CentOS7 升级 openssh 到 openssh-8.0p1版本

由 匿名 (未验证) 提交于 2019-12-02 23:53:01

centos7.3和centos7.6升级完毕测试登录ssh以及重启后登录ssh均无问题。

前期请自行配置好yum源（如果不会请百度）

整个过程不需要卸载原先的openssl包和openssh的rpm包。不影响我们的操作

本文的环境都是系统自带的openssh，没有经历过手动编译安装方式。如果之前有手动编译安装过openssh，请参照本文自行测试是否能成功。

如果严格参照本文操作，我保证你升级没问题

centos7.6升级后的效果

1
2
3
4
5
6
7
8
[root@testssh ~]# ssh -V
[root@testssh ~]# openssl version
[root@testssh ~]# cat /etc/redhat-release
CentOS Linux release 7.6.1810 (Core)
[root@testssh ~]#

　　

centos7.3升级后的效果

1
2
3
4
5
6
7
[root@linux-node3 ~]# openssl version
[root@linux-node3 ~]# ssh -V
[root@linux-node3 ~]# cat /etc/redhat-release
CentOS Linux release 7.3.1611 (Core)
[root@linux-node3 ~]#

　　

如果ssh版本过低，最好先yum update openssh升级下到目前yum仓库默认的openssh7.4p1版本

默认centos7.3的ssh是如下版本

1
2
3
4
5
[root@linux-node3 ~]# cat /etc/redhat-release
CentOS Linux release 7.3.1611 (Core)
[root@linux-node3 ~]# ssh -V
OpenSSH_6.6.1p1, OpenSSL 1.0.1e-fips 11 Feb 2013
[root@linux-node3 ~]#

　　

（这里准备统一openssh版本为7.4p1之后再统一编译安装升级到openssh8.0p1）

1
2
3
4
5
[root@linux-node3 ~]# yum update openssh -y
[root@linux-node3 ~]# ssh -V
[root@linux-node3 ~]#

　

安装telnet-server以及xinetd

1
2
3
4
5
6
7
8
9
10
11
[root@linux-node3 ~]# yum install xinetd telnet-server -y
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
* base: mirrors.163.com
* epel: mirrors.aliyun.com
* extras: mirrors.cn99.com
* updates: mirrors.cn99.com
Package 2:xinetd-2.3.15-13.el7.x86_64 already installed and latest version
Package 1:telnet-server-0.17-64.el7.x86_64 already installed and latest version
do
[root@linux-node3 ~]#

　　

配置telnet

现在很多centos7版本安装telnet-server以及xinetd之后没有一个叫telnet的配置文件了。

如果下面telnet文件不存在的话，可以跳过这部分的更改

1
2
[root@linux-node3 ~]# ll /etc/xinetd.d/telnet
ls/etc/xinetd.d/telnetfileor directory

　　

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
[root@rhel yum.repos.d]# cat /etc/xinetd.d/telnet
# default: on
# description: The telnet server serves telnet sessions; it uses \
service telnet
{
disable = no
/usr/sbin/in.telnetd
}
[root@rhel yum.repos.d]# vim /etc/xinetd.d/telnet
[root@rhel yum.repos.d]# cat /etc/xinetd.d/telnet
# default: on
# description: The telnet server serves telnet sessions; it uses \
service telnet
{
yes
/usr/sbin/in.telnetd
}

　　

配置telnet登录的终端类型，在/etc/securetty文件末尾增加一些pts终端，如下

1
2
3
4
pts/0
pts/1
pts/2
pts/3

配置之后的显示

1
2
3
4
5
6
7
8
[root@linux-node3 ~]# vim /etc/securetty
[root@linux-node3 ~]# tail -5 /etc/securetty
xvc0
pts/0
pts/1
pts/2
pts/3
[root@linux-node3 ~]#

　　

启动telnet服务，并设置开机自动启动

1
2
3
4
5
6
7
8
9
10
11
[root@linux-node3 ~]# systemctl enable xinetd
[root@linux-node3 ~]# systemctl enable telnet.socket
symlink/etc/systemd/system/sockets.target.wants/telnet/usr/lib/systemd/system/telnet.socket.
[root@linux-node3 ~]#
[root@linux-node3 ~]# systemctl start telnet.socket
[root@linux-node3 ~]# systemctl start xinetd
[root@linux-node3 ~]# netstat -lntp|grep 23
/systemd
[root@linux-node3 ~]#

　　

切换到telnet方式登录，以后的操作都在telnet终端下操作，防止ssh连接意外中断造成升级失败

telnet方式登录

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
[root@linux-node3 ~]
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
* base: mirrors.163.com
* epel: mirrors.aliyun.com
* extras: mirrors.cn99.com
* updates: mirrors.cn99.com
gcc-4.8.5-36.el7_6.1.x86_64 already installed and latest version
gcc-c++-4.8.5-36.el7_6.1.x86_64 already installed and latest version
Package glibc-2.17-260.el7_6.4.x86_64 already installed and latest version
Package 1:make-3.82-23.el7.x86_64 already installed and latest version
Package autoconf-2.69-11.el7.noarch already installed and latest version
Package 1:openssl-1.0.2k-16.el7_6.1.x86_64 already installed and latest version
Package 1:openssl-devel-1.0.2k-16.el7_6.1.x86_64 already installed and latest version
Package pcre-devel-8.32-17.el7.x86_64 already installed and latest version
Package pam-devel-1.1.8-22.el7.x86_64 already installed and latest version
do
[root@linux-node3 ~]#

　　

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
[root@linux-node3 ~]
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
* base: mirrors.163.com
* epel: mirrors.aliyun.com
* extras: mirrors.cn99.com
* updates: mirrors.cn99.com
Package pam_yubico-2.26-1.el7.x86_64 already installed and latest version
Package pam_script-1.1.8-1.el7.x86_64 already installed and latest version
Package pam_oath-2.4.1-9.el7.x86_64 already installed and latest version
Package pam_snapper-0.2.8-4.el7.x86_64 already installed and latest version
Package pam_ssh_agent_auth-0.10.3-2.16.el7.x86_64 already installed and latest version
Package pam_2fa-1.0-1.el7.x86_64 already installed and latest version
Package pam_mapi-0.3.4-1.el7.x86_64 already installed and latest version
Package pam_ssh_user_auth-1.0-1.el7.x86_64 already installed and latest version
Package pam_mount-2.16-5.el7.x86_64 already installed and latest version
Package pam_radius-1.4.0-3.el7.x86_64 already installed and latest version
Package pamtester-0.1.2-4.el7.x86_64 already installed and latest version
Package pam_afs_session-2.6-5.el7.x86_64 already installed and latest version
Package pam_pkcs11-0.6.2-30.el7.x86_64 already installed and latest version
Package pam-1.1.8-22.el7.x86_64 already installed and latest version
Package pam_ssh-2.3-1.el7.x86_64 already installed and latest version
Package 1:pam_url-0.3.3-4.el7.x86_64 already installed and latest version
Package pam_wrapper-1.0.7-2.el7.x86_64 already installed and latest version
Package pam-kwallet-5.5.2-1.el7.x86_64 already installed and latest version
Package pam-devel-1.1.8-22.el7.x86_64 already installed and latest version
Package pam_krb5-2.4.8-6.el7.x86_64 already installed and latest version
Package zlib-devel-1.2.7-18.el7.x86_64 already installed and latest version
Package zlib-static-1.2.7-18.el7.x86_64 already installed and latest version
Package zlib-1.2.7-18.el7.x86_64 already installed and latest version
Package zlib-ada-1.4-0.5.20120830CVS.el7.x86_64 already installed and latest version
Package zlib-ada-devel-1.4-0.5.20120830CVS.el7.x86_64 already installed and latest version
do
[root@linux-node3 ~]#

　　

下载openssh包和openssl的包

https://openbsd.hk/pub/OpenBSD/OpenSSH/portable/

https://ftp.openssl.org/source/

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
[root@linux-node3 ~]# mkdir /data/tools -p
[root@linux-node3 ~]# cd /data/tools/
/data/tools]# rz -E
rz waiting to receive.
/data/tools]# ll
total 5224
-rw-r--r-- 1 root root 5348369 Apr 27 12:19 openssl-1.0.2r.tar.gz
解压文件
/data/tools]# tar xfz openssl-1.0.2r.tar.gz
/data/tools]# ll
total 5228
tar.gz
/data/tools]# cd
[root@linux-node3 ~]#
现在是系统默认的版本，等会升级完毕对比下
[root@linux-node3 ~]# openssl version
[root@linux-node3 ~]#

　　

　　

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
[root@linux-node3 ~]# ll /usr/bin/openssl
/usr/bin/openssl
[root@linux-node3 ~]# mv /usr/bin/openssl /usr/bin/openssl_bak
[root@linux-node3 ~]# ll /usr/include/openssl
total 1864
......
[root@linux-node3 ~]# mv /usr/include/openssl /usr/include/openssl_bak
[root@linux-node3 ~]#

　　

　　

编译安装新版本的openssl

配置、编译、安装3个命令一起执行

&&符号表示前面的执行成功才会执行后面的

1
2
3
[root@linux-node3 ~]# cd /data/tools/openssl-1.0.2r/
/data/tools/openssl-1.0.2r]# ./config shared && make && make install

　　

以上命令执行完毕，echo $?查看下最后的make install是否有报错，0表示没有问题

1
2
3
4
5
6
7
[root@linux-node3 ~]# ln -s /usr/local/ssl/bin/openssl /usr/bin/openssl
[root@linux-node3 ~]# ln -s /usr/local/ssl/include/openssl /usr/include/openssl
[root@linux-node3 ~]# ll /usr/bin/openssl
/usr/bin/openssl/usr/local/ssl/bin/openssl
[root@linux-node3 ~]# ll /usr/include/openssl -ld
/usr/include/openssl/usr/local/ssl/include/openssl
[root@linux-node3 ~]#

　　

命令行执行下面2个命令加载新配置

1
2
3
echo"/usr/local/ssl/lib"/etc/ld.so.conf
/sbin/ldconfig

　　

1
2
[root@testssh ~]# openssl version

　　

上传openssh的tar包并解压

1
2
3
4
5
6
7
8
9
10
11
12
13
[root@testssh ~]# cd /data/tools/
[root@testssh tools]# ll
total 7628
tar.gz
tar.gz
[root@testssh tools]# tar xfz openssh-8.0p1.tar.gz
[root@testssh tools]# cd openssh-8.0p1
可能文件默认显示uid和gid数组都是1000，这里重新授权下。不授权可能也不影响安装（请自行测试）
[root@testssh tools]# chown -R root.root /data/tools/openssh-8.0p1

　　

　　

然后配置、编译、安装

注意下面编译安装的命令是一行，请把第一行末尾的 \ 去掉，然后在文本里弄成一行之后放命令行执行

1
2
3
4
rm/etc/ssh/*
./configure--prefix=/usr/--sysconfdir=/etc/ssh--with-openssl-includes=/usr/local/ssl/include\
--with-ssl-dir=/usr/local/sslmakemakeinstall

　　

1
2
3
4
5
[root@linux-node3 ~]
yes
[root@linux-node3 ~]
UseDNS no
[root@linux-node3 ~]#

　　

(可能下面的ssh.pam文件都没用到，因为sshd_config配置文件貌似没使用它，请自行测试。我这边是拷贝了)

1
2
3
4
5
6
7
/data/tools/openssh-8.0p1]# cp -a contrib/redhat/sshd.init /etc/init.d/sshd
/data/tools/openssh-8.0p1]# cp -a contrib/redhat/sshd.pam /etc/pam.d/sshd.pam
/data/tools/openssh-8.0p1]# chmod +x /etc/init.d/sshd
/data/tools/openssh-8.0p1]# chkconfig --add sshd
/data/tools/openssh-8.0p1]# systemctl enable sshd
/data/tools/openssh-8.0p1]#

　　

1
2
[root@linux-node3 ~]
[root@linux-node3 ~]

　　

设置sshd服务开机启动

1
2
3
[root@linux-node3 ~]# chkconfig sshd on
'systemctl enable sshd.socket'.
symlink/etc/systemd/system/sockets.target.wants/sshd/usr/lib/systemd/system/sshd.socket.

　　

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
以后管理sshd通过下面方式了
[root@linux-node3 ~]# /etc/init.d/sshd restart
[root@linux-node3 ~]#
[root@linux-node3 ~]#
[root@linux-node3 ~]# netstat -lntp
Active Internet connections (only servers)
/Program
/sshd
/sshd
/systemd
[root@linux-node3 ~]# /etc/init.d/sshd stop
[root@linux-node3 ~]# netstat -lntp
Active Internet connections (only servers)
/Program
/systemd
[root@linux-node3 ~]# /etc/init.d/sshd start
[root@linux-node3 ~]#
[root@linux-node3 ~]#

　　

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
[root@linux-node3 ~]# systemctl stop sshd
[root@linux-node3 ~]# netstat -lntp
Active Internet connections (only servers)
/Program
/systemd
[root@linux-node3 ~]# systemctl start sshd
[root@linux-node3 ~]# netstat -lntp
Active Internet connections (only servers)
/Program
/sshd
/sshd
/systemd
[root@linux-node3 ~]# systemctl restart sshd
[root@linux-node3 ~]# netstat -lntp
Active Internet connections (only servers)
/Program
/sshd
/sshd
/systemd
[root@linux-node3 ~]#

　　

1
2
3
4
5
6
7
8
9
[root@linux-node3 ~]# ssh -V
[root@linux-node3 ~]#
[root@linux-node3 ~]# telnet 127.0.0.1 22
Trying 127.0.0.1...
Connected to 127.0.0.1.
'^]'.
SSH-2.0-OpenSSH_8.0

　　

测试没问题后可以把telnet服务关闭了

1
2
3
4
5
6
[root@linux-node3 ~]# systemctl disable xinetd.service
symlink/etc/systemd/system/multi-user.target.wants/xinetd.service.
[root@linux-node3 ~]# systemctl stop xinetd.service
[root@linux-node3 ~]# systemctl disable telnet.socket
[root@linux-node3 ~]# systemctl stop telnet.socket
[root@linux-node3 ~]# netstat -lntp

注：转载请注明出处

本文转载至：https://www.cnblogs.com/nmap/p/10779658.html ，并对其中错误进行了更正。

来源: https://www.cnblogs.com/Bluesky-bk/p/11330316.html

标签
openssh
telnet
ssh
linux系统
systemd
sshd
etc
systemctl
易学教程内所有资源均来自网络或用户发布的内容，如有违反法律规定的内容欢迎反馈！
该文章没有解决你所遇到的问题?点击提问,说说你的问题,让更多的人一起探讨吧!