CVE-2020-15778 openssh8.5p1 RPM升级

1.下载openssh8.5p1升级包

# 历时3天对rpm包优化,已经对100台以上服务器进行了相关测试，优化了bug

centos6系列: https://download.csdn.net/download/ChongDanYiQieHuiYi/15709929

centos7系列: https://download.csdn.net/download/ChongDanYiQieHuiYi/15709939

centos8系列: https://download.csdn.net/download/ChongDanYiQieHuiYi/15709952

centos stream系列: https://download.csdn.net/download/ChongDanYiQieHuiYi/15709952

 

# centos6
[root@localhost noroot]# ls -l
-rw-r--r-- 1 Administrator 197121 2214412 3月  10 09:40 openssh-8.5p1-1.el6.x86_64.rpm
-rw-r--r-- 1 Administrator 197121   47081 3月  10 09:40 openssh-askpass-8.5p1-1.el6.x86_64.rpm
-rw-r--r-- 1 Administrator 197121 2573745 3月  10 09:40 openssh-clients-8.5p1-1.el6.x86_64.rpm
-rw-r--r-- 1 Administrator 197121 1352014 3月  10 09:40 openssh-server-8.5p1-1.el6.x86_64.rpm
-rw-r--r-- 1 Administrator 197121    2108 3月  10 10:24 readme.txt


# centos7
[root@localhost noroot]# ls -l
-rw-r--r-- 1 Administrator 197121  610576 3月  10 09:54 openssh-8.5p1-1.el7.x86_64.rpm
-rw-r--r-- 1 Administrator 197121   44344 3月  10 09:54 openssh-askpass-8.5p1-1.el7.x86_64.rpm
-rw-r--r-- 1 Administrator 197121   25612 3月  10 09:54 openssh-askpass-gnome-8.5p1-1.el7.x86_64.rpm
-rw-r--r-- 1 Administrator 197121  632140 3月  10 09:54 openssh-clients-8.5p1-1.el7.x86_64.rpm
-rw-r--r-- 1 Administrator 197121 3110544 3月  10 09:54 openssh-debuginfo-8.5p1-1.el7.x86_64.rpm
-rw-r--r-- 1 Administrator 197121  460964 3月  10 09:54 openssh-server-8.5p1-1.el7.x86_64.rpm
-rw-r--r-- 1 Administrator 197121  504996 8月  23  2019 openssl-1.0.2k-19.el7.x86_64.rpm
-rw-r--r-- 1 Administrator 197121 1581408 8月  23  2019 openssl-devel-1.0.2k-19.el7.x86_64.rpm
-rw-r--r-- 1 Administrator 197121 1254680 8月  23  2019 openssl-libs-1.0.2k-19.el7.x86_64.rpm
-rw-r--r-- 1 Administrator 197121    2974 3月  10 16:13 readme.txt



# centos8
[root@localhost noroot]# ls
-rw-r--r-- 1 Administrator 197121  706748 3月  10 14:35 openssh-8.5p1-1.el8.x86_64.rpm
-rw-r--r-- 1 Administrator 197121   50084 3月  10 14:35 openssh-askpass-8.5p1-1.el8.x86_64.rpm
-rw-r--r-- 1 Administrator 197121   61024 3月  10 14:35 openssh-askpass-debuginfo-8.5p1-1.el8.x86_64.rpm
-rw-r--r-- 1 Administrator 197121   31020 3月  10 14:35 openssh-askpass-gnome-8.5p1-1.el8.x86_64.rpm
-rw-r--r-- 1 Administrator 197121   42580 3月  10 14:35 openssh-askpass-gnome-debuginfo-8.5p1-1.el8.x86_64.rpm
-rw-r--r-- 1 Administrator 197121  658520 3月  10 14:35 openssh-clients-8.5p1-1.el8.x86_64.rpm
-rw-r--r-- 1 Administrator 197121 1378448 3月  10 14:35 openssh-clients-debuginfo-8.5p1-1.el8.x86_64.rpm
-rw-r--r-- 1 Administrator 197121 1026736 3月  10 14:35 openssh-debuginfo-8.5p1-1.el8.x86_64.rpm
-rw-r--r-- 1 Administrator 197121  698944 3月  10 14:35 openssh-debugsource-8.5p1-1.el8.x86_64.rpm
-rw-r--r-- 1 Administrator 197121  482464 3月  10 14:35 openssh-server-8.5p1-1.el8.x86_64.rpm
-rw-r--r-- 1 Administrator 197121  890744 3月  10 14:35 openssh-server-debuginfo-8.5p1-1.el8.x86_64.rpm
-rw-r--r-- 1 Administrator 197121  723632 12月 18 09:04 openssl-1.1.1g-12.el8_3.x86_64.rpm
-rw-r--r-- 1 Administrator 197121 2432596 12月 18 09:04 openssl-devel-1.1.1g-12.el8_3.x86_64.rpm
-rw-r--r-- 1 Administrator 197121   30884 7月   2  2019 openssl-ibmpkcs11-1.0.2-1.el8.x86_64.rpm
-rw-r--r-- 1 Administrator 197121 1533216 12月 18 09:04 openssl-libs-1.1.1g-12.el8_3.x86_64.rpm
-rw-r--r-- 1 Administrator 197121   81712 12月 18 09:04 openssl-perl-1.1.1g-12.el8_3.x86_64.rpm
-rw-r--r-- 1 Administrator 197121   67548 4月  10  2020 openssl-pkcs11-0.4.10-2.el8.x86_64.rpm
-rw-r--r-- 1 Administrator 197121    3649 3月  10 16:14 readme.txt


# centos stream
[root@localhost noroot]# ls
-rw-r--r-- 1 Administrator 197121  706748 3月  10 14:35 openssh-8.5p1-1.el8.x86_64.rpm
-rw-r--r-- 1 Administrator 197121   50084 3月  10 14:35 openssh-askpass-8.5p1-1.el8.x86_64.rpm
-rw-r--r-- 1 Administrator 197121   61024 3月  10 14:35 openssh-askpass-debuginfo-8.5p1-1.el8.x86_64.rpm
-rw-r--r-- 1 Administrator 197121   31020 3月  10 14:35 openssh-askpass-gnome-8.5p1-1.el8.x86_64.rpm
-rw-r--r-- 1 Administrator 197121   42580 3月  10 14:35 openssh-askpass-gnome-debuginfo-8.5p1-1.el8.x86_64.rpm
-rw-r--r-- 1 Administrator 197121  658520 3月  10 14:35 openssh-clients-8.5p1-1.el8.x86_64.rpm
-rw-r--r-- 1 Administrator 197121 1378448 3月  10 14:35 openssh-clients-debuginfo-8.5p1-1.el8.x86_64.rpm
-rw-r--r-- 1 Administrator 197121 1026736 3月  10 14:35 openssh-debuginfo-8.5p1-1.el8.x86_64.rpm
-rw-r--r-- 1 Administrator 197121  698944 3月  10 14:35 openssh-debugsource-8.5p1-1.el8.x86_64.rpm
-rw-r--r-- 1 Administrator 197121  482464 3月  10 14:35 openssh-server-8.5p1-1.el8.x86_64.rpm
-rw-r--r-- 1 Administrator 197121  890744 3月  10 14:35 openssh-server-debuginfo-8.5p1-1.el8.x86_64.rpm
-rw-r--r-- 1 Administrator 197121  723632 12月 18 09:04 openssl-1.1.1g-12.el8_3.x86_64.rpm
-rw-r--r-- 1 Administrator 197121 2432596 12月 18 09:04 openssl-devel-1.1.1g-12.el8_3.x86_64.rpm
-rw-r--r-- 1 Administrator 197121   30884 7月   2  2019 openssl-ibmpkcs11-1.0.2-1.el8.x86_64.rpm
-rw-r--r-- 1 Administrator 197121 1533216 12月 18 09:04 openssl-libs-1.1.1g-12.el8_3.x86_64.rpm
-rw-r--r-- 1 Administrator 197121   81712 12月 18 09:04 openssl-perl-1.1.1g-12.el8_3.x86_64.rpm
-rw-r--r-- 1 Administrator 197121   67548 4月  10  2020 openssl-pkcs11-0.4.10-2.el8.x86_64.rpm
-rw-r--r-- 1 Administrator 197121    3649 3月  10 16:14 readme.txt

 

注意事项:

1.目前测试redhat6/7/8/stream版本没有异常，有问题及时发给我修复bug

2.建议先备份/etc/ssh/sshd_config

3.每个centos6/7/8/stream系列分为(root用户登录版)及(禁止root用户登录版)

  a.root用户登录版: 可以直接使用登录工具直接用root用户登录
  b.禁止root用户登录版: 前提需要有一个普通用户并且设置密码，使用终端工具使用普通登录登录之后利用su - root进行切换登录root！！

 

 

2.升级步骤

# 升级openssl

• centos6.5以下升级openssl至最新版本
• centos6.5-6.10/7/8/stream 以上建议升级至最新版本

# centos6
[root@localhost Desktop]# rpm -Uvh openssl-1.0.1e-57.el6.x86_64.rpm openssl-devel-1.0.1e-57.el6.x86_64.rpm 
warning: openssl-1.0.1e-57.el6.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID fd431d51: NOKEY
Preparing...                ########################################### [100%]
   1:openssl                ########################################### [ 50%]
   2:openssl-devel          ########################################### [100%]

# centos7
[root@localhost ~]# rpm -Uvh openssl-1.0.2k-19.el7.x86_64.rpm openssl-libs-1.0.2k-19.el7.x86_64.rpm openssl-devel-1.0.2k-19.el7.x86_64.rpm
warning: openssl-1.0.2k-19.el7.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID f4a80eb5: NOKEY
Preparing...                          ################################# [100%]
Updating / installing...
   1:openssl-libs-1:1.0.2k-19.el7     ################################# [ 17%]
   2:openssl-1:1.0.2k-19.el7          ################################# [ 33%]
   3:openssl-devel-1:1.0.2k-19.el7    ################################# [ 50%]
Cleaning up / removing...
   4:openssl-devel-1:1.0.1e-42.el7_1.9################################# [ 67%]
   5:openssl-1:1.0.1e-42.el7_1.9      ################################# [ 83%]
   6:openssl-libs-1:1.0.1e-42.el7_1.9 ################################# [100%]

# centos8
[root@localhost houlei]# rpm -Uvh openssl-1.1.1g-12.el8_3.x86_64.rpm openssl-devel-1.1.1g-12.el8_3.x86_64.rpm openssl-libs-1.1.1g-12.el8_3.x86_64.rpm
Verifying...                          ################################# [100%]
Preparing...                          ################################# [100%]
Updating / installing...
   1:openssl-libs-1:1.1.1g-12.el8_3   ################################# [ 17%]
   2:openssl-1:1.1.1g-12.el8_3        ################################# [ 33%]
   3:openssl-devel-1:1.1.1g-12.el8_3  ################################# [ 50%]
Cleaning up / removing...
   4:openssl-1:1.1.1-8.el8            ################################# [ 67%]
   5:openssl-devel-1:1.1.1-8.el8      ################################# [ 83%]
   6:openssl-libs-1:1.1.1-8.el8       ################################# [100%]

# centos stream
[root@localhost houlei]# rpm -Uvh openssl-1.1.1g-12.el8_3.x86_64.rpm openssl-devel-1.1.1g-12.el8_3.x86_64.rpm openssl-libs-1.1.1g-12.el8_3.x86_64.rpm
Verifying...                          ################################# [100%]
Preparing...                          ################################# [100%]
Updating / installing...
   1:openssl-libs-1:1.1.1g-12.el8_3   ################################# [ 17%]
   2:openssl-1:1.1.1g-12.el8_3        ################################# [ 33%]
   3:openssl-devel-1:1.1.1g-12.el8_3  ################################# [ 50%]
Cleaning up / removing...
   4:openssl-1:1.1.1-8.el8            ################################# [ 67%]
   5:openssl-devel-1:1.1.1-8.el8      ################################# [ 83%]
   6:openssl-libs-1:1.1.1-8.el8       ################################# [100%]

# 升级openssh

# centos6
[root@loaclhost Desktop]# ls
openssh-8.5p1-1.el6.x86_64.rpm          openssh-clients-8.5p1-1.el6.x86_64.rpm
openssh-askpass-8.5p1-1.el6.x86_64.rpm  openssh-server-8.5p1-1.el6.x86_64.rpm
[root@loaclhost Desktop]# rpm -Uvh openssh-8.5p1-1.el6.x86_64.rpm openssh-clients-8.5p1-1.el6.x86_64.rpm openssh-server-8.5p1-1.el6.x86_64.rpm openssh-askpass-8.5p1-1.el6.x86_64.rpm 
Preparing...                ########################################### [100%]
   1:openssh                ########################################### [ 25%]
   2:openssh-clients        ########################################### [ 50%]
   3:openssh-server         ########################################### [ 75%]
/var/tmp/rpm-tmp.rchI3M: line 18: /usr/bin/chmod: No such file or directory
   4:openssh-askpass        ########################################### [100%]
[root@loaclhost Desktop]# 
[root@loaclhost Desktop]# sshd -V
unknown option -- V
OpenSSH_8.5p1, OpenSSL 1.0.1e-fips 11 Feb 2013
usage: sshd [-46DdeiqTt] [-C connection_spec] [-c host_cert_file]
            [-E log_file] [-f config_file] [-g login_grace_time]
            [-h host_key_file] [-o option] [-p port] [-u len]


# centos7
[root@localhost ~]# rpm -Uvh openssh-8.5p1-1.el7.x86_64.rpm openssh-clients-8.5p1-1.el7.x86_64.rpm openssh-server-8.5p1-1.el7.x86_64.rpm
Preparing...                          ################################# [100%]
Updating / installing...
   1:openssh-8.5p1-1.el7              ################################# [ 17%]
   2:openssh-clients-8.5p1-1.el7      ################################# [ 33%]
   3:openssh-server-8.5p1-1.el7       ################################# [ 50%]
Cleaning up / removing...
   4:openssh-server-7.4p1-21.el7      ################################# [ 67%]
   5:openssh-clients-7.4p1-21.el7     ################################# [ 83%]
   6:openssh-7.4p1-21.el7             ################################# [100%]

# centos8
[root@localhost noroot]# rpm -Uvh openssh-8.5p1-1.el8.x86_64.rpm openssh-clients-8.5p1-1.el8.x86_64.rpm openssh-server-8.5p1-1.el8.x86_64.rpm openssh-askpass-8.5p1-1.el8.x86_64.rpm 
Verifying...                          ################################# [100%]
Preparing...                          ################################# [100%]
Updating / installing...
   1:openssh-8.5p1-1.el8              ################################# [ 14%]
   2:openssh-clients-8.5p1-1.el8      ################################# [ 29%]
   3:openssh-server-8.5p1-1.el8       ################################# [ 43%]
   4:openssh-askpass-8.5p1-1.el8      ################################# [ 57%]
Cleaning up / removing...
   5:openssh-server-7.8p1-4.el8       ################################# [ 71%]
   6:openssh-clients-7.8p1-4.el8      ################################# [ 86%]
   7:openssh-7.8p1-4.el8              ################################# [100%]


# centos stream
[root@localhost noroot]# rpm -Uvh openssh-8.5p1-1.el8.x86_64.rpm openssh-clients-8.5p1-1.el8.x86_64.rpm openssh-server-8.5p1-1.el8.x86_64.rpm openssh-askpass-8.5p1-1.el8.x86_64.rpm 
Verifying...                          ################################# [100%]
Preparing...                          ################################# [100%]
Updating / installing...
   1:openssh-8.5p1-1.el8              ################################# [ 14%]
   2:openssh-clients-8.5p1-1.el8      ################################# [ 29%]
   3:openssh-server-8.5p1-1.el8       ################################# [ 43%]
   4:openssh-askpass-8.5p1-1.el8      ################################# [ 57%]
Cleaning up / removing...
   5:openssh-server-7.8p1-4.el8       ################################# [ 71%]
   6:openssh-clients-7.8p1-4.el8      ################################# [ 86%]
   7:openssh-7.8p1-4.el8              ################################# [100%]

# 验证版本

[root@localhost noroot]# sshd -v
unknown option -- v
OpenSSH_8.5p1, OpenSSL 1.1.1 FIPS  11 Sep 2018
usage: sshd [-46DdeiqTt] [-C connection_spec] [-c host_cert_file]
            [-E log_file] [-f config_file] [-g login_grace_time]
            [-h host_key_file] [-o option] [-p port] [-u len]

3.异常处理

# CRT和跳板机,由于sshd升级弱算法将不采用

Key exchange failed.
No compatible key exchange method. The server supports these methods: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256
No compatible hostkey. The server supports these methods: ssh-ed25519

 

# 一般不建议添加此项配置

cat >>/etc/ssh/sshd_config <<-EOF
KexAlgorithms diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256
EOF

# centos7/8/stream
systemctl restart sshd 

# centos6
service sshd restart

 

 

4.安全扫描合规

# 绿盟扫描

# Nessus

 

# 启明星辰--天镜