openssh升级通用版

1、检查openssh 和openssl版本及rpm包情况
[root@pxc3 ~]# ssh -V
[root@pxc3 ~]# openssl version

2、安装gcc及zlib，如已有则跳过
[root@pxc3 ~]# yum install gcc
[root@pxc3 ~]# tar -xvzf zlib-1.2.13.tar.gz
[root@pxc3 ~]# cd zlib-1.2.13
[root@pxc3 zlib-1.2.13]# ./configure --prefix=/usr/local/zlib
[root@pxc3 zlib-1.2.13]# make && make install
[root@pxc3 zlib-1.2.13]# echo '/usr/local/zlib/lib' >> /etc/ld.so.conf
[root@pxc3 zlib-1.2.13]# ldconfig -v

3、升级openssl
[root@pxc3 ~]# tar -xvzf openssl-1.1.1t.tar.gz
[root@pxc3 ~]# cd openssl-1.1.1t
[root@pxc3 openssl-1.1.1t]# ./config --prefix=/usr/local/openssl-1.1.1t -shared
[root@pxc3 openssl-1.1.1t]# make && make install

这一步如果如果报sh: pod2html: command not found 需要安装相关依赖

做软链接，使用新新安装的openssl
[root@pxc3 openssl-1.1.1t]# mv /usr/bin/openssl /usr/bin/openssl_old
ln -sf /usr/local/openssl-1.1.1t /usr/local/openssl
ln -sf /usr/local/openssl/bin/openssl /usr/bin/openssl
ln -sf /usr/local/openssl/include/openssl/ /usr/include/openssl
ln -sf /usr/local/openssl/lib/libssl.so.1.1 /usr/lib64/libssl.so.1.1
ln -sf /usr/local/openssl/lib/libcrypto.so.1.1 /usr/lib64/libcrypto.so.1.1
echo "/usr/lib64/">>/etc/ld.so.conf
echo "/usr/local/openssl/lib/">>/etc/ld.so.conf
ldconfig -v

openssl version

4、升级openssh
rpm -ivh /mnt/Packages/pam-devel-1.1.8-23.el7.x86_64.rpm
[root@pxc3 ~]# tar -xvzf openssh-9.2p1.tar.gz
[root@pxc3 ~]# cd openssh-9.2p1
[root@localhost openssh-9.2p1]# ./configure --prefix=/usr --with-zlib=/usr/local/zlib --with-ssl-dir=/usr/bin/openssl --with-pam
或者 ./configure --prefix=/usr --with-zlib=/usr/local/zlib --with-ssl-dir=/usr/local/openssl --with-pam --without-openssl-header-check
[root@pxc3 openssh-9.2p1]# rpm -e openssh-server-7.4p1-21.el7.x86_64
[root@pxc3 openssh-9.2p1]# make && make install
[root@pxc3 openssh-9.2p1]# cp contrib/redhat/sshd.init /etc/init.d/sshd
chmod a+x /etc/init.d/sshd
mv /usr/lib/systemd/system/sshd.service /usr/lib/systemd/system/sshd.service.bak
[root@pxc3 openssh-9.2p1]# echo 'PermitRootLogin yes' >>/usr/etc/sshd_config
[root@pxc3 openssh-9.2p1]# echo 'PubkeyAuthentication yes' >>/usr/etc/sshd_config
[root@pxc3 openssh-9.2p1]# echo 'PasswordAuthentication yes' >>/usr/etc/sshd_config
echo 'UsePAM yes' >>/usr/etc/sshd_config
echo "HostKeyAlgorithms=+ssh-rsa,ssh-dss">>/usr/etc/sshd_config
echo "KexAlgorithms=+diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1">>/usr/etc/sshd_config
[root@localhost openssh-9.2p1]# mv /usr/local/bin/ssh /usr/local/bin/ssh.bak
[root@localhost openssh-9.2p1]# cp /usr/bin/ssh /usr/local/bin/ssh
[root@localhost openssh-9.2p1]# chmod -R 755 /usr/local/openssl-1.1.1t/
[root@pxc3 openssh-9.2p1]# systemctl daemon-reload
[root@pxc3 openssh-9.2p1]# systemctl restart sshd
chkconfig sshd on

mv libnsl-2.17.so /lib64/
ln -sf /lib64/libnsl-2.17.so /lib64/libnsl.so.1