centos6.5 opessl openssl升级

安装 telnet 避免 ssh 无法登录

yum install xinetd telnet telnet-server -y

允许 root 账号登陆

vi /etc/securetty
末尾添加
pts/0
pts/1
pts/2

设置开机启动

chkconfig telnet on
vi /etc/xinetd.d/telnet
将”disable= yes”改成” disable=no”

重启xinetd服务

service xinetd restart

添加防火墙端口

iptables -I INPUT -p tcp --dport 23 -jACCEPT
iptables -I INPUT -p udp --dport 23 -jACCEPT
service iptables save //保存
service iptables restart //重启防火墙

升级openssl openssh

http://distfiles.macports.org/openssl/openssl-1.1.1j.tar.gz
http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-8.5p1.tar.gz

前置安装

yum install -y gcc zlib-devel pam pam-devel openssl-devel

openssl升级

安装依赖perl，详情见NOTES.PERL文件
从 CPAN(http://search.cpan.org/)搜索并下载Test::More和Text::Template模块的源代码包

cd /usr/local/src/
tar -zxf Test-Simple-1.302183.tar.gz
cd Test-Simple-1.302183
perl Makefile.PL
make && make test && make install

cd /usr/local/src/
tar -zxf Text-Template-1.59.tar.gz
cd Text-Template-1.59
perl Makefile.PL
make && make test && make install	

编译安装openssl

cd /usr/local/src/
tar -zxf openssl-1.1.1j.tar.gz
cd openssl-1.1.1j
./config --prefix=/usr/local/openssl --openssldir=/usr/local/openssl --shared zlib
make && make test && make install
mv /usr/bin/openssl /usr/bin/openssl_1.0.1e_bak
mv /usr/include/openssl /usr/include/openssl_1.0.1e_bak
cp /usr/local/openssl/bin/openssl /usr/bin/openssl
ln -s /usr/local/openssl/include/openssl /usr/include/openssl
cp /usr/local/openssl/lib/libcrypto.so.1.1 /usr/lib64/
cp /usr/local/openssl/lib/libssl.so.1.1 /usr/lib64/
ldconfig 
openssl version

如果执行yum操作报缺失libcrypto.so.10，执行以下步骤
cd /usr/lib64/
ln -s libssl.so.1.1 libssl.so.10
ln -s libcrypto.so.1.1 libcrypto.so.10

编译安装openssh

cd /usr/local/src
tar -zxf openssh-8.5p1.tar.gz
mv /etc/ssh /etc/ssh_bak
cd /usr/local/src/openssh-8.5p1
./configure --prefix=/usr/local/openssh --sysconfdir=/etc/ssh --with-md5-passwords --with-pam --with-ssl-dir=/usr/local/openssl --without-hardening --with-zlib=/usr/local/zlib
make && make install

备份原sshd

which sshd
mv /usr/sbin/sshd /opt/sshd_bak
cp /usr/local/openssh/sbin/sshd /usr/sbin/sshd

卸载openssh旧版本，拷贝新版本openssh相关程序与配置文件

rpm -aq | grep openssh
for i in $(rpm -aq | grep openssh); do rpm -e $i --nodeps ; done
cd /usr/local/openssh/bin
cp -arf /usr/local/openssh/bin/* /usr/bin/
cp /usr/local/openssh/sbin/sshd /usr/sbin/sshd
cp /usr/local/src/openssh-8.5p1/contrib/redhat/sshd.init /etc/init.d/sshd
cp -a /usr/local/src/openssh-8.5p1/contrib/redhat/sshd.pam /etc/pam.d/sshd.pam
chmod a+x /etc/init.d/sshd

若出现输入了正确的root密码也连不上的情况

在/etc/ssh/sshd_config中加入 PermitRootLogin yes 然后重启sshd服务
echo “PermitRootLogin yes” >> /etc/ssh/sshd_config #允许root用户通过ssh登录
service sshd restart

查看版本

ssh -V
openssl version