编译打包OpenSSH9.6为RPM

一、编译打包openssh

1、安装编译环境

yum install rpm-build zlib-devel openssl-devel gcc perl-devel pam-devel xmkmf libXt-devel gtk2-devel make krb5-devel -y

2、初始化rpm制作环境

mkdir -p /root/rpmbuild/{RPMS,SOURCES,SPECS}
# 解压缩文件并且存放于具体路径
# 将 openssh-9.2p1 存放于/root/rpmbuild/SOURCES
# 将 openssh.spec存放于 /root/rpmbuild/SPECS
cd /root/rpmbuild/SOURCES
wget https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-9.6p1.tar.gz
wget https://src.fedoraproject.org/repo/pkgs/openssh/x11-ssh-askpass-1.2.4.1.tar.gz/8f2e41f3f7eaa8543a2440454637f3c3/x11-ssh-askpass-1.2.4.1.tar.gz
tar -zxf openssh-9.6p1.tar.gz  -C /opt/
cp /opt/openssh-9.6p1/contrib/redhat/openssh.spec /root/rpmbuild/SPECS/
chown sshd:sshd /root/rpmbuild/SPECS/openssh.spec
vim /root/rpmbuild/SPECS/openssh.spec
​
# 修改openssh.spec
sed -ri 's/^%global no_x11_askpass 0/%global no_x11_askpass 1/g;s/%global no_gnome_askpass 0/%global no_gnome_askpass 1/g' /root/rpmbuild/SPECS/openssh.spec
cd /root/rpmbuild/SPECS/
# 查看openssl.spec中的openssl与系统中的版本是否符合，如果不符合则需要升级openssl
]# grep "BuildRequires" openssh.spec
......
BuildRequires: openssl-devel >= 1.1.1
]# openssl version
OpenSSL 1.0.2k-fips  26 Jan 2017
​
# 编译安装openssl
wget https://www.openssl.org/source/old/1.1.1/openssl-1.1.1w.tar.gz --no-check-certificate
tar -xf openssl-1.1.1w.tar.gz
cd openssl-1.1.1w/
./config --prefix=/usr/lib/openssl-1.1.w --openssldir=/usr/shared
make && make install
ldconfig -v
chmod -R 0755 /usr/lib/openssl-1.1.w
​
# 创建软链接
备份软链接
mv /usr/bin/openssl{,.20240224.bak}
创建新软链接
ln -sf /usr/lib/openssl-1.1.w/bin/openssl /usr/bin/openssl
ln -s /usr/lib/openssl-1.1.w/lib/libssl.so.1.1 /usr/lib64/libssl.so.1.1
ln -s /usr/lib/openssl-1.1.w/lib/libcrypto.so.1.1 /usr/lib64/libcrypto.so.1.1
​
# openssl升级完成，查看openssl升级后的版本
]# openssl version
OpenSSL 1.1.1w  11 Sep 2023
​
# 打包opensshrpm包
cd /root/rpmbuild/SPECS
rpmbuild -ba openssh.spec

备注：打包openssh可指定openssl相关版本，不指定直接打包，后续安装后使用ssh -V会不显示openssl的版本信息

vim openssh.spec

%configure \
        ......
        --with-openssl-includes=/usr/lib/openssl-1.1.w/include \
        --with-ssl-dir=/usr/lib/openssl-1.1.w \

​
# 查看打包完成的rpm包
ls /root/rpmbuild/RPMS/x86_64

二、使用rpm升级openssh

备份配置文件

mkdir ~/ssh_bak
cp -rf /etc/ssh ~/ssh_bak/
cp -rf /etc/pam.d ~/ssh_bak/
升级openssh
cd /root/rpmbuild/RPMS/x86_64
rpm -Uvh openssh*.rpm

还原配置文件

cp -rf ~/ssh_bak/ssh/sshd_config /etc/ssh/sshd_config
cp -rf ~/ssh_bak/pam.d/sshd /etc/pam.d/
rm -rf /etc/ssh/ssh_host_*
service sshd restart