Linux Ubuntu openssh离线源码安装、升级版本
文章目录
一、设备环境
1.操作系统
Ubuntu 16.04.1
root@Lemon:/home/lemon# uname -a
Linux Lemon 4.15.0-34-generic #37~16.04.1-Ubuntu SMP Tue Aug 28 10:44:06 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux
2.现在的openssh版本
OpenSSH_7.2p2 Ubuntu-4ubuntu2.4, OpenSSL 1.0.2g 1 Mar 2016
root@Lemon:/home/lemon# ssh V
OpenSSH_7.2p2 Ubuntu-4ubuntu2.4, OpenSSL 1.0.2g 1 Mar 2016
二、openssh官网下载源码
官网：https://www.openssh.com/
下载：https://www.openssh.com/portable.html
最新版本：https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-8.6p1.tar.gz
官网最新可用生产版本openssh-8.6p1
这次下载 https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-8.6p1.tar.gz 的源码包。
三、安装openssh
1.解压源码包
将openssh源码包解压，并进入openssh-8.6p1文件夹
root@Lemon:/home# tar -zxf openssh-8.6p1.tar.gz
root@Lemon:/home# cd openssh-8.6p1
2.查看README
root@Lemon:/home/openssh-8.6p1# vim README //查看帮助
下图是安装openssh的预制环境条件，由于是升级版本操作，以下环境已经安装过。
查看INSTALL
root@Lemon:/home/openssh-8.6p1# vim INSTALL
3.编译源码
接下来根据Quick Start直接编译
root@Lemon:/home/openssh-8.6p1# ./configure
root@Lemon:/home/openssh-8.6p1# ......
......
hecking if getpgrp accepts zero args... yes
checking openssl/opensslv.h usability... yes
checking openssl/opensslv.h presence... yes
checking for openssl/opensslv.h... yes
checking OpenSSL header version... 30000000 (OpenSSL 3.0.0-alpha17 20 May 2021)
checking for OpenSSL_version... no
checking for OpenSSL_version_num... no
checking OpenSSL library version... not found
configure: error: OpenSSL library not found.
报错了，说是没找到OpenSSL 依赖库，因为安装了openssl，那就尝试加参数指定依赖库位置。
./configure --with-ssl-dir=/usr/local/ssl --with-zlib=/usr/local/lib
root@Lemon:/home/openssh-8.6p1# ./configure --with-ssl-dir=/usr/local/ssl --with-zlib=/usr/local/lib
root@Lemon:/home/openssh-8.6p1# ......
OpenSSH has been configured with the following options:
User binaries: /usr/local/bin
System binaries: /usr/local/sbin
Configuration files: /usr/local/etc
Askpass program: /usr/local/libexec/ssh-askpass
Manual pages: /usr/local/share/man/manX
PID file: /var/run
Privilege separation chroot path: /var/empty
sshd default user PATH: /usr/bin:/bin:/usr/sbin:/sbin:/usr/local/bin
Manpage format: doc
PAM support: no
OSF SIA support: no
KerberosV support: no
SELinux support: no
MD5 password support: no
libedit support: no
libldns support: no
Solaris process contract support: no
Solaris project support: no
Solaris privilege support: no
IP address in $DISPLAY hack: no
Translate v4 in v6 hack: yes
BSD Auth support: no
Random number source: OpenSSL internal ONLY
Privsep sandbox style: seccomp_filter
PKCS#11 support: yes
U2F/FIDO support: yes
Host: x86_64-pc-linux-gnu
Compiler: cc
Compiler flags: -g -O2 -pipe -Wall -Wextra -Wpointer-arith -Wuninitialized -Wsign-compare -Wformat-security -Wsizeof-pointer-memaccess -Wno-pointer-sign -Wno-unused-parameter -Wno-unused-result -fno-strict-aliasing -D_FORTIFY_SOURCE=2 -ftrapv -fno-builtin-memset -fstack-protector-strong -fPIE
Preprocessor flags: -I/usr/local/ssl -I/usr/local/lib -D_XOPEN_SOURCE=600 -D_BSD_SOURCE -D_DEFAULT_SOURCE
Linker flags: -L/usr/local/ssl -L/usr/local/lib -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -fstack-protector-strong -pie
Libraries: -lcrypto -ldl -lutil -lz -lcrypt -lresolv
root@Lemon:/home/openssh-8.6p1# make
root@Lemon:/home/openssh-8.6p1# ......
root@Lemon:/home/openssh-8.6p1# make install
root@Lemon:/home/openssh-8.6p1# ......
至此，编译、安装过程中无任何报错，一路畅通，然后查看openssh版本。
root@Lemon:/home/openssh-8.6p1# ssh -V
OpenSSH_8.6p1, OpenSSL 3.0.0-alpha17 20 May 2021
四、报错异常
报错提示说是没找到OpenSSL 依赖库，因为安装了openssl，checking OpenSSL header version 时候也能够拿到OpenSSL的版本信息，需要加参数手动指定依赖库位置。
checking OpenSSL header version... 30000000 (OpenSSL 3.0.0-alpha17 20 May 2021)
checking for OpenSSL_version... no
checking for OpenSSL_version_num... no
checking OpenSSL library version... not found
configure: error: OpenSSL library not found.
configure提供如下常用指定参数
--prefix 安装目录
--sysconfdir 配置文件目录
--with-ssl-dir 指定 OpenSSL 的安装目录
--with-privsep-path 非特权用户的chroot目录
--with-privsep-user=sshd 指定非特权用户为sshd
--with-zlib 指定zlib库的安装目录
--with-md5-passwords 支持读取经过MD5加密的口令
--with-ssl-engine 启用OpenSSL的ENGINE支持
可以如下代码样配置
./configure --prefix=/usr/local --sysconfdir=/usr/local/ssh --with-ssl-dir=/usr/local/ssl --with-privsep-path=/var/empty --with-privsep-user=sshd --with-zlib=/usr/local/lib --with-ssl-engine --with-md5-passwords --disable-etc-default-login
五、openssh用法
官网Manual https://www.openssh.com/manual.html
配置文件路径/etc/ssh/
root@Lemon:/etc/ssh# ls
moduli sshd_config ssh_host_dsa_key.pub ssh_host_ecdsa_key.pub ssh_host_ed25519_key.pub ssh_host_rsa_key.pub
ssh_config ssh_host_dsa_key ssh_host_ecdsa_key ssh_host_ed25519_key ssh_host_rsa_key
配置文件：
root@Lemon:/etc/ssh# cat sshd_config
# Package generated configuration file
# See the sshd_config(5) manpage for details
# What ports, IPs and protocols we listen for
Port 22
# Use these options to restrict which interfaces/protocols sshd will bind to
#ListenAddress ::
#ListenAddress 0.0.0.0
Protocol 2
# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key
#Privilege Separation is turned on for security
UsePrivilegeSeparation yes
# Lifetime and size of ephemeral version 1 server key
KeyRegenerationInterval 3600
ServerKeyBits 1024
# Logging
SyslogFacility AUTH
LogLevel INFO
# Authentication:
LoginGraceTime 120
PermitRootLogin prohibit-password
StrictModes yes
RSAAuthentication yes
PubkeyAuthentication yes
#AuthorizedKeysFile %h/.ssh/authorized_keys
# Don't read the user's ~/.rhosts and ~/.shosts files
IgnoreRhosts yes
# For this to work you will also need host keys in /etc/ssh_known_hosts
RhostsRSAAuthentication no
# similar for protocol version 2
HostbasedAuthentication no
# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
#IgnoreUserKnownHosts yes
# To enable empty passwords, change to yes (NOT RECOMMENDED)
PermitEmptyPasswords no
# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
ChallengeResponseAuthentication no
# Change to no to disable tunnelled clear text passwords
#PasswordAuthentication yes
# Kerberos options
#KerberosAuthentication no
#KerberosGetAFSToken no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes
X11Forwarding yes
X11DisplayOffset 10
PrintMotd no
PrintLastLog yes
TCPKeepAlive yes
#UseLogin no
#MaxStartups 10:30:60
#Banner /etc/issue.net
# Allow client to pass locale environment variables
AcceptEnv LANG LC_*
Subsystem sftp /usr/lib/openssh/sftp-server
# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication. Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes
重启ssh服务生效
systemctl restart sshd
或
systemctl restart ssh
停止ssh服务
systemctl stop sshd
查看ssh服务状态
root@Lemon:/etc/ssh# systemctl status ssh
● ssh.service - OpenBSD Secure Shell server
Loaded: loaded (/lib/systemd/system/ssh.service; enabled; vendor preset: enabled)
Active: active (running) since 四 2021-06-17 15:37:13 CST; 1s ago
Main PID: 13283 (sshd)
CGroup: /system.slice/ssh.service
└─13283 /usr/sbin/sshd -D
6月 17 15:37:13 Lemon systemd[1]: Starting OpenBSD Secure Shell server...
6月 17 15:37:13 Lemon sshd[13283]: Server listening on 0.0.0.0 port 22.
6月 17 15:37:13 Lemon sshd[13283]: Server listening on :: port 22.
6月 17 15:37:13 Lemon systemd[1]: Started OpenBSD Secure Shell server.
六、openssh一键安装脚本
一键安装版本install.sh，openssh-8.6p1版本
#!/bin/sh
echo "1s后开始解压...\n"
sleep 1s
tar -zxvf openssh-8.6p1.tar.gz -C /home/
echo "解压成功...\进入/home/openssh-8.6p1\n"
cd /home/openssh-8.6p1
echo "1s后开始编译...\n"
sleep 1s
./configure
echo "1s后开始编译...\n"
sleep 1s
make
echo "1s后开始安装...\n"
sleep 1s
make install
echo "openssh安装完成...\nssh -V\n"
openssl -V
3616
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
