CentOS7编译生成openssl和openssh RPM包

一、编译生成openssl RPM包

二、安装openssl RPM包

三、编译生成openssh RPM包

四、测试机器安装openssl和openssh RPM包

一、编译生成openssl RPM包

参考：

 https://www.kingc.top/archives/centosrhel76-sheng-ji-openssl-he-openssh

1、安装编译环境依赖包

# yum install -y wget rpm-build zlib-devel openssl-devel gcc perl-devel pam-devel unzip libXt-devel imake gtk2-devel openssl-libs curl which make  perl perl-WWW-Curl

• 1.

2、下载最新的openssl源码包

# curl -O --silent https://www.openssl.org/source/openssl-1.1.1t.tar.gz

3、创建openssl.spec文件

Summary: OpenSSL 1.1.1t for Centos
Name: openssl
Version: %{?version}%{!?version:1.1.1t}
Release: 1%{?dist}
Obsoletes: %{name} <= %{version}
Provides: %{name} = %{version}
URL: https://www.openssl.org/
License: GPLv2+
Source: https://www.openssl.org/source/%{name}-%{version}.tar.gz
BuildRequires: make gcc perl perl-WWW-Curl
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root
# openssldir 可以自行更改
%global openssldir /usr/local/openssl
%description
https://github.com/philyuchkoff/openssl-RPM-Builder
OpenSSL RPM for version 1.1.1t on Centos
%package devel
Summary: Development files for programs which will use the openssl library
Group: Development/Libraries
Requires: %{name} = %{version}-%{release}
%description devel
OpenSSL RPM for version 1.1.1t on Centos (development package)
%prep
%setup -q
%build
./config --prefix=%{openssldir} --openssldir=%{openssldir}
make
%install
[ "%{buildroot}" != "/" ] && %{__rm} -rf %{buildroot}
%make_install
mkdir -p %{buildroot}%{_bindir}
mkdir -p %{buildroot}%{_libdir}
ln -sf %{openssldir}/lib/libssl.so.1.1 %{buildroot}%{_libdir}
ln -sf %{openssldir}/lib/libcrypto.so.1.1 %{buildroot}%{_libdir}
ln -sf %{openssldir}/bin/openssl %{buildroot}%{_bindir}
%clean
[ "%{buildroot}" != "/" ] && %{__rm} -rf %{buildroot}
%files
%{openssldir}
%defattr(-,root,root)
/usr/bin/openssl
/usr/lib64/libcrypto.so.1.1
/usr/lib64/libssl.so.1.1
%files devel
%{openssldir}/include/*
%defattr(-,root,root)
%post -p /sbin/ldconfig
%postun -p /sbin/ldconfig

4、编译打包

# mkdir -p /root/rpmbuild/{BUILD,RPMS,SOURCES,SPECS,SRPMS}
# cp openssl.spec /root/rpmbuild/SPECS/
# cp openssl-1.1.1t.tar.gz /root/rpmbuild/SOURCES/
# cd /root/rpmbuild/SPECS/
# rpmbuild -D "version 1.1.1t" -ba openssl.spec

5、查看生成的安装包，其中openssl-debuginfo可以不需要

# ll /root/rpmbuild/RPMS/x86_64
total 5656
-rw-r--r-- 1 root root 5417376 May 12 16:10 openssl-1.1.1t-1.el7.x86_64.rpm
-rw-r--r-- 1 root root  133608 May 12 16:10 openssl-debuginfo-1.1.1t-1.el7.x86_64.rpm
-rw-r--r-- 1 root root  234776 May 12 16:10 openssl-devel-1.1.1t-1.el7.x86_64.rpm

二、安装openssl RPM包

为了后续编译openssh RPM时用到新版的openssl，需要在该编译机器上安装编译好的openssl RPM包

openssl-libs不需要卸载
# yum remove openssl
# rpm -e openssl-devel   
# ll
total 5524
-rw-r--r-- 1 root root 5417376 May 12 16:23 openssl-1.1.1t-1.el7.x86_64.rpm
-rw-r--r-- 1 root root  234776 May 12 16:23 openssl-devel-1.1.1t-1.el7.x86_64.rpm
只安装openssl和openssl-devel两个包即可
# rpm -Uvh *.rpm --nodeps
# rpm -qa |grep openssl
xmlsec1-openssl-1.2.20-7.el7_4.x86_64
openssl-libs-1.0.2k-26.el7_9.x86_64
openssl-1.1.1t-1.el7.x86_64
openssl-devel-1.1.1t-1.el7.x86_64
# openssl version
OpenSSL 1.1.1t  7 Feb 2023

三、编译生成openssh RPM包

1、下载源码包

openssh源码包下载链接： https://cloudflare.cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/

这是一个Linux图形情况下用于口令输入的软件包

X11-ssh-askpass下载链接： https://src.fedoraproject.org/repo/pkgs/openssh/x11-ssh-askpass-1.2.4.1.tar.gz/8f2e41f3f7eaa8543a2440454637f3c3/

2、编译

# cp openssh-9.3p1.tar.gz /root/rpmbuild/SOURCES/
# cp x11-ssh-askpass-1.2.4.1.tar.gz /root/rpmbuild/SOURCES/
# tar zxvf openssh-9.3p1.tar.gz
# cp openssh-9.3p1/contrib/redhat/openssh.spec /root/rpmbuild/SPECS/

# vi /root/rpmbuild/SPECS/openssh.spec
修改内容如下：
1）将原先openssh.spec中的
%global no_x11_askpass 0
%global no_gnome_askpass 0
修改为
%global no_x11_askpass 1
%global no_gnome_askpass 1
2）注释掉#BuildRequires: openssl-devel < 1.1
3）插入--with-ssl-dir=/usr/local/openssl
%configure \
        --sysconfdir=%{_sysconfdir}/ssh \
        --libexecdir=%{_libexecdir}/openssh \
        --datadir=%{_datadir}/openssh \
        --with-default-path=/usr/local/bin:/bin:/usr/bin \
        --with-superuser-path=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin \
        --with-privsep-path=%{_var}/empty/sshd \
        --with-ssl-dir=/usr/local/openssl \
        --mandir=%{_mandir} \
        --with-mantype=man \
        --disable-strip \
        
# rpmbuild -ba /root/rpmbuild/SPECS/openssh.spec

3、查看生成的安装包

# ll /root/rpmbuild/RPMS/x86_64/openssh*
-rw-r--r-- 1 root root  667080 May 12 16:47 /root/rpmbuild/RPMS/x86_64/openssh-9.3p1-1.el7.x86_64.rpm
-rw-r--r-- 1 root root  639504 May 12 16:47 /root/rpmbuild/RPMS/x86_64/openssh-clients-9.3p1-1.el7.x86_64.rpm
-rw-r--r-- 1 root root 3192984 May 12 16:47 /root/rpmbuild/RPMS/x86_64/openssh-debuginfo-9.3p1-1.el7.x86_64.rpm
-rw-r--r-- 1 root root  470000 May 12 16:47 /root/rpmbuild/RPMS/x86_64/openssh-server-9.3p1-1.el7.x86_64.rpm

四、测试机器安装openssl和openssh RPM包

1、安装openssl RPM包

参考步骤“二、安装openssl RPM包”

2、安装openssh RPM包

# cp /etc/ssh/sshd_config /root/
# ll
total 1740
-rw-r--r-- 1 root root 667080 May 12 17:04 openssh-9.3p1-1.el7.x86_64.rpm
-rw-r--r-- 1 root root 639504 May 12 17:04 openssh-clients-9.3p1-1.el7.x86_64.rpm
-rw-r--r-- 1 root root 470000 May 12 17:04 openssh-server-9.3p1-1.el7.x86_64.rpm
# rpm -Uvh openssh-*
# mv /root/sshd_config /etc/ssh/
mv: overwrite ‘/etc/ssh/sshd_config’? y
# rm -rf /etc/ssh/ssh_host_*
# systemctl restart sshd
# ssh -V
OpenSSH_9.3p1, OpenSSL 1.1.1t  7 Feb 2023

注意PAM的问题，如果配置文件打开UsePAM yes，可能会导致服务器拒绝登录，需要修改相应的/etc/pam.d/sshd文件解决

# cat /etc/pam.d/sshd
#%PAM-1.0
auth	   required	pam_sepermit.so
auth       substack     password-auth
auth       include      postlogin
# Used with polkit to reauthorize users in remote sessions
-auth      optional     pam_reauthorize.so prepare
account    required     pam_nologin.so
account    include      password-auth
password   include      password-auth
# pam_selinux.so close should be the first session rule
session    required     pam_selinux.so close
session    required     pam_loginuid.so
# pam_selinux.so open should only be followed by sessions to be executed in the user context
session    required     pam_selinux.so open env_params
session    required     pam_namespace.so
session    optional     pam_keyinit.so force revoke
session    include      password-auth
session    include      postlogin
# Used with polkit to reauthorize users in remote sessions
-session   optional     pam_reauthorize.so prepare