linux/centos7升级openssh8.8p1

Centos升级openssl

1. 下载安装wget

yum -y install wget

2. 获取openssh源码包

# 清华源 https://mirrors.tuna.tsinghua.edu.cn/OpenBSD/OpenSSH/portable/
# 阿里源 https://mirrors.aliyun.com/pub/OpenBSD/OpenSSH/portable/?spm=a2c6h.25603864.0.0.6ff47250dE31BH
wget https://mirrors.tuna.tsinghua.edu.cn/OpenBSD/OpenSSH/portable/openssh-8.8p1.tar.gz

# 或前往官方下载后使用ftp传入服务器

3. 安装openssh 所需依赖

yum -y install  gcc gcc-c++ openssl-devel libstdc++* libcap* wget pam-devel zlib-devel perl

4. 备份旧版ssh配置文件

cp /etc/ssh/sshd_config /etc/ssh/sshd_config-bak-$(date +"%Y-%m-%d")
cp /etc/pam.d/sshd /etc/pam.d/sshd-bak-$(date +"%Y-%m-%d")

5. 卸载系统rpm自带ssh

rpm -e --nodeps `rpm -qa | grep openssh`

6. 解压并编译安装

tar -xf openssh-8.8p1.tar.gz -C /tmp
cd /tmp/openssh-8.8p1
./configure --prefix=/usr --sysconfdir=/etc/ssh --with-md5-passwords --with-pam --with-zlib --with-privsep-path=/var/lib/sshd --with-ssl-dir=/usr/local/openssl 

make && make install

7. 修改ssh秘钥文件权限

chmod 600 /etc/ssh/ssh_host_rsa_key
chmod 600 /etc/ssh/ssh_host_dsa_key
chmod 600 /etc/ssh/ssh_host_ecdsa_key
chmod 600 /etc/ssh/ssh_host_ed25519_key

8. 复制sshd初始化文件到linux启动目录

cp -p contrib/redhat/sshd.init /etc/init.d/sshd
chmod +x /etc/init.d/sshd

9. 修改配置文件(可以不修改)

chmod 755 /usr/local/openssl/ -R
# echo 'PermitRootLogin no' >> /etc/ssh/sshd_config  禁止root远程登录
# sed -i '/PASS_MAX_DAYS/s/99999/90/g' /etc/login.defs  密码最大天数改为90

10. 开启pam认证并修改pam文件

# sshd文件如果有的话先备份,没有的话直接写入一个
cp /etc/pam.d/postlogin /etc/pam.d/postlogin-bak-$(date +"%Y-%m-%d")
cp /etc/pam.d/sshd /etc/pam.d/sshd.bak-$(date +"%Y-%m-%d")
echo 'UsePAM yes' >> /etc/ssh/sshd_config # 开启pam认证
echo 'MaxStartups 1000' >> /etc/ssh/sshd_config # MaxStartups是用来限制并行认证ssh客户端数量
echo 'MaxSessions 1000' >> /etc/ssh/sshd_config # 每个TCP连接可以并行开启多少个会话（session），并不是指某个ip连接的数量

# 写入/etc/pam.d/sshd
echo '#%PAM-1.0
auth       required     pam_sepermit.so
auth       substack     password-auth
auth       include      postlogin
# Used with polkit to reauthorize users in remote sessions
-auth      optional     pam_reauthorize.so prepare
account    required     pam_nologin.so
account    include      password-auth
password   include      password-auth
# pam_selinux.so close should be the first session rule
session    required     pam_selinux.so close
session    required     pam_loginuid.so
# pam_selinux.so open should only be followed by sessions to be executed in the user context
session    required     pam_selinux.so open env_params
session    required     pam_namespace.so
session    optional     pam_keyinit.so force revoke
session    include      password-auth
session    include      postlogin
# Used with polkit to reauthorize users in remote sessions
-session   optional     pam_reauthorize.so prepare' > /etc/pam.d/sshd
# 写入/etc/pam.d/postlogin
echo '#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.


session     [success=1 default=ignore] pam_succeed_if.so service !~ gdm* service !~ su* quiet
session     [default=1]   pam_lastlog.so nowtmp showfailed
session     optional      pam_lastlog.so silent noupdate showfailed' > /etc/pam.d/postlogin

# 修改权限
chmod 644 /etc/pam.d/postlogin
chmod 600 /etc/pam.d/sshd

11. 重启服务

  systemctl daemon-reload
  systemctl restart sshd
  systemctl enable sshd

12. 查看ssh版本

ssh -V