Centos7 编译安装Openssh

syx4410177

已于 2023-11-06 16:07:01 修改

阅读量2.3k

点赞数

分类专栏： Linux 文章标签： linux 服务器运维

于 2022-03-18 16:47:43 首次发布

本文链接：https://blog.csdn.net/syx4410177/article/details/123576711

版权

Linux 专栏收录该内容

12 篇文章 0 订阅

订阅专栏

Centos7 编译安装Openssh

安装Telnet服务
安装前准备
安装服务
查看ssh加密协议
其他

安装Telnet服务

预防安装openssh失败导致无法远程连接服务，事先安装telnet服务以备用。

安装服务

# yum install xinetd telnet-server

修改配置

现在很多centos7版本安装telnet-server以及xinetd之后没有一个叫telnet的配置文件了。
如果下面telnet文件不存在的话，可以跳过这部分的更改。

# cat /etc/xinetd.d/telnet

# default: on
# description: The telnet server serves telnet sessions; it uses \
#   unencrypted username/password pairs for authentication.
service telnet
{
    disable = no
    flags       = REUSE
    socket_type = stream       
    wait        = no
    user        = root
    server      = /usr/sbin/in.telnetd
    log_on_failure  += USERID
}

修改disable = yes

配置telnet登录的终端类型，在/etc/securetty文件末尾增加一些pts终端，如下

# vi /etc/securetty
pts/0
pts/1
pts/2
pts/3

启动服务

设置开机启动xinetd服务
# systemctl enable xinetd
设置开机启动telnet服务
# systemctl enable telnet.socket
启动telnet
# systemctl start telnet.socket
启动xinetd
# systemctl start xinetd

检查服务
# netstat -lntp|grep 23
tcp6       0      0 :::23                   :::*                    LISTEN      1/systemd      

远程连接服务
计入cmd程序使用
telnet <ip> <端口>
> telnet 10.0.0.12 23

关闭服务

关闭开机启动xinetd服务
# systemctl disable xinetd.service
关闭xinetd
# systemctl stop xinetd.service
关闭开机启动telnet服务
# systemctl disable telnet.socket
关闭telnet
# systemctl stop telnet.socket

安装前准备

安装相关依赖
# yum install  -y gcc gcc-c++ glibc make autoconf openssl openssl-devel pcre-devel  pam-devel
下载zlib
# wget https://www.zlib.net/zlib-1.2.11.tar.gz
下载openssl
# wget https://www.openssl.org/source/openssl-1.1.1n.tar.gz
下载openssh
# wget https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-8.9p1.tar.gz

安装服务

安装zlib

解压软件
# tar -zvxf openssl-1.1.1n.tar.gz
编译安装
# cd zlib-1.2.11
# ./configure --prefix=/usr/local/zlib
# make && make install

安装openssl

解压软件
# tar -zvxf zlib-1.2.11.tar.gz
编译安装
# cd openssl-1.1.1n
# ./config --prefix=/usr/local/ssl -d shared
# make && make install

修改配置
# echo '/usr/local/ssl/lib' >> /etc/ld.so.conf
查看配置
# ldconfig -v

安装openssh

解压软件
# tar -zvxf openssh-8.9p1.tar.gz
编译安装
# cd openssh-8.9p1
# ./configure --prefix=/usr/local/openssh --with-ssl-dir=/usr/local/ssl --with-selinux --with-zlib=/usr/local/zlib --with-pam
或
# ./configure --prefix=/usr/local/openssh --with-ssl-dir=/usr/local/ssl --with-selinux --with-zlib --with-pam
# make && make install

修改配置
# echo 'PermitRootLogin no' >>/usr/local/openssh/etc/sshd_config
# echo 'X11Forwarding yes' >>/usr/local/openssh/etc/sshd_config
# echo 'UsePAM yes' >>/usr/local/openssh/etc/sshd_config
# echo 'PasswordAuthentication yes' >>/usr/local/openssh/etc/sshd_config
# echo 'SyslogFacility AUTHPRIV' >>/usr/local/openssh/etc/sshd_config
# echo 'KbdInteractiveAuthentication no' >>/usr/local/openssh/etc/sshd_config
# echo 'HostKey /etc/ssh/ssh_host_rsa_key' >>/usr/local/openssh/etc/sshd_config
# echo 'HostKey /etc/ssh/ssh_host_ecdsa_key' >>/usr/local/openssh/etc/sshd_config
# echo 'HostKey /etc/ssh/ssh_host_ed25519_key' >>/usr/local/openssh/etc/sshd_config

备份/etc/ssh目录下的所有文件
# cp -r /etc/ssh /etc/ssh-bak
备份文件：
# mv /usr/sbin/sshd /usr/sbin/sshd.bak
# mv /usr/bin/ssh /usr/bin/ssh.bak
# mv /usr/bin/ssh-keygen /usr/bin/ssh-keygen.bak
# mv /usr/lib/systemd/system/sshd.service  /usr/lib/systemd/system/sshd.service.bak



将/usr/local/openssh/etc/下的文件拷贝到/etc/ssh目录下
# cp -r /usr/local/openssh/etc/ /etc/ssh
拷贝文件
# cp /usr/local/openssh/sbin/sshd /usr/sbin/sshd
# cp /usr/local/openssh/bin/ssh /usr/bin/ssh
# cp /usr/local/openssh/bin/ssh-keygen /usr/bin/ssh-keygen
到openssh-8.9p1目录下拷贝
# cp -a contrib/redhat/sshd.init /etc/init.d/sshd
# cp -a contrib/redhat/sshd.pam /etc/pam.d/sshd.pam

##启动openssh服务

添加启动列表
# chkconfig --add sshd
开启开机启动
# systemctl enable sshd
设置sshd服务开机启动
# chkconfig sshd on

重启服务
# /etc/init.d/sshd restart

检查服务版本
ssh -V
查看端口信息
netstat -lntp

查看ssh加密协议

#查看ssh加密算法
/usr/local/openssh/sbin/sshd -T | grep ciphers
/usr/local/openssh/sbin/sshd -T | grep macs

#检查ssh启用的算法
nmap --script "ssh2*" 127.0.0.1

#centos安装nmap
yum install nmap

其他

修改端口号

需改sshd_config文件配置
Port 22022

修改SELinux
查看本机SELinux状态,如果是关闭则可以跳过此步骤
# sestatus
查看当前SELinux允许的ssh端口：
# semanage port -l | grep ssh
安装semanage命令：
# yum install policycoreutils-python
添加22022端口到SELinux：
# semanage port -a -t ssh_port_t -p tcp 22022
# semanage port -l | grep ssh

重启服务
# systemctl restart sshd.service

注：需要修改sshd.socket文件，否则重启服务后端口号会变成22
# vi /usr/lib/systemd/system/sshd.socket
ListenStream=22022

问题

SSH远程服务器时报错 /bin/bash : Permission denied

Feb 1 22:28:57 localhost setroubleshoot: SELinux is preventing /usr/local/sbin/sshd from using the transition access on a process. For complete SELinux messages. run sealert -l 6ca7e4db-d52f-41a3-8199-505f7a77a6c9
Feb 1 22:28:57 localhost python: SELinux is preventing /usr/local/sbin/sshd from using the transition access on a process.
* Plugin catchall (100. confidence) suggests 
**  If you believe that sshd should be allowed transition access on processes labeled unconfined_t by default. Then you should report this as a bug. You can generate a local policy module to allow this access.
Do allow this access for now by executing:
# ausearch -c 'sshd' --raw | audit2allow -M my-sshd
# semodule -i my-sshd.pp

于是运行下面两个命令：
# ausearch -c 'sshd' --raw | audit2allow -M my-sshd
# semodule -i my-sshd.pp