OpenSSH升级版本到最新(8.9)
漏洞:https://www.cvedetails.com/cve/CVE-2021-36368/
1.安装依赖软件包
yum install wget gcc -y
yum install -y zlib-devel openssl-devel
yum install pam-devel libselinux-devel zlib-devel openssl-devel -y
2.用wget直接下载或自行下载安装包OpenSSH8.6上传至服务器,此次使用wget下载
其他版本下载可以访问https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/
wget https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-8.9p1.tar.gz
3.删除低版本OpenSSH的的rpm包
rpm -e --nodeps `rpm -qa | grep openssh`
4.安装openssh
(1)解压,并进入目录
tar -zxvf openssh-8.9p1.tar.gz
cd openssh-8.9p1
(2)执行配置命令
./configure --prefix=/usr --sysconfdir=/etc/ssh --with-md5-passwords --with-pam --with-zlib --with-tcp-wrappers --with-ssl-dir=/usr/local/ssl --without-hardening
(3)编译、安装
make
make install
(4)授权
chmod 600 /etc/ssh/ssh_host_rsa_key /etc/ssh/ssh_host_ecdsa_key /etc/ssh/ssh_host_ed25519_key
(5)复制配置文件并设置允许root用户远程登录
cp -a contrib/redhat/sshd.init /etc/init.d/sshd
cp -a contrib/redhat/sshd.pam /etc/pam.d/sshd.pam
chmod u+x /etc/init.d/sshd
vim /etc/ssh/sshd_config
5.修改#PermitRootLogin prohibit-password项,去掉注释#并把prohibit-password改为yes,修改后即为PermitRootLogin yes
6.去掉注释#PasswordAuthentication yes变为PasswordAuthentication yes
7.添加添加自启服务ssh到开机启动项
chkconfig --add sshd
chkconfig sshd on
8.重启服务
systemctl restart sshd
9.查看下安装结果
ssh -V
版本结果为:
10.检查可用性
ssh user@hostname