openssh升级8.8

先升级openssl，所有涉及到的文件修改请先备份！！！

先安装telnet 防止sshd升级失败无法连接服务器

yum install -y telnet-server* telnet xinetd
systemctl enable xinetd.service
systemctl enable telnet.socket
systemctl start telnet.socket
systemctl start xinetd.service
echo 'pts/0' >> /etc/securetty 
echo 'pts/1' >> /etc/securetty 
echo 'pts/2' >> /etc/securetty 
echo 'pts/3' >> /etc/securetty

systemctl start firewalld
firewall-cmd --add-port=23/tcp --permanent
firewall-cmd  --reload

安装所需要的工具包

yum install  -y gcc gcc-c++ glibc make autoconf openssl openssl-devel pcre-devel  pam-devel
yum install  -y pam* zlib*

进入自己的软件文件夹下载并编译安装

d soft/
wget https://www.openssl.org/source/openssl-1.1.1l.tar.gz --no-check-certificate
mv /usr/bin/openssl  /usr/bin/openssl.old
mv /usr/include/openssl /usr/include/openssl.old
tar -zxvf openssl-1.1.1l.tar.gz 
cd openssl-1.1.1l/
./config --prefix=/usr/local/openssl
make
make install
ln -s /usr/local/openssl/bin/openssl /usr/bin/openssl
ln -s /usr/local/openssl/include/openssl /usr/include/openssl
echo "/usr/local/openssl/lib" >> /etc/ld.so.conf
ldconfig -v
openssl version

显示如下图则安装成功

安装openssh前(环境，证书登录，openssh7.4)

修改/etc/ssh/ssh_config 

Host *
	ForwardX11Trusted yes
	SendEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
	SendEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
	SendEnv LC_IDENTIFICATION LC_ALL LANGUAGE
	SendEnv XMODIFIERS

修改/etc/ssh/sshd_config

Port 32222
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key
StrictModes no
PubkeyAuthentication yes
AuthorizedKeysFile	.ssh/authorized_keys
ChallengeResponseAuthentication no
UsePAM yes
X11Forwarding yes
ClientAliveInterval 600
ClientAliveCountMax 2
AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
AcceptEnv XMODIFIERS
Subsystem	sftp	/usr/libexec/openssh/sftp-server
UseDNS no
AddressFamily inet
PermitRootLogin yes
SyslogFacility AUTHPRIV
PasswordAuthentication no

#7.4版本用的,注掉
#RSAAuthentication yes  

#openssh8.2后禁用ssh-rsa
PubkeyAcceptedAlgorithms +ssh-rsa 
PubkeyAcceptedKeyTypes +ssh-rsa
HostkeyAlgorithms +ssh-rsa
KexAlgorithms diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,curve25519-sha256@libssh.org

添加或修改/root/.ssh/config文件(git for code.aliyun.com)

Host code.aliyun.com
	HostName code.aliyun.com
	HostkeyAlgorithms +ssh-rsa
	PubkeyAcceptedAlgorithms +ssh-rsa

chmod 600 /etc/ssh/* #权限要改为600,否则会报警
wget -c https://openbsd.hk/pub/OpenBSD/OpenSSH/portable/openssh-8.8p1.tar.gz --no-check-certificate
tar -zxvf openssh-8.8p1.tar.gz
cd openssh-8.8p1
./configure --prefix=/usr --sysconfdir=/etc/ssh --with-md5-passwords --with-pam --with-tcp-wrappers --with-ssl-dir=/usr/local/openssl --with-zlib=/usr/local/lib64 --without-hardening
make
make install
cp -a contrib/redhat/sshd.init /etc/init.d/sshd
chmod +x /etc/init.d/sshd
chkconfig --add sshd
systemctl enable sshd
chkconfig sshd on
mv /usr/lib/systemd/system/sshd.service  /home/
systemctl daemon-reload
/etc/init.d/sshd restart

编译中出现下图可忽略