CentOS7OpenSSH升级到最新OpenSSH8.8p1教程⼀、环境介绍
查看openssh、openssl版本
[root@localhost ~]# openssl version
OpenSSL 1.0.2k-fips 26 Jan 2017
[root@localhost ~]# ssh -V
OpenSSH_7.4p1, OpenSSL 1.0.2k-fips 26 Jan 2017
查看linux发⾏版和内核
[root@localhost ~]# cat /etc/os-release
NAME="CentOS Linux"
VERSION="7 (Core)"
ID="centos"
ID_LIKE="rhel fedora"
VERSION_ID="7"
PRETTY_NAME="CentOS Linux 7 (Core)"
ANSI_COLOR="0;31"
CPE_NAME="cpe:/o:centos:centos:7"
HOME_URL="/"
BUG_REPORT_URL="/"
CENTOS_MANTISBT_PROJECT="CentOS-7"
CENTOS_MANTISBT_PROJECT_VERSION="7"
REDHAT_SUPPORT_PRODUCT="centos"
REDHAT_SUPPORT_PRODUCT_VERSION="7"
[root@localhost ~]# uname -r
3.10.0-957.el7.x86_64
⼆、安装配置telnet
2.1、安装telnet-server
[root@localhost ~]# yum -y install xinetd telnet-server
2.2、配置telnet
`先看⼀下xinetd.d⽬录下是否有telnet⽂件`
[root@localhost ~]# ll /etc/xinetd.d/telnet
ls: cannot access /etc/xinetd.d/telnet: No such file or directory
`如果有，则将⽂件⾥⾯的disable = no改成disable = yes`
`如果没有，就进⾏下⾯的操作`
[root@localhost ~]# cat > /etc/xinetd.d/telnet <<EOF
service telnet
{
disable = yes
flags = REUSE
socket_type = stream
wait = no
user = root
server = /usr/lnetd
log_on_failure += USERID
}
EOF
2.3、配置telnet登录的终端类型
[root@localhost ~]# cat >> /etc/securetty <<EOF
pts/0
pts/1
pts/2
pts/3
EOF
2.4、启动telnet服务
[root@localhost ~]# systemctl enable xinetd --now
[root@localhost ~]# systemctl enable telnet.socket --now
[root@localhost ~]# ss -nltp | grep23
LISTEN 0128 :::23 :::* users:(("systemd",pid=1,fd=46))
`23端⼝起来了，表⽰telnet服务正常运⾏`
三、切换登录⽅式为telnet
后⾯的操作都是在telnet链接的⽅式下进⾏，避免ssh中断导致升级失败
以telnet⽅式登录的时候，注意选择协议和端⼝，协议为telnet，端⼝为23
四、开始升级OpenSSH
4.1、下载升级所需依赖包
[root@localhost ~]# yum -y install gcc gcc-c++ glibc make autoconf openssl openssl-devel pcre-devel pam-devel
[root@localhost ~]# wget /source/openssl-1.1.
[root@localhost ~]# wget /pub/OpenBSD/OpenSSH/portable/openssh-8.
[root@localhost ~]# tar xf openssl-1.1.
[root@localhost ~]# tar xf openssh-8.
4.3、编译安装OpenSSL
`开始之前，先备份⼀下原有的OpenSSL⽂件`
[root@localhost ~]# mv /usr/bin/openssl{,.bak}
8.8级[root@localhost ~]# mv /usr/include/openssl{,.bak}
[root@localhost ~]# cd openssl-1.1.1i/
[root@localhost openssl-1.1.1i]# ./config shared && make && make install
`编译完成后，可以在/usr/local⽬录下到openssl的⼆进制⽂件和⽬录`
[root@localhost ~]# ll /usr/local/bin/openssl
-rwxr-xr-x 1 root root 749136 Jan 1414:25 /usr/local/bin/openssl
[root@localhost ~]# ll -d /usr/local/include/openssl/
drwxr-xr-x 2 root root 4096 Jan 1414:25 /usr/local/include/openssl/
`建⽴软连接`
[root@localhost ~]# ln -s /usr/local/bin/openssl /usr/bin/openssl
[root@localhost ~]# ln -s /usr/local/include/openssl/ /usr/include/openssl
[root@localhost ~]# ll /usr/bin/openssl
lrwxrwxrwx 1 root root 22 Jan 1414:32 /usr/bin/openssl -> /usr/local/bin/openssl
[root@localhost ~]# ll -d /usr/include/openssl
lrwxrwxrwx 1 root root 27 Jan 1414:33 /usr/include/openssl -> /usr/local/include/openssl/
`重新加载配置，验证openssl版本`
[root@localhost ~]# echo"/usr/local/lib64" >> /etc/f
[root@localhost ~]# /sbin/ldconfig
[root@localhost ~]# openssl version
OpenSSL 1.1.1i 8 Dec 2020
4.3.1、可能会有的⼀些报错和解决⽅法
[root@localhost ~]# openssl version
openssl: error while loading shared libraries: libssl.so.1.1: cannot open shared object file: No such file or directory
"这是因为libssl.so.1.1⽂件不到，执⾏find / -name 'libssl.so.1.1'，将/etc/f⾥⾯的lib64改成find出来的路径即可" [root@localhost ~]# find / -name "openssl"
"编译完，可以⽤上⾯的find命令看⼀下openssl所在的路径，以及include/openssl所在的路径"
4.4、编译安装OpenSSH
`备份原有的ssh⽬录`
[root@localhost ~]# mv /etc/ssh{,.bak}
[root@localhost ~]# mkdir /usr/local/openssh
[root@localhost ~]# cd openssh-8.4p1/
[root@localhost openssh-8.4p1]# ./configure --prefix=/usr/local/openssh \
--sysconfdir=/etc/ssh \
--with-openssl-includes=/usr/local/include \
--with-ssl-dir=/usr/local/lib64 \
--with-zlib \
--with-md5-passwords \
--with-pam && \
make && \
make install
4.4.1、配置sshd_config⽂件
[root@localhost ~]# echo"UseDNS no" >> /etc/ssh/sshd_config
[root@localhost ~]# echo'PermitRootLogin yes' >> /etc/ssh/sshd_config
[root@localhost ~]# echo'PubkeyAuthentication yes' >> /etc/ssh/sshd_config
[root@localhost ~]# echo'PasswordAuthentication yes' >> /etc/ssh/sshd_config
`如果是图形化界⾯，需要x11的话，需要配置如下`
[root@localhost ~]# echo"X11Forwarding yes" >> /etc/ssh/sshd_config
[root@localhost ~]# echo"X11UseLocalhost no" >> /etc/ssh/sshd_config
[root@localhost ~]# echo"XAuthLocation /usr/bin/xauth" >> /etc/ssh/sshd_config
4.4.2、创建新的sshd⼆进制⽂件
[root@localhost ~]# mv /usr/sbin/sshd{,.bak}
[root@localhost ~]# mv /usr/bin/ssh{,.bak}
[root@localhost ~]# mv /usr/bin/ssh-keygen{,.bak}
[root@localhost ~]# ln -s /usr/local/openssh/bin/ssh /usr/bin/ssh
[root@localhost ~]# ln -s /usr/local/openssh/bin/ssh-keygen /usr/bin/ssh-keygen
[root@localhost ~]# ln -s /usr/local/openssh/sbin/sshd /usr/sbin/sshd
`查看openssh当前版本`
[root@localhost ~]# ssh -V
OpenSSH_8.4p1, OpenSSL 1.1.1i 8 Dec 2020
4.4.3、重新启动openssh服务
[root@localhost ~]# systemctl disable sshd --now
[root@localhost ~]# mv /usr/lib/systemd/system/sshd.service{,.bak}
[root@localhost ~]# systemctl daemon-reload
[root@localhost ~]# cp -a openssh-8.6p1/contrib/redhat/sshd.init /etc/init.d/sshd [root@localhost ~]# cp -a openssh-8.6p1/contrib/redhat/sshd.pam /etc/pam.d/sshd.pam [root@localhost ~]# chkconfig --add sshd
[root@localhost ~]# systemctl enable sshd --now
4.5、ssh链接成功后的处理
[root@localhost ~]# ssh root@192.168.******
`成功连接上之后，可以关闭telnet服务，当然，也可以不关闭`
[root@localhost ~]# systemctl disable xinetd.service --now
[root@localhost ~]# systemctl disable telnet.socket --now
版权声明：本站内容均来自互联网，仅供演示用，请勿用于商业和其他非法用途。如果侵犯了您的权益请与我们联系QQ:729038198，我们将在24小时内删除。
发表评论