ssh RPM制作

openssh源码打包成rpm包
安全扫描经常遇到的openssh漏洞，需要升级修复，源码包编译安装时间长，命令多。通过源码生成rpm包升级就简单一些，生成的rpm包可以用于openssh漏洞的修复
一、制作openssh9.0.rpm包
1、yum安装编译依赖的组件
yum install -y rpm-build gcc gcc-c++ glibc glibc-devel openssl-devel openssl prce pcre-devel zlib zlib-devel make wget krb5-devel pam-devel libX11-devel xmkmf libXt-devel initscripts libXt-devel imake gtk2-devel lrzsz
2、建立编译目录
mkdir -pv /root/rpmbuild/{BUILD,BUILDROOT,RPMS,SOURCES,SPECS,SRPMS}
3、源码包下载到/root/rpmbuild/SOURCES
wget https://mirrors.aliyun.com/pub/OpenBSD/OpenSSH/portable/openssh-9.0p1.tar.gz
4、解压spec编译文件
cd /root/rpmbuild/SOURCES/
tar -xf openssh-9.0p1.tar.gz openssh-9.0p1/contrib/redhat/openssh.spec
mv openssh-9.0p1 /root/rpmbuild/SPECS
5、配置spec编译文件
a、不生成askpasz包
cd /root/rpmbuild/SPECS/openssh-9.0p1/contrib/redhat/
sed -i -e "s/%global no_gnome_askpass 0/%global no_gnome_askpass 1/g" openssh.spec
sed -i -e "s/%global no_x11_askpass 0/%global no_x11_askpass 1/g" openssh.spec
b、解决openssl-devel < 1.1报错
sed -i '/openssl-devel < 1.1/s/^/#/' openssh.spec
6、编译openssh源码
rpmbuild -bb /root/rpmbuild/SPECS/openssh-9.0p1/contrib/redhat/openssh.spec
编译好的rpm包会在：/root/rpmbuild/RPMS/x86_64/

 

更新

yum -y remove openssh-7.4p1-21.el7.x86_64 openssh-server-7.4p1-21.el7.x86_64 openssh-clients-7.4p1-21.el7.x86_64
rpm -Uvh openssh-server-9.0p1-1.el7.x86_64.rpm openssh-9.0p1-1.el7.x86_64.rpm openssh-clients-9.0p1-1.el7.x86_64.rpm
echo "PermitRootLogin yes" >> /etc/ssh/sshd_config

chmod 600 /etc/ssh/ -R
systemctl restart sshd