centeros 6 远程升级ssl ssh 的shell脚本
变量说明
SSL_N=openssl-1.0.2p #ssl 版本
SSH_N=openssh-7.9p1 #ssh 版本
ZLIB_N=zlib-1.2.11 # zlib 版本
脚本分为两个,因为升级ssh ssh存在断开问题,需要临时启用telnet继续执行
yum配置采用了ftp yum源,具体配置见我的博客:
https://www.cnblogs.com/levi-w/p/9675157.html
执行步骤:
1 首先在服务器执行openssh-update.telnet.sh
2 telnet 登录服务器,执行openssh-update.sh
脚本详情:
1 openssh-update.telnet.sh
#!/bin/bash
#config yum
export SSL_N=openssl-1.0.2p
export SSH_N=openssh-7.9p1
export ZLIB_N=zlib-1.2.11
cp -r /etc/yum.repos.d /etc/yum.repos.d_bak
rm -rf /etc/yum.repos.d/*
echo "[CenterOS-source]
name=Linux "'$releasever'" - "'$basearch'" - Source
baseurl=ftp://10.1.1.1/pub/cos6
enabled=1
gpgcheck=0" > /etc/yum.repos.d/rhel-source.repo
yum makecache
yum -y install gcc* telnet* pam-devel openssl-devel
##config telnet#一定要测试!
yum -y install telnet*
# disable字段改为no
sed -i '12c disable = no' /etc/xinetd.d/telnet
service xinetd restart
mv /etc/securetty /etc/securetty.bak
read -p "test telnet[y/n]: " number
if [ $number != 'y' ]
then
echo "Error"
exit
fi
echo "please use telnet to countinue"
2 openssh-update.sh
#!/bin/bash
#config yum
export SSL_N=openssl-1.0.2p
export SSH_N=openssh-7.9p1
export ZLIB_N=zlib-1.2.11
##config zlib
cd /opt
tar zxvf /opt/$ZLIB_N.tar.gz
cd /opt/$ZLIB_N/
./configure --prefix=/usr/local/$ZLIB_N -share
cd /opt/$ZLIB_N/
make -j4
make -j4 test
read -p "test $ZLIB_N [y/n]: " number
if [ $number != 'y' ]
then
echo "Error"
exit
fi
make -j4 install
mv /usr/local/$ZLIB_N/lib/libz.a /usr/local/$ZLIB_N/lib/libz.a.bak`date +%y%m%d`
/bin/cp -r /opt/$ZLIB_N/libz.a /usr/local/$ZLIB_N/lib
chmod 644 /usr/local/$ZLIB_N/lib/libz.a
/bin/cp -r /opt/$ZLIB_N/ libz.so.1.2.11 /usr/local/$ZLIB_N/lib
chmod 755 /usr/local/$ZLIB_N/lib/libz.so.1.2.11
mv /usr/local/$ZLIB_N/share/man/man3/zlib.3 /usr/local/$ZLIB_N/share/man/man3/zlib.3.bak`date +%y%m%d`
/bin/cp -r /opt/$ZLIB_N/zlib.3 /usr/local/$ZLIB_N/share/man/man3
mv /usr/local/$ZLIB_N/lib/pkgconfig/zlib.pc /usr/local/$ZLIB_N/lib/pkgconfig/zlib.pc.bak`date +%y%m%d`
cp -r /opt/$ZLIB_N/zlib.pc /usr/local/$ZLIB_N/lib/pkgconfig
chmod 644 /usr/local/$ZLIB_N/lib/pkgconfig/zlib.pc
mv /usr/local/$ZLIB_N/include/zlib.h /usr/local/$ZLIB_N/include/zlib.h.bak`date +%y%m%d`
mv /usr/local/$ZLIB_N/include/zconf.h /usr/local/$ZLIB_N/include/zconf.h.bak`date +%y%m%d`
/bin/cp -r /opt/$ZLIB_N/zlib.h zconf.h /usr/local/$ZLIB_N/include
chmod 644 /usr/local/$ZLIB_N/include/zlib.h /usr/local/$ZLIB_N/include/zconf.h
echo "include ld.so.conf.d/*.conf
## add for update ssh
/usr/local/$ZLIB_N/lib
##add end">>/etc/ld.so.conf
ldconfig -v
ln -s /usr/local/$ZLIB_N /usr/local/zlib
##install openssl
cp -r /usr/lib64/openssl /usr/lib64/openssl_old
cp -r /usr/bin/openssl /usr/bin/openssl_old
cd /opt
tar zxvf /opt/$SSL_N.tar.gz
cd /opt/$SSL_N/
./config zlib-dynamic --prefix=/usr/local/$SSL_N --with-zlib-lib=/usr/local/$ZLIB_N/lib --with-zlib-include=/usr/local/$ZLIB_N/include --shared
make
make test
read -p "test $SSL_N [y/n]: " number
if [ $number != 'y' ]
then
echo "Error"
exit
fi
make install
echo "## add below line to ld.so.conf
/usr/local/$SSL_N/lib
###">>/etc/ld.so.conf
ldconfig -v
ln -s /usr/local/$SSL_N /usr/local/openssl
echo "##config for ssl
export PATH=/usr/local/openssl/bin:"'$PATH'"
###">>/etc/profile
source /etc/profile
openssl version -a
##install openssh
service sshd stop
cp -r /etc/ssh /etc/ssh_old`date +%F`
rpm -qa | grep openssh | xargs rpm -e
cd /opt
tar zxvf /opt/$SSH_N.tar.gz
cd /opt/$SSH_N
./configure --prefix=/usr --sysconfdir=/etc/ssh --with-pam --with-ssl-dir=/usr/local/$SSL_N --with-md5-passwords --mandir=/usr/share/man --with-zlib=/usr/local/zlib
make && make install
/bin/cp -r ./contrib/redhat/sshd.init /etc/init.d/sshd
chmod +x /etc/init.d/sshd
chkconfig --add sshd
service sshd restart
ssh -V
##PermitRootLogin prohibit-password
#PermitRootLogin yes
cp /etc/ssh/sshd_config /etc/ssh/sshd_config_old`date +%F`
sed -i '33i PermitRootLogin yes' /etc/ssh/sshd_config
service sshd restart
read -p "test SSH [y/n]: " number
if [ $number != 'y' ]
then
echo "Error"
exit
fi
## config telnet close
sed -i '12c disable = yes' /etc/xinetd.d/telnet
#/etc/xinetd.d/telnet
mv /etc/securetty.bak /etc/securetty
service xinetd restart
echo "test telnet"