Kylin Server V10下OpenSSH安全漏洞离线修复脚本

1．查看操作系统信息

[root@localhost ~]# cat /etc/.kyinfo

2．查看SSH信息

[root@localhost ~]# ssh -V

OpenSSH_8.2p1, OpenSSL 1.1.1f  31 Mar 2020

3．查看目录结构

[root@localhost openssh]#ls

openssh.tar.gz是openssh二进制压缩包

4. 编辑setup.sh

[root@localhost openssh]#vi setup.sh

###########################################################################################
#  @programe  : openssh_setup.sh 
#  @version   : 0.0.1                                                       
#  @function@ : 
#  @campany   : 
#  @dep.      :                                         
#  @writer    : Liu Cheng Ji                                              
#  @date      : 2024-02-04                                                
##########################################################################################
#!/bin/bash

tar -zxvf openssh.tar.gz -C /usr/local/

openssh_version=`ssh -V 2>&1 | awk -F "," '{print $1}'`
openssh_version_num=${openssh_version:8: 3}

if [ -f /lib/systemd/system/sshd.service ];then
	mv /lib/systemd/system/sshd.service /lib/systemd/system/sshd_$openssh_version_num.service
	cp ./config/sshd.service /lib/systemd/system/
fi

chown root:root /lib/systemd/system/sshd.service
chmod 0644 /lib/systemd/system/sshd.service

cp ./config/sshd.conf /usr/lib/tmpfiles.d/
chown root:root /usr/lib/tmpfiles.d/sshd.conf
chmod 0644 /usr/lib/tmpfiles.d/sshd.conf
systemd-tmpfiles --create /usr/lib/tmpfiles.d/sshd.conf

mv /usr/bin/ssh 		/usr/bin/ssh_$openssh_version_num
mv /usr/bin/scp 		/usr/bin/scp_$openssh_version_num
mv /usr/sbin/sshd 		/usr/sbin/sshd_$openssh_version_num
mv /usr/bin/ssh-add 		/usr/bin/ssh-add_$openssh_version_num
mv /usr/bin/ssh-agent 		/usr/bin/ssh-agent_$openssh_version_num
mv /usr/bin/ssh-keygen 		/usr/bin/ssh-keygen_$openssh_version_num
mv /usr/bin/ssh-keyscan 	/usr/bin/ssh-keyscan_$openssh_version_num

update-alternatives --install /usr/bin/ssh       	ssh       	/usr/local/openssh/bin/ssh		9
update-alternatives --install /usr/bin/scp     		scp        	/usr/local/openssh/bin/scp		9
update-alternatives --install /usr/sbin/sshd     	sshd        	/usr/local/openssh/sbin/sshd    	9
update-alternatives --install /usr/bin/ssh-add     	ssh-add         /usr/local/openssh/bin/ssh-add		9
update-alternatives --install /usr/bin/ssh-agent    	ssh-agent       /usr/local/openssh/bin/ssh-agent	9
update-alternatives --install /usr/bin/ssh-keygen   	ssh-keygen      /usr/local/openssh/bin/ssh-keygen	9
update-alternatives --install /usr/bin/ssh-keyscan  	ssh-keyscan     /usr/local/openssh/bin/ssh-keyscan	9

systemctl daemon-reload
systemctl restart sshd
systemctl enable sshd

echo "+--------------------------------------------------------------------------------------------------------------+"
echo "|                                          OpenSSH 9.7p1 Install Sucesses                                      |"
echo "+--------------------------------------------------------------------------------------------------------------+"

5. 编辑更新脚本update.sh

[root@localhost openssh]# vi update.sh 

#!/bin/bash
###########################################################################################
#  @programe  : openssh_update.sh 
#  @version   : 0.0.1                                                       
#  @function@ : 
#  @campany   : 
#  @dep.      :                                         
#  @writer    : Liu Cheng ji                                              
#  @date      : 2024-02-04                                              
############################################################################################
if [ -d "/usr/local/openssh" ]; then
	rm -rf /usr/local/openssh
	tar -zxvf openssh.tar.gz -C /usr/local/
else
	tar -zxvf openssh.tar.gz -C /usr/local/
fi
echo "+--------------------------------------------------------------------------------------------------------------+"
echo "|                                       	    OpenSSH is updated 9.7p1                                         |"
echo "+--------------------------------------------------------------------------------------------------------------+"

6．查看config目录

[root@localhost openssh]# cd config

[root@localhost config]# ls

sshd.conf  sshd.service

7. 编辑sshd.service文件

[root@localhost config]#vi sshd.service

[Unit]
Description=OpenSSH server daemon
Documentation=man:sshd(8) man:sshd_config(5)
After=network.target sshd-keygen.target
Wants=sshd-keygen.target

[Service]
EnvironmentFile=-/etc/sysconfig/sshd
ExecStartPre=/usr/sbin/sshd -t
ExecStart=/usr/sbin/sshd -D $SSHD_OPTS
ExecReload=/usr/sbin/sshd -t
ExecReload=/bin/kill -HUP $MAINPID
KillMode=process
Restart=on-failure
RestartSec=42s

[Install]
WantedBy=multi-user.target

8.编辑sshd.conf文件

[root@localhost openssh]# vi sshd.conf

d /var/empty/sshd 0711 root root

9.安装OpenSSH

[root@localhost openssh]# ./setup.sh

10.查看更新后的OpenSSH版本

[root@localhost ~]# ssh -V

OpenSSH, OpenSSL 3.2.1 30 Jan 2024