【Redhat7.6升级SSH】

一、Redhat7.6配置网络yum源

redhat系统安装好尽管默认带有yum，但是redhat的更新包只对注册用户有效（收费）。所以需要更换yum源，用Redhat相近的centos的yum源。

1、删除redhat7.0系统自带的yum软件包

rpm -qa|grep yum|xargs rpm -e --nodeps   
#不检查依赖，直接删除rpm包

2、选择阿里云自行下载所需要的软件包。

2.1 三大网路源地址

包名会更新，根据当前最新的下载。如有有依赖问题，下载依赖包进行安装。
阿里云网络源地址：https://mirrors.aliyun.com/centos/7/os/x86_64/Packages/
网易163网络源地址：http://mirrors.163.com/ CentOS
网络源地址：http://centos.ustc.edu.cn/centos/

2.2 下载相关rpm包，确保能上外网

##因版本升级了，找不到对应文件，需进入//mirrors.aliyun.com/centos/7/os/x86_64/Packages找到正确文件
wget https://mirrors.aliyun.com/centos/7/os/x86_64/Packages/yum-metadata-parser-1.1.4-10.el7.x86_64.rpm
wget https://mirrors.aliyun.com/centos/7/os/x86_64/Packages/yum-3.4.3-168.el7.centos.noarch.rpm
wget https://mirrors.aliyun.com/centos/7/os/x86_64/Packages/yum-plugin-fastestmirror-1.1.31-54.el7_8.noarch.rpm
wget https://mirrors.aliyun.com/centos/7/os/x86_64/Packages/yum-utils-1.1.31-54.el7_8.noarch.rpm
wget https://mirrors.aliyun.com/centos/7/os/x86_64/Packages/python-urllib3-1.10.2-7.el7.noarch.rpm
wget https://mirrors.aliyun.com/centos/7/os/x86_64/Packages/yum-langpacks-0.4.2-7.el7.noarch.rpm
wget https://mirrors.aliyun.com/centos/7/os/x86_64/Packages/yum-rhn-plugin-2.0.1-10.el7.noarch.rpm
wget https://mirrors.aliyun.com/centos/7/os/x86_64/Packages/rpm-4.11.3-45.el7.x86_64.rpm

3、根据依赖项安装

#进入文件下载目录 /boot/downloads/
rpm -ivh python-*
rpm -Uvh rpm-4* --nodeps
rpm -ivh yum-*

4、下载repo配置文件

wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo

5、下载KEY文件：

5.1 直接下载

cd  /etc/pki/rpm-gpg
wget   http://mirrors.aliyun.com/centos/7/os/x86_64/RPM-GPG-KEY-CentOS-7

5.2 vim /etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-7文件，内容如下

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.4.5 (GNU/Linux)

mQINBFOn/0sBEADLDyZ+DQHkcTHDQSE0a0B2iYAEXwpPvs67cJ4tmhe/iMOyVMh9
Yw/vBIF8scm6T/vPN5fopsKiW9UsAhGKg0epC6y5ed+NAUHTEa6pSOdo7CyFDwtn
4HF61Esyb4gzPT6QiSr0zvdTtgYBRZjAEPFVu3Dio0oZ5UQZ7fzdZfeixMQ8VMTQ
4y4x5vik9B+cqmGiq9AW71ixlDYVWasgR093fXiD9NLT4DTtK+KLGYNjJ8eMRqfZ
Ws7g7C+9aEGHfsGZ/SxLOumx/GfiTloal0dnq8TC7XQ/JuNdB9qjoXzRF+faDUsj
WuvNSQEqUXW1dzJjBvroEvgTdfCJfRpIgOrc256qvDMp1SxchMFltPlo5mbSMKu1
x1p4UkAzx543meMlRXOgx2/hnBm6H6L0FsSyDS6P224yF+30eeODD4Ju4BCyQ0jO
IpUxmUnApo/m0eRelI6TRl7jK6aGqSYUNhFBuFxSPKgKYBpFhVzRM63Jsvib82rY
438q3sIOUdxZY6pvMOWRkdUVoz7WBExTdx5NtGX4kdW5QtcQHM+2kht6sBnJsvcB
JYcYIwAUeA5vdRfwLKuZn6SgAUKdgeOtuf+cPR3/E68LZr784SlokiHLtQkfk98j
NXm6fJjXwJvwiM2IiFyg8aUwEEDX5U+QOCA0wYrgUQ/h8iathvBJKSc9jQARAQAB
tEJDZW50T1MtNyBLZXkgKENlbnRPUyA3IE9mZmljaWFsIFNpZ25pbmcgS2V5KSA8
c2VjdXJpdHlAY2VudG9zLm9yZz6JAjUEEwECAB8FAlOn/0sCGwMGCwkIBwMCBBUC
CAMDFgIBAh4BAheAAAoJECTGqKf0qA61TN0P/2730Th8cM+d1pEON7n0F1YiyxqG
QzwpC2Fhr2UIsXpi/lWTXIG6AlRvrajjFhw9HktYjlF4oMG032SnI0XPdmrN29lL
F+ee1ANdyvtkw4mMu2yQweVxU7Ku4oATPBvWRv+6pCQPTOMe5xPG0ZPjPGNiJ0xw
4Ns+f5Q6Gqm927oHXpylUQEmuHKsCp3dK/kZaxJOXsmq6syY1gbrLj2Anq0iWWP4
Tq8WMktUrTcc+zQ2pFR7ovEihK0Rvhmk6/N4+4JwAGijfhejxwNX8T6PCuYs5Jiv
hQvsI9FdIIlTP4XhFZ4N9ndnEwA4AH7tNBsmB3HEbLqUSmu2Rr8hGiT2Plc4Y9AO
aliW1kOMsZFYrX39krfRk2n2NXvieQJ/lw318gSGR67uckkz2ZekbCEpj/0mnHWD
3R6V7m95R6UYqjcw++Q5CtZ2tzmxomZTf42IGIKBbSVmIS75WY+cBULUx3PcZYHD
ZqAbB0Dl4MbdEH61kOI8EbN/TLl1i077r+9LXR1mOnlC3GLD03+XfY8eEBQf7137
YSMiW5r/5xwQk7xEcKlbZdmUJp3ZDTQBXT06vavvp3jlkqqH9QOE8ViZZ6aKQLqv
pL+4bs52jzuGwTMT7gOR5MzD+vT0fVS7Xm8MjOxvZgbHsAgzyFGlI1ggUQmU7lu3
uPNL0eRx4S1G4Jn5
=OGYX
-----END PGP PUBLIC KEY BLOCK-----

6、清理yum缓存并重启服务器

 yum -y makecache
 ## 如果报错，换源
 http://mirrors.aliyuncs.com/centos/%24releasever/os/x86_64/repodata/repomd.xml: [Errno 14] 

尝试CentOS-Base.repo内容更改为163的源
vim /etc/yum.repos.d/CentOS-Base.repo

#CentOS-Base.repo
#
# The mirror system uses the connecting IP address of the client and the
# update status of each mirror to pick mirrors that are updated to and
# geographically close to the client.  You should use this for CentOS updates
# unless you are manually picking other mirrors.
#
# If the mirrorlist= does not work for you, as a fall back you can try the
# remarked out baseurl= line instead.
#
#
[base]
name=CentOS-$7 - Base - 163.com
#mirrorlist=http://mirrorlist.centos.org/?release=$7&arch=$basearch&repo=os
baseurl=http://mirrors.163.com/centos/7/os/$basearch/
gpgcheck=1
gpgkey=http://mirrors.163.com/centos/RPM-GPG-KEY-CentOS-7

#released updates
[updates]
name=CentOS-$7 - Updates - 163.com
#mirrorlist=http://mirrorlist.centos.org/?release=$7&arch=$basearch&repo=updates
baseurl=http://mirrors.163.com/centos/7/updates/$basearch/
gpgcheck=1
gpgkey=http://mirrors.163.com/centos/RPM-GPG-KEY-CentOS-7

#additional packages that may be useful
[extras]
name=CentOS-$7 - Extras - 163.com
#mirrorlist=http://mirrorlist.centos.org/?release=$7&arch=$basearch&repo=extras
baseurl=http://mirrors.163.com/centos/7/extras/$basearch/
gpgcheck=1
gpgkey=http://mirrors.163.com/centos/RPM-GPG-KEY-CentOS-7

#additional packages that extend functionality of existing packages
[centosplus]
name=CentOS-$7 - Plus - 163.com
baseurl=http://mirrors.163.com/centos/7/centosplus/$basearch/
gpgcheck=1
enabled=0
gpgkey=http://mirrors.163.com/centos/RPM-GPG-KEY-CentOS-7

二、升级ssl和ssh

1、查看操作系统情况

cat /etc/redhat-release 
#输出：Red Hat Enterprise Linux Server release 7.6 (Maipo)
ssh -V 

2、下载SSH和SSL安装包

用wget下载
openssh-9.5p1.tar.gz
openssl-3.0.12.tar.gz

3、安装Telnet。避免卸载ssh后无法远程登录

#安装组件，Telnet运行需要依靠xinetd组件
yum install telnet-server.x86_64 xinetd.x86_64
#启动服务
systemctl enable telnet.socket
systemctl start telnet.socket 
systemctl start xinetd
#查看服务是否启动
systemctl status telnet.socket 
#关闭防火墙
systemctl stop firewalld
systemctl disable firewalld

4、用telnet登录并卸载旧版本SSH

yum remove openssh -y   //卸载旧版本SSH
rm -rf /etc/ssh/*       //删除原SSH文件

5、安装依赖包

yum -y install zlib* pam-* gcc make

6、升级ssl

6.1 解压源码包

tar -zxvf openssl-3.0.12.tar.gz

6.2 进入源码包执行config文件

 cd /root/Downloads/openssl-3.0.12
 ./config --prefix=/usr/local/openssl
 #根据安装过程中报的错误，安装依赖包，如perl、IPC/Cmd.pm等
 yum install perl*  //安装Perl命令
 yum install perl-ExtUtils-CBuilder perl-ExtUtils-MakeMaker //Can't locate IPC/Cmd.pm pm

6.3 编译安装

make -j4 && make install

6.4 配置软连接

ln -b /usr/local/openssl/lib64/libssl.so.3 /usr/lib64/libssl.so.3
ln -b /usr/local/openssl/lib64/libcrypto.so.3 /usr/lib64/libcrypto.so.3
ln -sf /usr/local/openssl/bin/openssl /usr/bin/openssl

6.5 查看是否安装成功

openssl version
#输出：OpenSSL 3.0.12 24 Oct 2023 (Library: OpenSSL 3.0.12 24 Oct 2023)即可

7、升级SSH

7.1 解压源码包

tar -zxvf  openssh-9.5p1.tar.gz

7.2 进入源码包目录编译安装

./configure --prefix=/usr/ --sysconfdir=/etc/ssh  --with-openssl-includes=/usr/local/openssl/include --with-ssl-dir=/usr/local/openssl   --with-zlib   --with-md5-passwords   --with-pam && make -j4&& make install

7.3 复制配置文件

cd /root/Downloads/openssh-9.5p1/contrib/redhat
cp -a sshd.init /etc/init.d/sshd
chmod u+x /etc/init.d/sshd

7.4 添加SSH开机自启动

chkconfig --add sshd
chkconfig sshd on

7.5 查看sshd运行状态

systemctl restart sshd
systemctl status sshd 

8、查看升级结果

ssh -V
#输出：OpenSSH_9.5p1, OpenSSL 3.0.12 24 Oct 2023，升级成功

9、卸载telnet-server包

yum remove telnet-server -y //只删除服务端，不删除客户端

三、问题处理

1、当使用 SSH 登录 Linux 云主机时，即便正确输入了密码，在命令行或 secure 日志中也会出现类似如下错误信息，导致连接失败

1.1 报错内容

Permission denied, please try again.
error: Could not get shadow infromation for root.

1.2 错误原因

该问题通常是由于系统启用了 SELinux 所致。

1.3 处理办法

编辑 /etc/selinux/config 文件
SELINUX=disabled

临时关闭SELinux
setenforce 0

2、将openssl升级至3.x找不到libssl.so.3和libcrypto.so.3

2.1 报错内容

openssl: error while loading shared libraries: libssl.so.3: cannot open shared object file: No such file or directory

2.2 报错原因

以前老版本的lib是1.0，没有把/usr/local/openssl/lib64/的libssl.so.3与/usr/lib或/usr/lib64建立软连接

2.3 处理办法

ln -b /usr/local/openssl/lib64/libssl.so.3 /usr/lib64/libssl.so.3
ln -b /usr/local/openssl/lib64/libcrypto.so.3 /usr/lib64/libcrypto.so.3

ln -b /usr/local/openssl/lib64/libssl.so.3 /usr/lib/libssl.so.3
ln -b /usr/local/openssl/lib64/libcrypto.so.3 /usr/lib/libcrypto.so.3

3、SSH文件权限问题，启动 systemctl restart sshd报权限错误

chmod 600 /etc/ssh/ssh*
systemctl status sshd.service
systemctl restart sshd 
systemctl status sshd.service