准备工作:
- 查询系统版本 和 ssh版本,本次安装基于CentOS Linux release 7.4.1708,和openssh7.4
cat /etc/redhat-release
ssh -V
- 安装telnet-server以及xinetd,以防远程升级,失败后无法登录到服务器
yum install xinetd telnet-server -y
vim /etc/xinetd.d/telnet
service telnet
{
disable = yes
flags = REUSE
socket_type = stream
wait = no
user = root
server = /usr/sbin/in.telnetd
log_on_failure += USERID
}
配置telnet登录的终端类型,在/etc/securetty文件末尾增加一些pts终端,如下
vim /etc/securetty
pts/0
pts/1
pts/2
pts/3
systemctl enable xinetd
systemctl enable telnet.socket
systemctl start telnet.socket
systemctl start xinetd
netstat -lntp|grep 23
3. 准备安装包
zlib-1.2.11.tar.gz 下载地址:http://www.zlib.net/zlib-1.2.11.tar.gz 也可以直接下载:wget http://www.zlib.net/zlib-1.2.11.tar.gz
openssl-1.1.1h.tar.gz 下载地址:https://www.openssl.org/source/openssl-1.1.1h.tar.gz 也可以直接下载:wget https://www.openssl.org/source/openssl-1.1.1h.tar.gz
openssh-8.4p1.tar.gz 下载地址:http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-8.4p1.tar.gz 也可以直接下载:wget http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-8.4p1.tar.gz
- 解压安装包,我习惯将安装包解压到/usr/local/src下面
tar xf openssh-8.4p1.tar.gz -C /usr/local/src/
tar xf openssl-1.1.1h.tar.gz -C /usr/local/src/
tar xf zlib-1.2.11.tar.gz -C /usr/local/src/
ll /usr/local/src/
开始安装:
- 安装zlib-1.2.11.tar.gz
[root@test3 ~]# cd /usr/local/src/zlib-1.2.11/
[root@test3 zlib-1.2.11]# ./configure --prefix=/usr/local/zlib && make -j 4 && make install
- 安装 openssl-1.1.1h.tar.gz
[root@test3 zlib-1.2.11]# cd /usr/local/src/openssl-1.1.1h/
[root@test3 openssl-1.1.1h]# ./config --prefix=/usr/local/ssl -d shared
[root@test3 openssl-1.1.1h]# make -j 4 && make install
[root@test3 openssl-1.1.1h]# echo '/usr/local/ssl/lib' >> /etc/ld.so.conf
[root@test3 openssl-1.1.1h]# ldconfig -v
- 安装openssh-8.4p1.tar.gz
mv /etc/ssh /etc/ssh.bak
cd /usr/local/src/openssh-8.4p1/
./configure --prefix=/usr/local/openssh --sysconfdir=/etc/ssh --with-ssl-dir=/usr/local/ssl --with-zlib=/usr/local/zlib
make -j 4 && make install
- sshd_config文件修改
echo "X11Forwarding yes" >> /etc/ssh/sshd_config
echo "X11UseLocalhost no" >> /etc/ssh/sshd_config
echo "XAuthLocation /usr/bin/xauth" >> /etc/ssh/sshd_config
echo "UseDNS no" >> /etc/ssh/sshd_config
echo 'PermitRootLogin yes' >> /etc/ssh/sshd_config
echo 'PubkeyAuthentication yes' >> /etc/ssh/sshd_config
echo 'PasswordAuthentication yes' >> /etc/ssh/sshd_config
echo 'KexAlgorithms diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1' >> /etc/ssh/sshd_config
- 备份 /etc/ssh 原有文件,并将新的配置复制到指定目录
mv /usr/sbin/sshd /usr/sbin/sshd.bak
cp -rf /usr/local/openssh/sbin/sshd /usr/sbin/sshd
mv /usr/bin/ssh /usr/bin/ssh.bak
cp -rf /usr/local/openssh/bin/ssh /usr/bin/ssh
mv /usr/bin/ssh-keygen /usr/bin/ssh-keygen.bak
cp -rf /usr/local/openssh/bin/ssh-keygen /usr/bin/ssh-keygen
- 停掉sshd服务,将systemctl原服务器删除,使用安装包里自带的sshd.init,复制到/etc/init.d/sshd
systemctl stop sshd.service
rm -rf /lib/systemd/system/sshd.service
systemctl daemon-reload
cp /usr/local/src/openssh-8.4p1/contrib/redhat/sshd.init /etc/init.d/sshd
/etc/init.d/sshd restart
systemctl status sshd
- 添加开机启动
chkconfig --add sshd
chkconfig --list sshd
打完收工!