centos7 升級openssh到openssh-8.0p1版本

centos7 ssh默認爲openssh7.4p1版本：

[root@localhost ~]# cat /etc/redhat-release
CentOS Linux release 7.6.1810 (Core) 
[root@localhost ~]# 
[root@localhost ~]# ssh -V
OpenSSH_7.4p1, OpenSSL 1.0.2k-fips  26 Jan 2017
[root@localhost ~]# 

1、安裝telnet服務
1.爲了防止ssh鏈接失敗沒法登陸到主機，先安裝一個telnet

yum install -y telnet-server xinetd

2.運行telnet服務

systemctl enable xinetd.service
systemctl enable telnet.socket
systemctl start telnet.socket
systemctl start xinetd.service

3.默認狀況下，系統是不容許root用戶telnet遠程登陸的。若是要使用root用戶直接登陸，需設置以下內容:

echo -e 'pts/0\npts/1\npts/2\npts/3'  >>/etc/securetty

4.重啓telnet服務

systemctl restart xinetd.service

5.測試
能夠中止sshd服務或者殺掉sshd進程，遠程終端將沒法鏈接主機，可使用telnet ip鏈接，則配置成功.
systemctl stop sshd.service
telnet ip
也可使用xshell鏈接，修改協議爲telnet，端口改成23端口,如圖配置.

2、安裝依賴包

1.切換到telnet方式登陸，之後的操做都在telnet終端下操做，防止ssh鏈接意外中斷形成升級失敗.

2.升級須要幾個組件，有些是和編譯相關的等

# yum install  -y gcc gcc-c++ glibc make autoconf openssl openssl-devel pcre-devel  pam-devel

3.安裝pam和zlib等.

# yum install  -y pam* zlib*

3、下載openssh包和openssl的包

openssh下載地址：
https://openbsd.hk/pub/OpenBSD/OpenSSH/portable/

openssl下載地址：

https://ftp.openssl.org/source/

此處我下載的是新的版本，分別是：
openssh-8.0p1.tar.gz
openssl-1.0.2r.tar.gz

4、開始安裝 openssl：

1.開始安裝openssl，把安裝包上傳至/root/soft目錄下,並解壓.

[root@localhost soft]# tar xfz openssl-1.0.2r.tar.gz

如今是系統默認的版本，等會升級完畢對比下

[root@localhost soft]# openssl version
OpenSSL 1.0.2k-fips  26 Jan 2017

2.備份下面2個文件或目錄（若是存在的話就執行）

[root@localhost soft]# ll /usr/bin/openssl
-rwxr-xr-x. 1 root root 555288 Aug  9 09:38 /usr/bin/openssl
[root@localhost soft]# 
[root@localhost soft]# mv /usr/bin/openssl /usr/bin/openssl_bak
[root@localhost soft]# 
[root@localhost soft]# ll /usr/include/openssl
total 1864
-rw-r--r--. 1 root root   6146 Aug  9 09:38 aes.h
-rw-r--r--. 1 root root  63204 Aug  9 09:38 asn1.h
-rw-r--r--. 1 root root  24435 Aug  9 09:38 asn1_mac.h
-rw-r--r--. 1 root root  34475 Aug  9 09:38 asn1t.h
...
[root@localhost soft]#
[root@localhost soft]# mv /usr/include/openssl /usr/include/openssl_bak
[root@localhost soft]# 

3.編譯安裝新版本的openssl

[root@localhost soft]# cd openssl-1.0.2r
[root@localhost openssl-1.0.2r]# ./config shared && make && make install

以上命令執行完畢，echo $?查看下最後的make install是否有報錯，0表示沒有問題
[root@localhost openssl-1.0.2r]# echo $?
0
[root@localhost openssl-1.0.2r]#

4.下面2個文件或者目錄作軟連接

[root@localhost openssl-1.0.2r]# ln -s /usr/local/ssl/bin/openssl /usr/bin/openssl
[root@localhost openssl-1.0.2r]# ln -s /usr/local/ssl/include/openssl /usr/include/openssl
[root@localhost openssl-1.0.2r]# ll /usr/bin/openssl
lrwxrwxrwx. 1 root root 26 Oct 31 23:14 /usr/bin/openssl -> /usr/local/ssl/bin/openssl
[root@localhost openssl-1.0.2r]# ll /usr/include/openssl -ld
lrwxrwxrwx. 1 root root 30 Oct 31 23:14 /usr/include/openssl -> /usr/local/ssl/include/openssl
[root@localhost openssl-1.0.2r]# 

5.命令行執行下面2個命令加載新配置

[root@localhost openssl-1.0.2r]# echo "/usr/local/ssl/lib" >> /etc/ld.so.conf
[root@localhost openssl-1.0.2r]# /sbin/ldconfig

6.查看確認版本，沒問題

[root@localhost openssl-1.0.2r]# openssl version
OpenSSL 1.0.2r  26 Feb 2019

5、安裝openssh

1.上傳並解壓openssh

[root@localhost soft]# tar xfz openssh-8.0p1.tar.gz 
[root@localhost soft]# cd openssh-8.0p1
[root@localhost openssh-8.0p1]# chown -R root.root /root/soft/openssh-8.0p1

2.命令行刪除原先ssh的配置文件和目錄,而後配置、編譯、安裝

[root@localhost openssh-8.0p1]# rm -rf /etc/ssh/*
[root@localhost openssh-8.0p1]# ./configure --prefix=/usr/ --sysconfdir=/etc/ssh  --with-openssl-includes=/usr/local/ssl/include \
 --with-ssl-dir=/usr/local/ssl   --with-zlib   --with-md5-passwords   --with-pam  && make && make install
[root@localhost openssh-8.0p1]# echo $?
0
[root@localhost openssh-8.0p1]# 

3.安裝完成後，須要對配置進行修改，否則可能會遇到root登陸不上去的狀況.最終添加以下兩個內容，其餘的不要動

[root@localhost ~]# grep "^PermitRootLogin"  /etc/ssh/sshd_config
PermitRootLogin yes
[root@localhost ~]# grep  "UseDNS"  /etc/ssh/sshd_config
UseDNS no
[root@localhost ~]# 

4.從原先的解壓的包中拷貝一些文件到目標位置（若是目標目錄存在就覆蓋）

[root@localhost openssh-8.0p1]# cp -a contrib/redhat/sshd.init /etc/init.d/sshd
[root@localhost openssh-8.0p1]# cp -a contrib/redhat/sshd.pam /etc/pam.d/sshd.pam
[root@localhost openssh-8.0p1]# chmod +x /etc/init.d/sshd
[root@localhost openssh-8.0p1]# chkconfig --add sshd
[root@localhost openssh-8.0p1]# systemctl enable sshd

 #把原先的systemd管理的sshd文件刪除或者移走或者刪除，不移走的話影響咱們重啓sshd服務
[root@localhost openssh-8.0p1]# mv  /usr/lib/systemd/system/sshd.service  /tmp/

5.設置sshd服務開機啓動

[root@localhost openssh-8.0p1]# chkconfig sshd on
Note: Forwarding request to 'systemctl enable sshd.socket'.
Created symlink from /etc/systemd/system/sockets.target.wants/sshd.socket to /usr/lib/systemd/system/sshd.socket.

[root@localhost openssh-8.0p1]# systemctl restart sshd.service
[root@localhost openssh-8.0p1]# netstat -lntp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 0.0.0.0:111             0.0.0.0:*               LISTEN      1/systemd           
tcp        0      0 0.0.0.0:20048           0.0.0.0:*               LISTEN      6139/rpc.mountd     
tcp        0      0 0.0.0.0:41811           0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      1869/sshd           
tcp        0      0 0.0.0.0:46303           0.0.0.0:*               LISTEN      6108/rpc.statd      
tcp        0      0 0.0.0.0:2049            0.0.0.0:*               LISTEN      -             
[root@localhost openssh-8.0p1]#

6.測試版本.都正常

[root@localhost openssh-8.0p1]# ssh -V
OpenSSH_8.0p1, OpenSSL 1.0.2r  26 Feb 2019

7.測試沒問題後能夠把telnet服務關閉了

[root@localhost ~]# systemctl disable xinetd.service
[root@localhost ~]# systemctl stop xinetd.service
[root@localhost ~]# systemctl disable telnet.socket
Removed symlink /etc/systemd/system/sockets.target.wants/telnet.socket.
[root@localhost ~]# systemctl stop telnet.socket
[root@localhost ~]# netstat -lntp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 0.0.0.0:111             0.0.0.0:*               LISTEN      1/systemd           
tcp6       0      0 :::3306                 :::*                    LISTEN      3798/mysqld         
tcp6       0      0 :::111                  :::*                    LISTEN      1/systemd           
tcp6       0      0 :::22                   :::*                    LISTEN      1/systemd           
[root@localhost ~]# 

 

參考文檔：https://www.cnblogs.com/caidingyu/p/11100804.html