redhat 5 openSSL及openSSH升级

redhat 5 openSSL及openSSH升级

根据漏洞扫描升级openssl和openssh，提高系统的安全性

1.环境

Red Hat Enterprise Linux Server release 5.6 (Tikanga)

Red Hat Enterprise Linux Server release 5.9 (Tikanga)

2.升级版本

名称	当前版本	升级后版本
perl	v5.8.8/v5.16.3	v5.30.3
OpenSSL	0.9.8e	1.1.1k
openSSH	4.3p2	8.6p1

3.升级操作

yum -y install gcc gcc-c++ glibc make zlib zlib-devel pam-devel

#Perl update
cd /home/wei
tar zxvf perl-5.30.3.tar.gz
cd /home/wei/perl-5.30.3
./Configure -des -Dprefix=/usr/local/perl && echo $? || exit
make && echo $? >> ~/update.log
make test
make install
mv /usr/bin/perl /usr/bin/perl.bak
ln -s /usr/local/perl/bin/perl /usr/bin/perl
perl -v  && echo  -e  '\E[32mperl 升级成功\E[0m'

#openssl update
cd /home/wei
tar openssl-1.1.1k.tar.gz  
cd /home/wei/openssl-1.1.1k
./config --prefix=/usr/local/ssl shared zlib
make install && echo $?
mv /usr/bin/openssl /usr/bin/openssl.bak
ln -s /usr/local/ssl/bin/openssl /usr/bin/openssl
cat > /etc/ld.so.conf.d/ssl.conf <<EOF
/usr/local/ssl/lib
EOF
/sbin/ldconfig
openssl version

#openssh update
cp -ar /etc/ssh/ /etc/ssh.bak
cp -ar /etc/pam.d /etc/pam.d.bak
cd /usr/bin/
cp ssh ssh.bak
cp ssh-add ssh-add.bak
cp ssh-copy-id ssh-copy-id.bak
cp ssh-keygen ssh-keygen.bak
cp ssh-keyscan ssh-keyscan.bak
cp scp scp.bak
cp sftp sftp.bak
cp /usr/sbin/sshd /usr/sbin/sshd.bak
cp /etc/init.d/sshd /etc/init.d/sshd.bak
cd /home/wei
tar zxvf openssh-8.6p1.tar.gz
cd ./openssh-8.6p1
./configure --prefix=/usr/local/openssh --sysconfdir=/etc/ssh --with-pam --with-zlib --without-openssl-header-check --with-ssl-dir=/usr/local/ssl --with-privsep-path=/var/lib/sshd
make && echo $?
make install 
ln -sf /usr/local/openssh/bin/ssh /usr/bin/ssh
ln -sf /usr/local/openssh/bin/ssh-add /usr/bin/ssh-add
ln -sf /usr/local/openssh/bin/ssh-agent /usr/bin/ssh-agent
ln -sf /usr/local/openssh/bin/ssh-keygen /usr/bin/ssh-keygen
ln -sf /usr/local/openssh/bin/ssh-keyscan /usr/bin/ssh-keyscan
ln -sf /usr/local/openssh/bin/scp /usr/bin/scp
ln -sf /usr/local/openssh/bin/sftp /usr/bin/sftp
ln -sf /usr/local/openssh/sbin/sshd /usr/sbin/sshd
cp  /home/wei/openssh-8.6p1/contrib/redhat/sshd.init /etc/init.d/sshd
chmod a+x /etc/init.d/sshd
chmod a+x -R /usr/local/openssh/*
/sbin/chkconfig --add sshd
/sbin/chkconfig --list|grep sshd
cp /etc/pam.d.bak/sshd /etc/pam.d/sshd
---------------------
vim /etc/ssh/sshd_config
#GSSAPIAuthentication yes
#GSSAPICleanupCredentials yes
PermitRootLogin yes
---------------------

/sbin/service sshd restart

4 版本回退

#perl降级
rm -f /usr/bin/perl
cp  /usr/bin/perl.bak /usr/bin/perl
perl -v 

#降级openssl
rm -f  /usr/bin/openssl /etc/ld.so.conf.d/ssl.conf 
cp  /usr/bin/openssl.bak /usr/bin/openssl
/sbin/ldconfig
openssl version

#openssh降级
\cp -ar  /etc/ssh.bak /etc/ssh/
\cp -ar  /etc/pam.d.bak  /etc/pam.d
cd /usr/bin/
rm -f  ssh ssh-add  ssh-keygen  ssh-keyscan scp sftp
\cp  ssh.bak  ssh 
\cp  ssh-add.bak ssh-add
\cp  ssh-copy-id.bak  ssh-copy-id
\cp  ssh-keygen.bak ssh-keygen
\cp  ssh-keyscan.bak  ssh-keyscan
\cp  scp.bak  scp
\cp     sftp.bak     sftp
\cp  /usr/sbin/sshd.bak /usr/sbin/sshd
\cp  /etc/init.d/sshd.bak /etc/init.d/sshd

chmod a+x /etc/init.d/sshd
/sbin/chkconfig --del sshd
/sbin/chkconfig --add sshd
/sbin/chkconfig --list|grep sshd

cp /etc/pam.d.bak/sshd /etc/pam.d/sshd

/sbin/service sshd restart

 

5 报错

 5.1 未开启ipv6

未开启ipv6会出现以下报错，可忽略

dist/Net-Ping/t/501_Ping_icmpv6 ................icmp socket error - Address family not supported by protocol at t/501_Ping_icmpv6

 

5.2 GSSAPI参数淘汰

高版本淘汰的参数,报错如下,注释/etc/ssh/sshd_config 该选项即可

/etc/ssh/sshd_config line74 : unsuport option GSSAPIAuthentication

/etc/ssh/sshd_config line76 : unsuport option GSSAPICleanupCredentials

5.3 libcrypto.so.1.1 : cannot open shared object file

缺少相关库，文件重新软链接,报错信息如下：

 Starting sshd: /usr/sbin/sshd: error while loading shared libraries: libcrypto.so.1.1: cannot open shared object file: No such file or directory

#建议拆开进行软链接进行配置，保证链接的准确性。同时考虑PATH的优先级的影响，还原备份文件的过程很重要
ln -sv `find / -name libcrypto.so.1.1` /usr/lib64/libcrypto.so.1.1

6 总结

rhel 5 升级/降级操作，首先进行相关文件目录的备份，然后需注意用户的权限及目录指定。编译操作指定路径，编译完成需测试状态返回码是否成功，编译完成后进行版本的更替。

相关命令报不存在时时，请指定绝对路径进行执行，请根据报错信息去排查排错

 

附录

 OpenSSL官网下载地址：https://www.openssl.org/source/

官网软件包地址：https://access.redhat.com/downloads/content/69/ver=/rhel---5/5.11/x86_64/packages

官网镜像下载地址：https://access.redhat.com/downloads/content/69/ver=/rhel---5/5.9/x86_64/product-software