centos6.5 升级 openssh记录

一、更换源为阿里源
      

cp -r /etc/yum.repos.d /etc/yum.repos.d.backup #备份源

cd /etc/yum.repos.d/ 
sudo rm -f CentOS-Base.repo
sudo rm -f CentOS-CR.repo
sudo rm -f CentOS-Debuginfo.repo
sudo rm -f CentOS-Media.repo
sudo rm -f CentOS-Vault.repo

#Centos6.5 可用yum源

vim /etc/yum.repos.d/CentOS-Base.repo

# CentOS-Base.repo
#
# The mirror system uses the connecting IP address of the client and the
# update status of each mirror to pick mirrors that are updated to and
# geographically close to the client.  You should use this for CentOS updates
# unless you are manually picking other mirrors.
#
# If the mirrorlist= does not work for you, as a fall back you can try the 
# remarked out baseurl= line instead.
#
#
 
[base]
name=CentOS-$releasever - Base - mirrors.aliyun.com
failovermethod=priority
baseurl=http://mirrors.aliyun.com/centos-vault/6.10/os/$basearch/
        http://mirrors.aliyuncs.com/centos-vault/6.10/os/$basearch/
        http://mirrors.cloud.tencent.com/centos/$releasever/os/$basearch/
        http://mirrors.tencentyun.com/centos/$releasever/os/$basearch/
#mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=os
gpgcheck=1
gpgkey=http://mirrors.aliyun.com/centos/RPM-GPG-KEY-CentOS-6
 
#released updates 
[updates]
name=CentOS-$releasever - Updates - mirrors.aliyun.com
failovermethod=priority
baseurl=http://mirrors.aliyun.com/centos-vault/6.10/updates/$basearch/
        http://mirrors.aliyuncs.com/centos-vault/6.10/updates/$basearch/
        http://mirrors.cloud.tencent.com/centos/$releasever/updates/$basearch/
        http://mirrors.tencentyun.com/centos/$releasever/updates/$basearch/
#mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=updates
gpgcheck=1
gpgkey=http://mirrors.aliyun.com/centos/RPM-GPG-KEY-CentOS-6
 
#additional packages that may be useful
[extras]
name=CentOS-$releasever - Extras - mirrors.aliyun.com
failovermethod=priority
baseurl=http://mirrors.aliyun.com/centos-vault/6.10/extras/$basearch/
        http://mirrors.aliyuncs.com/centos-vault/6.10/extras/$basearch/
        http://mirrors.cloud.tencent.com/centos/$releasever/extras/$basearch/
        http://mirrors.tencentyun.com/centos/$releasever/extras/$basearch/
#mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=extras
gpgcheck=1
gpgkey=http://mirrors.aliyun.com/centos/RPM-GPG-KEY-CentOS-6
 
#additional packages that extend functionality of existing packages
[centosplus]
name=CentOS-$releasever - Plus - mirrors.aliyun.com
failovermethod=priority
baseurl=http://mirrors.aliyun.com/centos-vault/6.10/centosplus/$basearch/
        http://mirrors.aliyuncs.com/centos-vault/6.10/centosplus/$basearch/
        http://mirrors.cloud.tencent.com/centos/$releasever/centosplus/$basearch/
        http://mirrors.tencentyun.com/centos/$releasever/centosplus/$basearch/
#mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=centosplus
gpgcheck=1
enabled=0
gpgkey=http://mirrors.aliyun.com/centos/RPM-GPG-KEY-CentOS-6
 
#contrib - packages by Centos Users
[contrib]
name=CentOS-$releasever - Contrib - mirrors.aliyun.com
failovermethod=priority
baseurl=http://mirrors.aliyun.com/centos-vault/6.10/contrib/$basearch/
        http://mirrors.aliyuncs.com/centos-vault/6.10/contrib/$basearch/
        http://mirrors.cloud.tencent.com/centos/$releasever/contrib/$basearch/
        http://mirrors.tencentyun.com/centos/$releasever/contrib/$basearch/
#mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=contrib
gpgcheck=1
enabled=0
gpgkey=http://mirrors.aliyun.com/centos/RPM-GPG-KEY-CentOS-6

    更新 YUM 缓存

     sudo yum clean all
     sudo yum makecache

     yum list available 测试源是否生效

二、升级openssh

操作步骤​​​​​​
1.安装编译所需依赖软件包

yum install -y wget gcc pam-devel libselinux-devel zlib-devel openssl-devel
2.下载安装包

https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-9.9p1.tar.gz
3. 删除低版本OpenSSH的 rpm 包

rpm -e --nodeps `rpm -qa | grep openssh`
4.编译配置

//解压
tar -zxvf openssh-9.9p1.tar.gz
//cd openssh-9.9p1 进入解压后的目录，输入以下命令进行安装前配置
./configure --prefix=/usr --sysconfdir=/etc/ssh --with-md5-passwords --with-pam --with-zlib --with-tcp-wrappers --with-ssl-dir=/usr/local/ssl --without-hardening
5.编译安装

make && make install
6.检查版本

ssh -V

三、异常情况处理

1、在configure openssh时，有设置参数 –with-pam，会提示：

PAM is enabled. You may need to install a PAM control file for sshd, otherwise password authentication may fail. Example PAM control files can be found in the contrib/subdirectory
 

解决方法：备份原文件/etc/pam.d/sshd，将以下内容覆盖写入/etc/pam.d/sshd，然后重启sshd

#%PAM-1.0
auth       required pam_sepermit.so
auth       include      password-auth
account    required     pam_nologin.so
account    include      password-auth
password   include      password-auth
# pam_selinux.so close should be the first session rule
session    required     pam_selinux.so close
session    required     pam_loginuid.so
# pam_selinux.so open should only be followed by sessions to be executed in the user context
session    required     pam_selinux.so open env_params
session    optional     pam_keyinit.so force revoke
session    include      password-auth

2、升级完毕之后 ssh报错 no kex alg 和 no hostkey alg  

        这是因为客户端的ssh版本低于服务端

vim /etc/ssh/sshd_config

# 在最后一行添加下面内容
KexAlgorithms +diffie-hellman-group1-sha1 HostKeyAlgorithms +ssh-rsa

3、报错checking OpenSSL library version... not found
configure: error: OpenSSL library not found.
直接强制 命令 告知 ssl 依赖包位置 

CFLAGS="-I/usr/local/openssl/include" LDFLAGS="-L/usr/local/openssl/lib" ./configure --with-openssl=/usr/local/openssl --prefix=/usr --sysconfdir=/etc/ssh --with-md5-passwords --with-pam --with-zlib --with-tcp-wrappers --with-ssl-dir=/usr/local/ssl --without-hardening

4、ssh_exchange_identification: Connection closed by remote host
检查并临时禁用 SELinux

setenforce 0

重启 service sshd restart

四、升级openssl 

升级到openssh openssh-9.9p1 可能还需要升级openssl 到 OpenSSL >= 1.1.1
我升级到了  1.1.1t

安装依赖
sudo yum groupinstall "Development Tools"
sudo yum install -y gcc make perl

下载 OpenSSL 新版本
cd /usr/local/src
sudo wget https://www.openssl.org/source/openssl-1.1.1t.tar.gz
sudo tar -xvzf openssl-1.1.1t.tar.gz
cd openssl-1.1.1t

sudo ./config --prefix=/usr/local/openssl --openssldir=/usr/local/openssl
sudo make &&  make install


更新系统的 OpenSSL 链接,安装完成后，更新系统默认使用的 OpenSSL 版本。你需要更新链接，并修改 /etc/ld.so.conf.d/openssl.conf 来包含新安装的路径。

sudo ln -sf /usr/local/openssl/bin/openssl /usr/bin/openssl
sudo ln -sf /usr/local/openssl/lib/libssl.so /usr/lib64/libssl.so
sudo ln -sf /usr/local/openssl/lib/libcrypto.so /usr/lib64/libcrypto.so

确保 /usr/local/openssl/lib 被包括在 LD_LIBRARY_PATH 中：
sudo echo "/usr/local/openssl/lib" > /etc/ld.so.conf.d/openssl.conf
sudo ldconfig

验证安装
openssl version