Centos/Redhat升级openssl/openssh服务
Centos/Redhat升级openssl/openssh服务
1、下载openssl-1.0.2h.tar.gz
wget https://www.openssl.org/source/openssl-1.0.2n.tar.gz
2、升级zlib服务
yum install -y zlib zlib-devel
3、解压安装
tar zxf openssl-1.0.2n.tar.gz
cd openssl-1.0.2n
./config shared zlib
make
make install
mv /usr/bin/openssl /usr/bin/openssl.bak
mv /usr/include/openssl /usr/include/openssl.bak
ln -s /usr/local/ssl/bin/openssl /usr/bin/openssl
ln -s /usr/local/ssl/include/openssl /usr/include/openssl
echo "/usr/local/ssl/lib" >> /etc/ld.so.conf
ldconfig -v
5、查看是否升级成功
[root@zj ~]# openssl version -a
OpenSSL 1.0.2h 3 May 2016
升级openssh
OpenSSH_5.3p1, OpenSSL 1.0.1e-fips 11 Feb 2013
openssl version -a
OpenSSL 1.0.1e-fips 11 Feb 2013
一、准备
备份ssh目录(重要)
cp -rf /etc/ssh /etc/ssh.bak
【 可以现场处理的，不用设置
安装telnet，避免ssh升级出现问题，导致无法远程管理
yum install telnet-server
vi /etc/xinetd.d/telnet
service telnet
{
flags = REUSE
socket_type = stream
wait = no
user = root
server = /usr/sbin/in.telnetd
log_on_failure += USERID
disable = no
}
默认不允许root登录
vi /etc/securetty
增加
pts/0
pts/1
pts/2
如果登录用户较多，需要更多的pts/*
/etc/init.d/xinetd restart
这样root可以telnet登录了
ssh升级后建议再修改回还原设置
】
二、安装
升级需要几个组件
yum install -y gcc openssl-devel pam-devel rpm-build
wget http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-7.5p1.tar.gz
wget http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-7.7p1.tar.gz
解压升级包，并安装
tar -zxvf openssh-7.7p1.tar.gz
cd openssh-7.5p1
./configure --prefix=/usr --sysconfdir=/etc/ssh --with-pam --with-zlib --with-md5-passwords --with-tcp-wrappers
make && make install
安装后提示：
/etc/ssh/ssh_config already exists, install will not overwrite
/etc/ssh/sshd_config already exists, install will not overwrite
/etc/ssh/moduli already exists, install will not overwrite
ssh-keygen: generating new host keys: ECDSA ED25519
/usr/sbin/sshd -t -f /etc/ssh/sshd_config
/etc/ssh/sshd_config line 81: Unsupported option GSSAPIAuthentication
/etc/ssh/sshd_config line 83: Unsupported option GSSAPICleanupCredentials
修改配置文件,允许root登录
vi /etc/ssh/sshd_config
#PermitRootLogin yes
修改为
PermitRootLogin yes
命令：
sed -i '/^#PermitRootLogin/s/#PermitRootLogin yes/PermitRootLogin yes/' /etc/ssh/sshd_config
重启openSSH
service sshd restart
升级后版本
ssh -V
OpenSSH_7.2p1, OpenSSL 1.0.1e-fips 11 Feb 2013
【
可以不操作，禁止dns解析
sed -i '/^#UseDNS yes/s/#UseDNS yes/UseDNS no/' /etc/ssh/sshd_config
可以不操作默认是22，修改ssh端口至6022
echo "Port 9092" >> /etc/ssh/sshd_config
】
注:在升级SSH时你的SSH是不会因为升级或重启服务而断掉的.
问题1：
[root@testserver2 tmp]# service sshd restart
Stopping sshd: [ OK ]
Starting sshd: /etc/ssh/sshd_config line 81: Unsupported option GSSAPIAuthentication
/etc/ssh/sshd_config line 83: Unsupported option GSSAPICleanupCredentials [ OK ]
解决：
将/etc/ssh/sshd_config文件中以上行数内容注释下即可
sed -i '/^GSSAPICleanupCredentials/s/GSSAPICleanupCredentials yes/#GSSAPICleanupCredentials yes/' /etc/ssh/sshd_config
sed -i '/^GSSAPIAuthentication/s/GSSAPIAuthentication yes/#GSSAPIAuthentication yes/' /etc/ssh/sshd_config
sed -i '/^GSSAPIAuthentication/s/GSSAPIAuthentication no/#GSSAPIAuthentication no/' /etc/ssh/sshd_config
问题2：
更新后ssh有如下提示，但不影响使用：
[root@testserver2 tmp]# ssh 10.111.32.51
/etc/ssh/ssh_config line 50: Unsupported option "gssapiauthentication"
解决：
可以注释/etc/ssh/ssh_config的gssapiauthentication内容
