前言
因Openssh经常遇到扫描漏洞，许多运维人员不知道该如何安全有效地升级Openssh，于是参考网上相关资料，整理了一份openssh的升级脚本，有需要的请自取。【建议大家遇到此类漏洞，都考虑升级，这样可以最快解决大批量openssh的相关漏洞】
升级的关键点
升级OpenSSH至最新版本【建议都采用此方式，可以同时修复多个openssh相关漏洞】，建议多几篇网上相关文章，做好相关备份，并开启telnet以防止ssh中断【下面的脚本同样有此功能】，按照网上相关库的安装顺序去做对应升级：
https://blog.csdn.net/Astralisxoxo/article/details/121166562
脚本
建议先在相同的测试环境测试脚本可行性，并根据自己系统情况自行做调整，此脚本仅供大家参考【一些字符的格式可能受到影响，请自行调整】
#!/bin/bash
#author: nyc
oldversion=`ssh -V 2>&1`
echo "开始执行 OpenSSH 版本升级脚本"
echo -e "现在的ssh版本是：\033[36m $oldversion \033[0m"
####### 备份旧ssh ######
echo "请自行按如下命令备份旧ssh相关配置"
echo "mv /usr/sbin/sshd /usr/sbin/sshd.bak"
echo "mv /usr/bin/ssh /usr/bin/ssh.bak"
echo "mv /usr/sbin/sshd /usr/sbin/sshd.bak"
read -p "备份完成后直接回车进入下一步：" next
####### 关闭防火墙及selinux ######
echo "开始关闭防火墙及selinux"
systemctl stop firewalld
systemctl disable firewalld
firewall_status=`systemctl status firewalld|grep dead|wc -l`
if [ $firewall_status == 1 ]
then
echo -e "\033[36m防火墙已关闭！\033[0m"
fi
setenforce 0
sed -inr '7s/enforcing/disabled/g' /etc/sysconfig/selinux
sed -inr '7s/enforcing/disabled/g' /etc/selinux/config
if [ $(getenforce|grep -E "Permissive|Disabled"|wc -l) ]&&[ $(sed -nr 7p /etc/sysconfig/selinux|grep disabled|wc -l) ]
then
echo -e '\033[36mselinux 已关闭！\033[0m'
fi
# 安装telnet-server和telnent
echo "检查是否已安装telnet 服务..."
if [ `rpm -qa|grep telnet|wc -l` == 2 ]
then
echo -e "\033[36m已安装telnet-server和telnet服务！\033[0m"
else
echo -e "\033[36m正在安装中，请耐心等待...\033[0m"
yum install xinetd telnet-server telnet -y>>install_telnet.log
if [ `echo $?` == 0 ]
then
echo -e "\033[36mtelnet-server和telnet安装成功！\033[0m"
fi
fi
# 配置telnet-server
if [ `grep pts /etc/securetty|wc -l` -lt 4 ]
then
cat>>/etc/securetty<<EOF
pts/0
pts/1
pts/2
pts/3
EOF
else
echo -e "/etc/securetty已存在\033[36mpts/0,pts/1,pts/2,pts/3\033[0m"
fi
echo "正在启动telnet服务..."
systemctl enable xinetd
systemctl enable telnet.socket
systemctl start telnet.socket
systemctl start xinetd
if [ `rpm -qa|grep net-tools|wc -l` == 1 ]
then
if [ `netstat -tuanp|grep -E ":::23"|wc -l` == 1 ]
then
echo -e "\033[36mtelnet-server服务已开启！\033[0m"
fi
else
yum -y install net-tools>>install_net-tools.log
if [ `netstat -anp|grep 23|wc -l` == 1 ]
then
echo -e "\033[36mtelnet-server服务已开启！\033[0m"
fi
fi
read -p "请在确认telnet可以建立会话后，直接回车进入下一步：" next
if [ -f "/data/tools/install_lib.log" ]
then
echo "依赖包已安装完成"
else
echo "安装依赖包..."
echo -e "\033[36mgcc gcc-c++ glibc make autoconf openssl openssl-devel pcre-devel pam-devel\033[0m"
yum install -y gcc gcc-c++ glibc make autoconf openssl openssl-devel pcre-devel pam-devel>>install_lib.log
echo -e "\033[36mpam* zlib*\033[0m"
yum install -y pam* zlib*>>install_lib.log
fi
echo "检查是否存在/data/tools目录，及软件安装包"
if [ -d "/data/tools/" ]
then
echo "目录已存在，检查是否存在安装包"
if [ -e "/data/tools/openssl-1.1.1m.tar.gz" -a -e "/data/tools/openssh-9.0p1.tar.gz" ]
then
echo "已存在安装包...开始安装..."
else
echo "请上传安装包到/data/tools/目录"
exit
fi
else
mkdir -p /data/tools
echo "已自动创建/data/tools目录，请自行上传安装包到/data/tools/目录"
exit
fi
if [ `openssl version|grep "1.1.1m"|wc -l` -eq "1" ]
then
echo -e "\033[36m已经安装所需版本的openssl\033[0m"
else
echo -e "\033[36m开始安装openssl！\033[0m"
cd /data/tools
tar xfz openssl-1.1.1m.tar.gz
if [ -e "/usr/bin/openssl" -a -d "/usr/include/openssl" ]
then
mv /usr/bin/openssl /usr/bin/openssl_bak
mv /usr/include/openssl /usr/include/openssl_bak
if [ -e "/usr/bin/openssl_bak" -a -d "/usr/include/openssl_bak" ]
then
echo "备份完成！"
fi
fi
echo -e "\033[36m配置、编译、安装！\033[0m"
cd /data/tools/openssl-1.1.1m/
./config shared && make && make install>>install_openssl.log
if [ `echo $?` == 0 ]
then
ln -s /usr/local/lib64/libssl.so.1.1 /usr/lib64/libssl.so.1.1
ln -s /usr/local/lib64/libcrypto.so.1.1 /usr/lib64/libcrypto.so.1.1
echo "/usr/local/lib64/libssl.so.1.1" >> /etc/ld.so.conf
/sbin/ldconfig
if [ -e "/usr/bin/openssl" -a -d "/usr/include/openssl" ]
then
version_ssl=`openssl version`
echo -e "\033[36mopenssl安装成功！当前版本为：$version_ssl\033[0m"
fi
fi
fi
if [[ (`ssh -V 2>&1|grep 9.0p1|wc -l` == 1) && (`ssh -V 2>&1|grep 9.0p1|wc -l` == 1) ]]
then
echo -e "\033[36mopenssh已是9.0p1版本\033[0m"
else
echo -e "\033[36m开始安装openssh！\033[0m"
cd /data/tools/
tar xfz openssh-9.0p1.tar.gz
cd /data/tools/openssh-9.0p1
chown -R root:root /data/tools/openssh-9.0p1
tar -zcf /data/tools/ssh-bak-2022 /etc/ssh/*
rm -rf /etc/ssh/*
cd /data/tools/openssh-9.0p1
./configure --prefix=/usr/local/openssh --sysconfdir=/etc/ssh --with-openssl-includes=/usr/local/include --with-ssl-dir=/usr/local/lib64/ --with-zlib --with-md5-passwords --with-pam && make && make install
if [ `echo $?`==0 ]
then
echo "PermitRootLogin yes">> /etc/ssh/sshd_config
echo "UseDNS no">> /etc/ssh/sshd_config
echo "PubkeyAuthentication yes">> /etc/ssh/sshd_config
echo "UseDNS no">> /etc/ssh/sshd_config
ln -s /usr/local/openssh/bin/ssh /usr/bin/ssh
ln -s /usr/local/openssh/bin/ssh-keygen /usr/bin/ssh-keygen
ln -s /usr/local/openssh/sbin/sshd /usr/sbin/sshd
if [[ (`ssh -V 2>&1|grep 9.0p1|wc -l` == 1) && (`ssh -V 2>&1|grep 9.0p1|wc -l` == 1) ]]
then
echo -e "\033[36mopenssh安装成功\033[0m"
systemctl disable sshd --now
cd /data/tools/openssh-9.0p1
cp -a contrib/redhat/sshd.init /etc/init.d/sshd
cp -a contrib/redhat/sshd.pam /etc/pam.d/sshd.pam
chkconfig --add sshd
systemctl enable sshd --now
else
echo -e "\033[36mopenssh安装失败\033[0m"
fi
fi
fi
echo -e "\033[36m是否关闭或卸载telnet-server？【请务必保证ssh可以正常连接再卸载telnet!!!】\033[0m"""
echo "1. 关闭telnet-server"
echo "2. 卸载telnet-server"
echo "3. 跳过"
read -p "请输入选项：" choice
case $choice in
1)
command
systemctl disable xinetd.service
systemctl stop xinetd.service
systemctl disable telnet.socket
systemctl stop telnet.socket
echo -e "\033[36mtelnet-server已关闭\033[0m"""
;;
2)
if [`rpm -qa|grep telnet-server|wc -l` == 1]
then
read -p "请自行执行命令【rpm -e telnet-server-xxxx】进行卸载，卸载后回车继续下一步" next
else
echo -e "\033[36mtelnet-server已卸载\033[0m"""
fi
;;
*)
esac
while true
do
echo -e "\033[36m是否开启防火墙和selinux？【请确保ssh可以正常连接后再开启，开启后，telnet可能无法连接!!!】\033[0m"""
echo "1. 开启防火墙"
echo "2. 开启selinux"
echo "3. 跳过并退出"
read -p "请输入选项：" choice
case $choice in
1)
command
systemctl start firewalld
systemctl enable firewalld
firewall_status=`systemctl status firewalld|grep active|wc -l`
if [ $firewall_status == 1 ]
then
echo -e "\033[36m防火墙已开启！\033[0m"
fi
;;
2)
command
sed -inr '7s/disabled/enforcing/g' /etc/sysconfig/selinux
sed -inr '7s/disabled/enforcing/g' /etc/selinux/config
setenforce 1
if [ $(getenforce|grep -E "Permissive|enforcing"|wc -l) ]&&[ $(sed -nr 7p /etc/sysconfig/selinux|grep enforcing|wc -l) ]
then
echo -e "\033[36mselinux已开启！\033[0m"""
fi
;;
3)
command
exit
;;
*)
esac
done
483
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
