Linux升级openssh及问题总结

因第三方监控软件扫描Linux ssh存在漏洞，此次需将openssh升级至OpenSSH_7.1p2

系统版本：

[root@db ~]# uname -a
Linux db 2.6.32-431.el6.x86_64 #1 SMP Sun Nov 10 22:19:54 EST 2013 x86_64 x86_64 x86_64 GNU/Linux
[root@db ~]# cat /etc/redhat-release 
Red Hat Enterprise Linux Server release 6.5 (Santiago)

升级步骤：

1、验证现有版本

[root@db 1]# yum install pam-devel

[root@db 1]# pwd
/home/1
[root@db 1]# ls
openssh-7.1p2  openssl-1.1.0-pre3  zlib-1.2.8
[root@db 1]# ssh -V
OpenSSH_5.3p1, OpenSSL 1.0.0-fips 29 Mar 2010      <<<--当前ssh版本
[root@db 1]# openssl version
OpenSSL 1.0.1e-fips 11 Feb 2013
[root@db 1]# rpm -q zlib
zlib-1.2.3-29.el6.x86_64
[root@db 1]#  rpm -qa | grep openssl  
openssl-1.0.1e-15.el6.x86_64
[root@db 1]#  rpm -qa | grep openssh
openssh-5.3p1-94.el6.x86_64
openssh-clients-5.3p1-94.el6.x86_64
openssh-server-5.3p1-94.el6.x86_64
openssh-askpass-5.3p1-94.el6.x86_64

2、卸载现有版本
[root@db 1]# rpm -e `rpm -qa | grep openssh`
error: Failed dependencies:
        openssh-clients is needed by (installed) python-meh-0.12.1-3.el6.noarch
[root@db 1]# rpm -e `rpm -qa | grep openssl` --nodeps 
[root@db 1]# rpm -e firstboot-1.110.15-1.el6.x86_64
[root@db 1]# rpm -e python-meh-0.12.1-3.el6.noarch
[root@db 1]# rpm -e `rpm -qa | grep openssh`
[root@db 1]# yum install firstboot
There was a problem importing one of the Python modules
required to run yum. The error leading to this problem was:


   libssl.so.10: cannot open shared object file: No such file or directory


Please install a package which provides this module, or
verify that the module is installed correctly.


It's possible that the above module doesn't match the
current version of Python, which is:
2.6.6 (r266:84292, Sep  4 2013, 07:46:00) 
[GCC 4.4.7 20120313 (Red Hat 4.4.7-3)]


If you cannot solve this problem yourself, please go to 
the yum faq at:
  http://yum.baseurl.org/wiki/Faq
  

3、安装zlib
[root@db 1]# cd zlib-1.2.8/
[root@db zlib-1.2.8]# ls
[root@db zlib-1.2.8]#  ./configure  --prefix=/usr/local/zlib
[root@db zlib-1.2.8]# make  &&  make install  
[root@db zlib-1.2.8]# cd ../openssl-1.1.0-pre3/
[root@db openssl-1.1.0-pre3]# ./config  --prefix=/usr/local/openssl   
[root@db openssl-1.1.0-pre3]# make &&  make install  

4、安装openssh
[root@db openssl-1.1.0-pre3]# cd ../openssh-7.1p2/
[root@db openssh-7.1p2]# ./configure --prefix=/usr/local/openssh --sysconfdir=/etc/ssh --with-pam --with-ssl-dir=/usr/local/openssl --with-md5-passwords --mandir=/usr/share/man --with-zlib=/usr/local/zlib 
checking for gcc... gcc
...
configure: error: *** OpenSSL headers missing - please install first or check config.log ***


[root@db openssh-7.1p2]# rpm -qa |grep pam
pam-1.1.1-17.el6.x86_64
pam-devel-1.1.1-17.el6.x86_64
pam_krb5-2.3.11-9.el6.x86_64
pam_passwdqc-1.0.5-6.el6.x86_64
pam-devel-1.1.1-17.el6.i686
fprintd-pam-0.1-21.git04fd09cfa.el6.x86_64
pam-1.1.1-17.el6.i686
gnome-keyring-pam-2.28.2-8.el6_3.x86_64
[root@db openssh-7.1p2]# ./configure --prefix=/usr/local/openssh --sysconfdir=/etc/ssh --with-pam --with-ssl-dir=/usr/local/openssl --with-md5-passwords --mandir=/usr/share/man --with-zlib=/usr/local/zlib ^C


[root@db openssh-7.1p2]# rpm -ivh /media/rhel/Packages/openssl-1.0.1e-15.el6.x86_64.rpm 
Preparing...                ########################################### [100%]
   1:openssl                ########################################### [100%]


[root@db openssh-7.1p2]# rpm -ivh openssl-1.0.1e-15.el6.x86_64.rpm 
[root@db openssh-7.1p2]# ./configure --prefix=/usr/local/openssh --sysconfdir=/etc/ssh --with-pam --with-ssl-dir=/usr/local/openssl --with-md5-passwords --mandir=/usr/share/man --with-zlib=/usr/local/zlib 
checking for gcc... gcc
...
configure: error: *** OpenSSL headers missing - please install first or check config.log ***
[root@db openssh-7.1p2]# openssl version -a
OpenSSL 1.0.1e-fips 11 Feb 2013
built on: Fri Sep 27 10:09:12 EDT 2013
platform: linux-x86_64
options:  bn(64,64) md2(int) rc4(16x,int) des(idx,cisc,16,int) idea(int) blowfish(idx) 
compiler: gcc -fPIC -DOPENSSL_PIC -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DKRB5_MIT -m64 -DL_ENDIAN -DTERMIO -Wall -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic -Wa,--noexecstack -DPURIFY -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM
OPENSSLDIR: "/etc/pki/tls"
engines:  rdrand dynamic 
[root@db openssh-7.1p2]# 
[root@db openssh-7.1p2]# rpm -qa |grep gcc
gcc-4.4.7-4.el6.x86_64
gcc-c++-4.4.7-4.el6.x86_64
libgcc-4.4.7-4.el6.x86_64
libgcc-4.4.7-4.el6.i686
[root@db openssh-7.1p2]# rpm -qa |grep openssl-devel
[root@db openssh-7.1p2]# cd /media/rhel/Packages/
[root@db Packages]# rpm -ivh openssl-devel-1.0.1e-15.el6.x86_64.rpm 
error: Failed dependencies:
        krb5-devel is needed by openssl-devel-1.0.1e-15.el6.x86_64
        zlib-devel is needed by openssl-devel-1.0.1e-15.el6.x86_64
[root@db Packages]# rpm -ivh krb5-devel-1.10.3-10.el6_4.6.x86_64.rpm 
error: Failed dependencies:
        keyutils-libs-devel is needed by krb5-devel-1.10.3-10.el6_4.6.x86_64
        libcom_err-devel is needed by krb5-devel-1.10.3-10.el6_4.6.x86_64
        libselinux-devel is needed by krb5-devel-1.10.3-10.el6_4.6.x86_64
[root@db Packages]# rpm -ivh keyutils-libs-devel
error: open of keyutils-libs-devel failed: No such file or directory
[root@db Packages]# rpm -ivh keyutils-libs-devel-1.4-4.el6.x86_64.rpm 
Preparing...                ########################################### [100%]
   1:keyutils-libs-devel    ########################################### [100%]
[root@db Packages]# rpm -ivh libcom_err-devel-1.41.12-18.el6.x86_64.rpm 
Preparing...                ########################################### [100%]
   1:libcom_err-devel       ########################################### [100%]
[root@db Packages]# rpm -ivh libselinux-devel-2.0.94-5.3.el6_4.1.x86_64.rpm 
error: Failed dependencies:
        libsepol-devel >= 2.0.32-1 is needed by libselinux-devel-2.0.94-5.3.el6_4.1.x86_64
        pkgconfig(libsepol) is needed by libselinux-devel-2.0.94-5.3.el6_4.1.x86_64
[root@db Packages]# yum install libsepol-devel



[root@db Packages]# cd /home/1/openssh-7.1p2/
[root@db openssh-7.1p2]# ./configure --prefix=/usr/local/openssh --sysconfdir=/etc/ssh --with-pam --with-ssl-dir=/usr/local/openssl --with-md5-passwords --mandir=/usr/share/man --with-zlib=/usr/local/zlib 


[root@db openssh-7.1p2]# make && make install 


5、设置ssh服务
[root@db openssh-7.1p2]# cp -p contrib/redhat/sshd.init /etc/init.d/sshd
[root@db openssh-7.1p2]# chmod u+x /etc/init.d/sshd  
[root@db openssh-7.1p2]# chkconfig --add sshd  

[root@db 1]# cp /usr/local/openssh/sbin/sshd  /usr/sbin/sshd  
[root@db 1]# service sshd start 
/etc/init.d/sshd: line 41: /usr/bin/ssh-keygen: No such file or directory
Starting sshd:[  OK  ]
[root@db 1]# find / -name ssh
/etc/ssh
/usr/local/openssh/bin/ssh
/home/1/openssh-7.1p2/ssh
[root@db 1]# /usr/local/openssh/bin/ssh -V
OpenSSH_7.1p2, OpenSSL 1.0.1e-fips 11 Feb 2013
[root@db 1]# cp /usr/local/openssh/bin/ssh /usr/bin/

6、验证升级后版本及重启测试服务
[root@db 1]# ssh -V
OpenSSH_7.1p2, OpenSSL 1.0.1e-fips 11 Feb 2013
[root@db 1]# 
[root@db 1]# 
[root@db 1]# service sshd restart
Stopping sshd:[  OK  ]
/etc/init.d/sshd: line 41: /usr/bin/ssh-keygen: No such file or directory
Starting sshd:[  OK  ]


[root@db ~]# cd /usr/local/openssh/bin
[root@db bin]# ls
scp  sftp  slogin  ssh  ssh-add  ssh-agent  ssh-keygen  ssh-keyscan
[root@db bin]# cp ssh-keygen /usr/bin/
[root@db bin]# service sshd restart
Stopping sshd:[  OK  ]
Starting sshd:[  OK  ]
[root@db bin]# 
[root@db bin]# ssh -V
OpenSSH_7.1p2, OpenSSL 1.0.1e-fips 11 Feb 2013

7、设置允许root用户远程登录
[root@db ~]# cat /etc/ssh/sshd_config 
# Authentication:
...
#LoginGraceTime 2m
PermitRootLogin yes




8、SecureCRT不能上传文件的解决办法：
将 /etc/ssh/sshd_config 中的
Subsystem      sftp    /usr/libexec/openssh/sftp-server 
改为
Subsystem       sftp    internal-sftp
重启sshd后，sftp正常工作了。



9、升级后的问题

使用SecureCRT ssh协议连接正常，但使用其他工具无法远程连接操作系统：

解决方法：

=================================================================

参考网上解决方法如下：

修改sshd的配置文件 /etc/ssh/sshd_config

在配置文件中添加：

Ciphers aes128-cbc,aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr,3des-cbc,arcfour128,arcfour256,arcfour,blowfish-cbc,cast128-cbc

MACs hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160,hmac-sha1-96,hmac-md5-96

KexAlgorithms diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,curve25519-sha256@libssh.org

导致此问题的原因是ssh升级后，为了安全，默认不再采用原来一些加密算法，我们手工添加进去即可。

（添加三行或者添加最后一行，重启服务都报错如下）

但重启服务报错如下：

[ root@db ~]# service sshd restart

Stopping sshd:[  OK  ]

Starting sshd:Unsupported KEX algorithm " ecdh-sha2-nistp521"

/etc/ssh/sshd_config line 137: Bad SSH2 KexAlgorithms 'diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1, curve25519-sha256@libssh.org'.

[FAILED]

[ root@db ~]# 

=================================================================

修改为如下：

Ciphers aes128-cbc,aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr,3des-cbc,arcfour128,arcfour256,arcfour,blowfish-cbc,cast128-cbc

MACs hmac-md5,hmac-sha1, umac-64@openssh.com,hmac-ripemd160,hmac-sha1-96,hmac-md5-96

KexAlgorithms diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,ecdh-sha2-nistp256,ecdh-sha2-nistp384,diffie-hellman-group1-sha1, curve25519-sha256@libssh.org    （此行中去掉ecdh-sha2-nistp521）

启动sshd服务即可：