修复SSH漏洞,升级openssh8.8,openssl1.1.1

创建一下文件 vi ssh.sh，进入I模式将以下内容贴进去，然后进入:模式，输入wq回车

#!/bin/bash

yum install -y pam* zlib* openssl-devel gcc

#第一步：安装perl
wget -c http://mirrors.163.com/cpan/src/5.0/perl-5.28.3.tar.gz --no-check-certificate
tar -zxvf perl-5.28.3.tar.gz
mkdir /usr/local/perl
cd perl-5.28.3
./Configure -des -Dprefix=/usr/local/perl -Dusethreads –Uversiononly
make && make install
perl -v
cd ..

#第二步：更新openssl
wget https://www.openssl.org/source/openssl-1.1.1l.tar.gz --no-check-certificate
mv /usr/bin/openssl /usr/bin/openssl.old
mv /usr/include/openssl /usr/include/openssl.old
tar -zxvf openssl-1.1.1l.tar.gz
cd openssl-1.1.1l/
./config --prefix=/usr/local/openssl
make && make install
ln -s /usr/local/openssl/bin/openssl /usr/bin/openssl
ln -s /usr/local/openssl/include/openssl /usr/include/openssl
echo "/usr/local/openssl/lib" >> /etc/ld.so.conf
ldconfig -v
openssl version
cd ..


#第三步：安装openssh
#权限要改为600,否则会报警
chmod 600 /etc/ssh/* 
wget -c https://mirrors.aliyun.com/pub/OpenBSD/OpenSSH/portable/openssh-8.8p1.tar.gz --no-check-certificate

cp /usr/bin/ssh /usr/bin/ssh.bak
cp /usr/sbin/sshd /usr/sbin/sshd.bak
mv /etc/ssh /etc/ssh.bak
tar -zxvf openssh-8.8p1.tar.gz
cd openssh-8.8p1

./configure --prefix=/usr --sysconfdir=/etc/ssh --with-md5-passwords --with-pam --with-tcp-wrappers --with-ssl-dir=/usr/local/openssl --with-zlib=/usr/local/lib64 --without-hardening

make && make install

# 修改启动文件和pam
cp ./contrib/redhat/sshd.init /etc/init.d/sshd
cp -a contrib/redhat/sshd.pam /etc/pam.d/sshd.pam

echo -e "\n" >> /etc/ssh/sshd_config
echo "UsePAM yes" >> /etc/ssh/sshd_config
echo "PermitRootLogin yes" >> /etc/ssh/sshd_config
echo "PubkeyAuthentication yes" >> /etc/ssh/sshd_config
echo "PasswordAuthentication yes" >> /etc/ssh/sshd_config
echo -e "\n" >> /etc/ssh/sshd_config

cd ..
mv /usr/lib/systemd/system/sshd.service /usr/lib/systemd/system/sshd.service_bak
systemctl daemon-reload
systemctl restart sshd
systemctl status sshd
ssh -V

chmod 777 ./ssh.sh
./ssh.sh