centos7 升级 OpenSSH

随着计算机技术发张日新月异，人们对计算机的安全要求也逐渐严苛起来了。OpenSSH作为文件传输和远程客户端连接的协议实现，其重要性不言而喻。然而就是这么重要的组件，centos7原生自带的OpenSSH却因为其过低的版本而漏洞频出，所以我这里为了方便升级，编写了个shell脚本。

 准备离线依赖包

yum install --downloadonly --downloaddir=/opt/depends/ gcc gcc-c++ glibc make autoconf openssl openssl-devel pcre-devel wget  pam* zlib*
tar -czf depends.tar.gz  /opt/depends/

下载openssl-1.1.1k.tar.gz 、openssh-9.4p1.tar.gz

wget https://www.openssl.org/source/openssl-1.1.1k.tar.gz
wget https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-9.4p1.tar.gz

 

#!/bin/bash

set -e

# 安装依赖包
tar xf /opt/depends.tar.gz -C /opt
rpm -ivh --nodeps --force /opt/depends/*.rpm


# 安装openssl

mkdir /usr/local/openssl && cd /opt/src && tar xf openssl-1.1.1k.tar.gz 

cd openssl-1.1.1k/ && ./config --prefix=/usr/local/openssl

make  && make install

mv /usr/bin/openssl /usr/bin/openssl.bak
mv /usr/include/openssl /usr/include/openssl.bak

unlink /usr/lib64/libssl.so

ln -s /usr/local/openssl/bin/openssl /usr/bin/openssl

ln -s /usr/local/openssl/include/openssl /usr/include/openssl

ln -s /usr/local/openssl/lib/libssl.so /usr/lib64/libssl.so

echo '/usr/local/openssl/lib' >> /etc/ld.so.conf

ldconfig -v

ln -s /usr/local/openssl/lib/libssl.so.1.1 /usr/lib64/libssl.so.1.1

ln -s /usr/local/openssl/lib/libcrypto.so.1.1 /usr/lib64/libcrypto.so.1.1


# 部署OpenSSH
cd /opt/src
cp /etc/ssh/sshd_config sshd_config.backup

cp /etc/pam.d/sshd sshd.backup

rpm -e --nodeps `rpm -qa | grep openssh`

tar xf openssh-9.4p1.tar.gz && cd openssh-9.4p1

./configure --prefix=/usr --sysconfdir=/etc/ssh --with-md5-passwords --with-pam --with-zlib --with-tcp-wrappers --with-ssl-dir=/usr/local/openssl --without-hardening

make 
make install || true

chmod 600 /etc/ssh/ssh_host_rsa_key /etc/ssh/ssh_host_ecdsa_key /etc/ssh/ssh_host_ed25519_key

cp -a contrib/redhat/sshd.init /etc/init.d/sshd
chmod u+x /etc/init.d/sshd

mv -f ../sshd.backup /etc/pam.d/sshd
mv -f ../sshd_config.backup /etc/ssh/sshd_config

echo "KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521" >> /etc/ssh/sshd_config
chkconfig --add sshd
chkconfig sshd on

systemctl restart sshd

 

参考连接：https://blog.csdn.net/weixin_43741718/article/details/132583582