linux下升级openssh参考[不建议采用此法安装]
-
本人不见一采用这种方法安装,只是当遇到问题时候有一定的参考意义,所以贴了上来。建议使用yum方式安装,详见在下另一篇博文:
http://blog.csdn.net/lqzixi/article/details/24816735http://blog.csdn.net/lqzixi/article/details/24816735
-
linux下升级openssh查询是否安装telnet# rpm -qa | grep telnettelnet-server-0.17-31.EL4.5telnet-0.17-31.EL4.5打开telnet服务修改设置文件/etc/xinetd.d/telnet中disable字段改为no。启动服务#ntsysv或#service xinetd restart。创建登陆用户因为不能直接root telnet登陆,所以创建一个登陆用户.安转完成后可以把该用户删除useradd opensshinstall(删除用户及/home/sshinstall目录 userdel -r sshinstall 删除这个用户的组groupdel sshinstall)安装源文件在/usr/local/src目录下zlib和openssl安装在/usr/local目录下安装zlib-1.2.5#tar -zxvf zlib-1.2.5.tar.gz#cd zlib-1.2.5#./configure --prefix=/usr/local/zlib-1.2.5 -share#make#make test#make installcp libz.a /usr/local/zlib-1.2.5/libcp libz.so.1.2.5 /usr/local/zlib-1.2.5/libcd /usr/local/zlib-1.2.5/lib; chmod u=rw,go=r libz.acp zlib.3 /usr/local/zlib-1.2.5/share/man/man3chmod 644 /usr/local/zlib-1.2.5/share/man/man3/zlib.3cp zlib.pc /usr/local/zlib-1.2.5/lib/pkgconfigchmod 644 /usr/local/zlib-1.2.5/lib/pkgconfig/zlib.pccp zlib.h zconf.h /usr/local/zlib-1.2.5/includechmod 644 /usr/local/zlib-1.2.5/include/zlib.h /usr/local/zlib-1.2.5/include/zconf.h#vi /etc/ld.so.conf 配置库文件搜索路径include ld.so.conf.d/*.conf##add 2010.7.7/usr/local/zlib-1.2.5/lib##add end#ldconfig -v 刷新缓存文件/etc/ld.so.cache#ln -s /usr/local/zlib-1.2.5 /usr/local/zlib安装openssl#cd /usr/local/src#tar zxvf openssl-1.0.0a.tar.gz#cd openssl-1.0.0a#./config shared zlib-dynamic --prefix=/usr/local/openssl-1.0.0a --with-zlib-lib=/usr/local/zlib-1.2.5/lib --with-zlib-include=/usr/local/zlib-1.2.5/include#make#make test (这一步是进行 SSL 加密协议的完整测试,如果出现错误就要一定先找出原因,否则一味继续可能导致 SSH 不能使用!)#make install#vi /etc/ld.so.conf 配置库文件搜索路径############################################## add below line to ld.so.conf/usr/local/openssl-1.0.0a/lib 64位OS 没有生成lib目录,是lib64目录#############################################ldconfig -v 刷新缓存文件/etc/ld.so.cache#ln -s /usr/local/openssl-1.0.0a /usr/local/opensslvi /etc/profile###########################################(add to end of the file)PATH=/usr/local/openssl/bin:$PATHexport PATH###########################################退出,再登录,查看openssl的版本号,以验正是否安装正确#openssl version -aOpenSSL 1.0.0a 1 Jun 2010built on: Wed Jul 7 17:08:07 CST 2010platform. linux-x86_64options: bn(64,64) rc4(1x,char) des(idx,cisc,16,int) idea(int) blowfish(idx)compiler: gcc -fPIC -DOPENSSL_PIC -DZLIB_SHARED -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -m64 -DL_ENDIAN -DTERMIO -O3 -Wall -DMD32_REG_T=int -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DWHIRLPOOL_ASMOPENSSLDIR: "/usr/local/openssl-1.0.0a/ssl"停止并卸载Openssh1.停止OpenSSH服务#service sshd stop2. 查询并卸载openssh# rpm -qa | grep opensshopenssh-3.9p1-8.RHEL4.24openssh-askpass-3.9p1-8.RHEL4.24openssh-clients-3.9p1-8.RHEL4.24openssh-server-3.9p1-8.RHEL4.24openssh-askpass-gnome-3.9p1-8.RHEL4.24#rpm -e openssh-3.9p1-8.RHEL4.24 --nodeps#rpm -e openssh-clients-3.9p1-8.RHEL4.24 --nodeps警告/etc/ssh/ssh_config 已存为 /etc/ssh/ssh_config.rpmsave#rpm -e openssh-askpass-3.9p1-8.RHEL4.24#rpm -e openssh-server-3.9p1-8.RHEL4.24 --nodeps#rpm -e openssh-askpass-gnome-3.9p1-8.RHEL4.24cd /usr/local/srctar zxvf openssh-5.5p1.tar.gzcd openssh-5.5p1./configure --prefix=/usr --sysconfdir=/etc/ssh --with-pam --with-ssl-dir=/usr/local/openssl-1.0.0a --with-md5-passwords --mandir=/usr/share/man --with-zlib=/usr/local/zlib-1.2.5#make#make install#将sshd加入启动服务:进入ssh安装解压目录#cp ./contrib/redhat/sshd.init /etc/init.d/sshd#chmod +x /etc/init.d/sshd#chkconfig --add sshd最后,启动 SSH 服务使修改生效:# service sshd start重启后确认一下当前的 OpenSSH 和 OpenSSL 是否正确:# ssh -v如果看到了新的版本号就没问题啦!关闭telnet服务修改设置文件/etc/xinetd.d/telnet中disable字段改为yes。启动服务#ntsysv或#service xinetd restart。注意问题1.在安装openssh, ./configure 时,报下面错误:configure: error: PAM headers not found运行# rpm -qa | grep pampam_smb-1.1.7-5pam_ccreds-1-3pam_passwdqc-0.7.5-2pam-0.77-66.17pam_krb5-2.1.8-1spamassassin-3.0.6-1.el4发现有 pam-0.77-66.17,从网上找到 pam-devel-0.77-66.17.i386.rpm,运行rpm -ivh pam-devel-0.77-66.17.i386.rpm后,./configure正常版本号0.77-66.17必须一样。2.在安装openssh时,configure报错:./configure --prefix=/usr --sysconfdir=/etc/ssh --with-pam --with-zlib --with-ssl-dir=/usr/include/openssl --with-md5-passwords --mandir=/usr/share/man.....configure: error: *** zlib too old - check config.log ***Your reported zlib version has known security problems. It's possible yourvendor has fixed these problems without changing the version number. If youare sure this is the case, you can disable the check by running"./configure --without-zlib-version-check".If you are in doubt, upgrade zlib to version 1.2.3 or greater.See http://www.gzip.org/zlib/ for details.因此需要升级zlib.3.如果操作系统是64位的,openssl-1.0.0a只生成了lib64,没有生成lib目录。openssh configure时,还是连接的老版本的openssl,郁闷。4. ./configure显示信息:./configure --prefix=/usr --sysconfdir=/etc/ssh --with-pam --with-ssl-dir=/usr/local/openssl-1.0.0a --with-md5-passwords --mandir=/usr/share/man --with-zlib=/usr/local/zlib-1.2.5显示信息:OpenSSH has been configured with the following options:User binaries: /usr/binSystem binaries: /usr/sbinConfiguration files: /etc/sshAskpass program: /usr/libexec/ssh-askpassManual pages: /usr/share/man/manXPID file: /var/runPrivilege separation chroot path: /var/emptysshd default user PATH: /usr/bin:/bin:/usr/sbin:/sbinManpage format: docPAM support: yesOSF SIA support: noKerberosV support: noSELinux support: noSmartcard support:S/KEY support: noTCP Wrappers support: noMD5 password support: yeslibedit support: noSolaris process contract support: noIP address in $DISPLAY hack: noTranslate v4 in v6 hack: yesBSD Auth support: noRandom number source: OpenSSL internal ONLYHost: i686-pc-linux-gnuCompiler: gccCompiler flags: -g -O2 -Wall -Wpointer-arith -Wuninitialized -Wsign-compare -Wformat-security -fno-builtin-memset -std=gnu99Preprocessor flags: -I/usr/local/openssl-1.0.0a/include -I/usr/local/zlib-1.2.5/includeLinker flags: -L/usr/local/openssl-1.0.0a/lib -L/usr/local/zlib-1.2.5/libLibraries: -lresolv -lcrypto -ldl -lutil -lz -lnsl -lcrypt+for sshd: -lpamPAM is enabled. You may need to install a PAM control filefor sshd, otherwise password authentication may fail.Example PAM control files can be found in the contrib/subdirectory