linux ssh rpm包,Centos 升级至 OpenSSH 8 rpm包制作-Go语言中文社区

背景

安全部门扫描系统漏洞，OpenSSH 7.9出现漏洞，需升级到8。

使用 rpmbuild 将源码包编译为 rpm包。

yum install rpm-build zlib-devel openssl-devel gcc perl-devel pam-devel unzip -y

mkdir -p /root/rpmbuild/{SOURCES,SPECS}

cd /root/rpmbuild/SOURCES

wget https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-8.0p1.tar.gz

wget https://src.fedoraproject.org/repo/pkgs/openssh/x11-ssh-askpass-1.2.4.1.tar.gz/8f2e41f3f7eaa8543a2440454637f3c3/x11-ssh-askpass-1.2.4.1.tar.gz

tar zxvf openssh-8.0p1.tar.gz openssh-8.0p1/contrib/redhat/openssh.spec

mv openssh-8.0p1/contrib/redhat/openssh.spec ../SPECS/

chown sshd:sshd /root/rpmbuild/SPECS/openssh.spec

cp /root/rpmbuild/SPECS/openssh.spec /root/rpmbuild/SPECS/openssh.spec_def

sed -i -e "s/%define no_gnome_askpass 0/%define no_gnome_askpass 1/g" /root/rpmbuild/SPECS/openssh.spec

sed -i -e "s/%define no_x11_askpass 0/%define no_x11_askpass 1/g" /root/rpmbuild/SPECS/openssh.spec

cd /root/rpmbuild/SPECS/

rpmbuild -ba openssh.spec

编译过程遇到的错误:

错误：构建依赖失败： openssl-devel < 1.1 被 openssh-8.0p1-1.el7.x86_64 需要

解决：[root@localhost SPECS]# vim openssh.spec 注释掉 BuildRequires: openssl-devel < 1.1 这一行

安装后要修改选项：

cd /etc/ssh/

chmod 400 ssh_host_ecdsa_key ssh_host_ed25519_key ssh_host_rsa_key

echo "PermitRootLogin no" >> /etc/ssh/sshd_config

systemctl restart sshd

centos 7 记得修改这个文件。不然会出现密码是对的，却无法登陆。

[root@iZ16pk5aqeZ ~]# cat /etc/pam.d/sshd

#%PAM-1.0

auth required pam_sepermit.so

auth include password-auth

account required pam_nologin.so

account include password-auth

password include password-auth

## pam_selinux.so close should be the first session rule

session required pam_selinux.so close

session required pam_loginuid.so

## pam_selinux.so open should only be followed by sessions to be executed in the user context

session required pam_selinux.so open env_params

session optional pam_keyinit.so force revoke

session include password-auth