssh_config mv /etc/ssh/moduli.rpmsave /etc/ssh/moduli #替换新版本openssh相关命令 cp -arf /usr/local/openssh/bin/* /usr/bin/ cp -arf /usr/local/openssh/sbin/sshd /usr/sbin/sshd #拷贝启动脚本 cp /opt/openssh-8.2p1/contrib/redhat/sshd.init /etc/init.d/sshd #给启动脚本添加执行权限 chmod +x /etc/init.d/sshd #拷贝sshd.pam cp -a contrib/redhat/sshd.pam /etc/pam.d/sshd.pam #重启sshd服务并设为开机自启动 systemctl daemon-reload service sshd restart chkconfig --add sshd chkconfig --level 2345 sshd on chkconfig --list