linux 离线升级openssh服务

前言：

openssh服务依赖openssl服务，需要先升级openssl

1. 安装包准备

openssl包

git clone git://git.openssl.org/openssl.git
cd openssl
git tag
git tag | grep 1.1.1
git co OpenSSL_1_1_1w
git branch
git log
cd ..
tar -zcvf openssl-1.1.1t.tar.gz openssl/*

openssh包

curl -L -O https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-8.8p1.tar.gz

2. 安装升级

openssl

tar -zxvf openssl-1.1.1t.tar.gz 
cd openssl-1.1.1t.tar.gz

./config --prefix=/usr/local/OpenSSL_1_1_1t
make -j 2
make install
mv /usr/bin/openssl /usr/bin/openssl.old
ln -s /usr/local/OpenSSL_1_1_1t/bin/openssl /usr/bin/openssl

更改环境openssl依赖

vi /etc/ld.so.conf.d/openssl.conf
# 新增一行内容：
/usr/local/OpenSSL_1_1_1t/lib

# 配置生效
/sbin/ldconfig -v

openssh

tar -zxvf openssh-8.8p1.tar.gz
# ssl_dir地址为openssl的prefix
./configure --prefix=/usr/local/openssh  --with-ssl-dir=/usr/local/OpenSSL_1_1_1t
make && make install

# 配置ssh
echo 'PermitRootLogin yes' >>/usr/local/openssh/etc/sshd_config
echo 'PubkeyAuthentication yes' >>/usr/local/openssh/etc/sshd_config
echo 'PasswordAuthentication yes' >>/usr/local/openssh/etc/sshd_config

# 更新覆盖原配置及服务
mv /etc/ssh/sshd_config /etc/ssh/sshd_config.bak
cp /usr/local/openssh/etc/sshd_config /etc/ssh/
mv /usr/sbin/sshd /usr/sbin/sshd.bak
cp /usr/local/openssh/sbin/sshd /usr/sbin/sshd
mv /usr/bin/ssh /usr/bin/ssh.bak
cp /usr/local/openssh/bin/ssh /usr/bin/ssh
mv /usr/bin/ssh-keygen /usr/bin/ssh-keygen.bak
cp /usr/local/openssh/bin/ssh-keygen /usr/bin/ssh-keygen
mv /etc/ssh/ssh_host_ecdsa_key.pub /etc/ssh/ssh_host_ecdsa_key.pub.bak
cp /usr/local/openssh/etc/ssh_host_ecdsa_key.pub /etc/ssh/ssh_host_ecdsa_key.pub

# 修改systemd参数（去掉Type或改为Type=simple）
vi /usr/lib/systemd/system/sshd.service 

# 重载
systemctl daemon-reload
systemctl restart sshd
systemctl status sshd

3. 检查版本

ssh -V