升级openssh

由于之前的项目用的ssh的版本较低，最近被频繁查出有安全漏洞

不得不进行升级避免安全问题

操作步骤

一、开启telnet

记得先测试telnet能否成功登录再升级openssh不然ssh会挂掉，当然如果你是在本机升级可以省略这一步

yum install telnet-server telnet

systemctl start telnet.socket
systemctl enable telnet.socket

lsof -i:23

#开放防火墙策略

firewall-cmd --zone=public --add-port=23/tcp --permanent

二、备份旧的ssh

#查询ssh目录

whereis sshd

mv /usr/sbin/sshd /usr/sbin/sshd.bak

whereis ssh

mv /usr/bin/ssh /usr/bin/ssh.bak

whereis ssh-keygen
mv /usr/bin/ssh-keygen /usr/bin/ssh-keygen.bak

三、卸载旧的openssh-server

yum  remove openssh-server

四、安装新的openssh-server

# 安装依赖
yum install zlib-devel openssl-devel -y
cd /usr/local

wget https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-8.8p1.tar.gz

tar -zxvf   openssh-8.8p1.tar.gz

cd  openssh-8.8p1

./configure

make & make install

# 设置全局使用
cp /usr/local/sbin/sshd  /usr/sbin
cp /usr/local/bin/ssh /usr/bin
cp /usr/local/bin/ssh-keygen /usr/bin/

五、查看新本版

ssh -V

六、启动ssh 并设置开机自启

cp /usr/local/openssh-8.8p1/contrib/redhat/sshd.init /etc/init.d/sshd

/etc/init.d/sshd restart

systemctl status sshd


systemctl enable sshd

七、安装后可能会导致ssh无法连接，解决办法如下

第一步：
cp /usr/local/openssh-8.8p1/sshd_config /etc/ssh/

第二步：
vim /etc/ssh/sshd_config

找到PermitRootLogin without-password 改成PermitRootLogin yes

第三步：
vim /etc/init.d/sshd
在48行下面加上 OPTIONS="-f /etc/ssh/sshd_config"



第四步：
systemctl daemon-reload
systemctl restart sshd

如果报如下异常：

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the ECDSA key sent by the remote host is
SHA256:9XvufSSIeZ7MAurIZ1Qw9Z13YV1Zcim2kthmAlECgYw.
Please contact your system administrator.
Add correct host key in /root/.ssh/known_hosts to get rid of this message.
Offending ECDSA key in /root/.ssh/known_hosts:8
ECDSA host key for 192.168.122.100 has changed and you have requested strict checking.
Host key verification failed.
lost connection

尝试删除 rm -rf ~/.ssh/known_hosts

还有本地的：~/.ssh/known_hosts