由于升级OpenSSH涉及到安全性问题，为保险起见，在升级前最好安装telnet服务作为备用方案，然后在升级成功后再停止telnet即可。


一、OpenSSH升级相关源码包下载地址:


zlib  http://www.zlib.net/zlib-1.2.11.tar.gz

zlib其他版本下载地址 http://www.zlib.net/fossils/

openssl-fips https://www.openssl.org/source/old/fips/openssl-fips-2.0.12.tar.gz

OpenSSL https://www.openssl.org/source/openssl-1.0.2k.tar.gz

OpenSSH  http://openbsd.hk/pub/OpenBSD/OpenSSH/portable/ openssh-7.4p1.tar.gz


二、RHEL7配置yum源


1.新建iso存放目录


#mkdir iso


用winscp上传rhel-server-7.1-x86_64-dvd.iso 上传至 /iso 目录


2.新建iso挂载目录 /yum

#mkdir /yum


3.上传到rhel-server-7.1-x86_64-dvd.iso 至 /iso目录，然后挂载到/yum目录下


#mount -o loop /rhel-server-7.1-x86_64-dvd.iso /yum


4、在目录/etc/yum.repos.d/创建文件文件名.repo 


5、配置本地yum源


#cd /etc/yum.repos.d/   #进入yum配置目录 


#touch rhel7.repo   #建立yum配置文件 


#vi rhel7.repo   #编辑配置文件，添加以下内容： 


[media]

name=RHEL7.1

baseurl=file:///yum

enabled=1

gpgcheck=1

gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release

~

:wq! #保存退出


说明：


[media]


name=rhel7           #自定义名称 


baseurl=file:///mnt  #本地光盘挂载路径 


enabled=1            #启用yum源，0为不启用，1为启用 


gpgcheck=0           #检查GPG-KEY，0为不检查，1为检查 


gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release



#yum clean all

Loaded plugins: product-id, refresh-packagekit, security, subscription-manager

Updating certificate-based repositories.

Unable to read consumer identity

Cleaning repos: rhel-source

Cleaning up Everything


#yum update

Loaded plugins: product-id, refresh-packagekit, security, subscription-manager

Updating certificate-based repositories.

Unable to read consumer identity

rhel-source                                              | 4.0 kB     00:00 ... 

rhel-source/primary_db                                   | 3.1 MB     00:00 ... 

Setting up Update Process

No Packages marked for Update


#yum makecache


Loaded plugins: product-id, refresh-packagekit, security, subscription-manager

Updating certificate-based repositories.

Unable to read consumer identity

rhel-source                                              | 4.0 kB     00:00 ... 

rhel-source/filelists_db                                 | 3.7 MB     00:00 ... 

rhel-source/other_db                                     | 1.6 MB     00:00 ... 

rhel-source/group_gz                                     | 204 kB     00:00 ... 

Metadata Cache Created



三、安装telnet服务


先检查RHEL7是否已经安装以下两个安装包:telnet-server、xinetd。命令如下：


#rpm -qa telnet-server

#rpm -qa xinetd


如果没有安装，则先安装。安装命令：



1. 使用yum安装telnet


#yum list |grep telnet

telnet-server.x86_64                   1:0.17-59.el7               @media       

telnet.x86_64                          1:0.17-59.el7               media 

#yum install telnet-server.x86_64 

#yum install telnet.x86_64



或

#yum -y install telnet-server

Loaded plugins: langpacks, product-id, subscription-manager

This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register.

Resolving Dependencies

--> Running transaction check

---> Package telnet-server.x86_64 1:0.17-59.el7 will be installed

--> Finished Dependency Resolution


Dependencies Resolved


==================================================================================

 Package               Arch           Version                 Repository     Size

==================================================================================

Installing:

 telnet-server         x86_64         1:0.17-59.el7           media          40 k


Transaction Summary

==================================================================================

Install  1 Package


Total download size: 40 k

Installed size: 55 k

Downloading packages:

warning: /yum/Packages/telnet-server-0.17-59.el7.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID fd431d51: NOKEY

Public key for telnet-server-0.17-59.el7.x86_64.rpm is not installed

Retrieving key from file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release

Importing GPG key 0xFD431D51:

 Userid     : "Red Hat, Inc. (release key 2) <security@redhat.com>"

 Fingerprint: 567e 347a d004 4ade 55ba 8a5f 199e 2f91 fd43 1d51

 Package    : redhat-release-server-7.1-1.el7.x86_64 (@anaconda/7.1)

 From       : /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release

Importing GPG key 0x2FA658E0:

 Userid     : "Red Hat, Inc. (auxiliary key) <security@redhat.com>"

 Fingerprint: 43a6 e49c 4a38 f4be 9abf 2a53 4568 9c88 2fa6 58e0

 Package    : redhat-release-server-7.1-1.el7.x86_64 (@anaconda/7.1)

 From       : /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release

Running transaction check

Running transaction test

Transaction test succeeded

Running transaction

  Installing : 1:telnet-server-0.17-59.el7.x86_64                             1/1 

  Verifying  : 1:telnet-server-0.17-59.el7.x86_64                             1/1 


Installed:

  telnet-server.x86_64 1:0.17-59.el7

#####################################################################################


2.使用yum安装xinetd


#yum list |grep xinetd

xinetd.x86_64                          2:2.3.15-12.el7             @media

#yum install xinetd.x86_64

或

#yum install xinetd

Loaded plugins: langpacks, product-id, subscription-manager

This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register.

Resolving Dependencies

--> Running transaction check

---> Package xinetd.x86_64 2:2.3.15-12.el7 will be installed

--> Finished Dependency Resolution


Dependencies Resolved


==================================================================================

 Package         Arch            Version                     Repository      Size

==================================================================================

Installing:

 xinetd          x86_64          2:2.3.15-12.el7             media          128 k


Transaction Summary

==================================================================================

Install  1 Package


Total download size: 128 k

Installed size: 261 k

Is this ok [y/d/N]: y

Downloading packages:

Running transaction check

Running transaction test

Transaction test succeeded

Running transaction

  Installing : 2:xinetd-2.3.15-12.el7.x86_64                                  1/1 

  Verifying  : 2:xinetd-2.3.15-12.el7.x86_64                                  1/1 


Installed:

  xinetd.x86_64 2:2.3.15-12.el7                                                   


Complete!


2. 启动telnet服务


安装完成后，将xinetd服务加入开机自启动:


#systemctl enable xinetd.service



#将telnet服务加入开机自启动：


#systemctl enable telnet.socket


最后，启动以上两个服务即可：


#systemctl start telnet.socket

#systemctl status telnet.socket


telnet.socket - Telnet Server Activation Socket

   Loaded: loaded (/usr/lib/systemd/system/telnet.socket; enabled)

   Active: active (listening) since Sun 2017-04-09 01:52:57 PDT; 1min 38s ago

     Docs: man:telnetd(8)

   Listen: [::]:23 (Stream)

 Accepted: 0; Connected: 0



#systemctl start xinetd（或service xinetd start）


#systemctl status xinetd.service


xinetd.service - Xinetd A Powerful Replacement For Inetd

   Loaded: loaded (/usr/lib/systemd/system/xinetd.service; enabled)

   Active: active (running) since Sun 2017-04-09 01:53:37 PDT; 4min 5s ago

  Process: 3296 ExecStart=/usr/sbin/xinetd -stayalive -pidfile /var/run/xinetd.pid $EXTRAOPTIONS (code=exited, status=0/SUCCESS)

 Main PID: 3297 (xinetd)

   CGroup: /system.slice/xinetd.service

           └─3297 /usr/sbin/xinetd -stayalive -pidfile /var/run/xinetd.pid


Apr 09 01:53:37 localhost.localdomain xinetd[3297]: removing discard

Apr 09 01:53:37 localhost.localdomain xinetd[3297]: removing discard

Apr 09 01:53:37 localhost.localdomain xinetd[3297]: removing echo

Apr 09 01:53:37 localhost.localdomain xinetd[3297]: removing echo

Apr 09 01:53:37 localhost.localdomain xinetd[3297]: removing tcpmux

Apr 09 01:53:37 localhost.localdomain xinetd[3297]: removing time

Apr 09 01:53:37 localhost.localdomain xinetd[3297]: removing time

Apr 09 01:53:37 localhost.localdomain xinetd[3297]: xinetd Version 2.3.15 start...

Apr 09 01:53:37 localhost.localdomain xinetd[3297]: Started working: 0 availabl...

Apr 09 01:53:37 localhost.localdomain systemd[1]: Started Xinetd A Powerful Re....

Hint: Some lines were ellipsized, use -l to show in full.


#查看防火墙状态


#systemctl status firewalld


#添加防火墙规则（telnet加入防火墙）


$ sudo firewall-cmd --zone=public --add-port=23/tcp --permanent

success


$ sudo firewall-cmd --reload 

success


如果不使用“--permanent”标记，把么防火墙规则在重启后会失效



五、安装依赖包


#yum -y install gcc pam-devel zlib-devel openssl-devel


Loaded plugins: product-id, refresh-packagekit, security, subscription-manager

Updating certificate-based repositories.

Unable to read consumer identity

Setting up Install Process

Package gcc-4.4.6-4.el6.x86_64 already installed and latest version

Resolving Dependencies

--> Running transaction check

---> Package openssl-devel.x86_64 0:1.0.0-20.el6_2.5 will be installed

--> Processing Dependency: krb5-devel for package: openssl-devel-1.0.0-20.el6_2.5.x86_64

---> Package pam-devel.x86_64 0:1.1.1-10.el6_2.1 will be installed

---> Package zlib-devel.x86_64 0:1.2.3-27.el6 will be installed

--> Running transaction check

---> Package krb5-devel.x86_64 0:1.9-33.el6 will be installed

--> Processing Dependency: libselinux-devel for package: krb5-devel-1.9-33.el6.x86_64

--> Processing Dependency: libcom_err-devel for package: krb5-devel-1.9-33.el6.x86_64

--> Processing Dependency: keyutils-libs-devel for package: krb5-devel-1.9-33.el6.x86_64

--> Running transaction check

---> Package keyutils-libs-devel.x86_64 0:1.4-4.el6 will be installed

---> Package libcom_err-devel.x86_64 0:1.41.12-12.el6 will be installed

---> Package libselinux-devel.x86_64 0:2.0.94-5.3.el6 will be installed

--> Processing Dependency: libsepol-devel >= 2.0.32-1 for package: libselinux-devel-2.0.94-5.3.el6.x86_64

--> Processing Dependency: pkgconfig(libsepol) for package: libselinux-devel-2.0.94-5.3.el6.x86_64

--> Running transaction check

---> Package libsepol-devel.x86_64 0:2.0.41-4.el6 will be installed

--> Finished Dependency Resolution


Dependencies Resolved


================================================================================

 Package                 Arch       Version               Repository       Size

================================================================================

Installing:

 openssl-devel           x86_64     1.0.0-20.el6_2.5      rhel-source     1.1 M

 pam-devel               x86_64     1.1.1-10.el6_2.1      rhel-source     204 k

 zlib-devel              x86_64     1.2.3-27.el6          rhel-source      44 k

Installing for dependencies:

 keyutils-libs-devel     x86_64     1.4-4.el6             rhel-source      28 k

 krb5-devel              x86_64     1.9-33.el6            rhel-source     1.2 M

 libcom_err-devel        x86_64     1.41.12-12.el6        rhel-source      31 k

 libselinux-devel        x86_64     2.0.94-5.3.el6        rhel-source     136 k

 libsepol-devel          x86_64     2.0.41-4.el6          rhel-source      64 k


Transaction Summary

================================================================================

Install       8 Package(s)


Total download size: 2.8 M

Installed size: 6.1 M

Downloading Packages:

--------------------------------------------------------------------------------

Total                                            23 MB/s | 2.8 MB     00:00     

Running rpm_check_debug

Running Transaction Test

Transaction Test Succeeded

Running Transaction

  Installing : libsepol-devel-2.0.41-4.el6.x86_64                           1/8 

  Installing : libselinux-devel-2.0.94-5.3.el6.x86_64                       2/8 

  Installing : libcom_err-devel-1.41.12-12.el6.x86_64                       3/8 

  Installing : zlib-devel-1.2.3-27.el6.x86_64                               4/8 

  Installing : keyutils-libs-devel-1.4-4.el6.x86_64                         5/8 

  Installing : krb5-devel-1.9-33.el6.x86_64                                 6/8 

  Installing : openssl-devel-1.0.0-20.el6_2.5.x86_64                        7/8 

  Installing : pam-devel-1.1.1-10.el6_2.1.x86_64                            8/8 

Installed products updated.

  Verifying  : openssl-devel-1.0.0-20.el6_2.5.x86_64                        1/8 

  Verifying  : keyutils-libs-devel-1.4-4.el6.x86_64                         2/8 

  Verifying  : zlib-devel-1.2.3-27.el6.x86_64                               3/8 

  Verifying  : libselinux-devel-2.0.94-5.3.el6.x86_64                       4/8 

  Verifying  : libcom_err-devel-1.41.12-12.el6.x86_64                       5/8 

  Verifying  : libsepol-devel-2.0.41-4.el6.x86_64                           6/8 

  Verifying  : krb5-devel-1.9-33.el6.x86_64                                 7/8 

  Verifying  : pam-devel-1.1.1-10.el6_2.1.x86_64                            8/8 


Installed:

  openssl-devel.x86_64 0:1.0.0-20.el6_2.5  pam-devel.x86_64 0:1.1.1-10.el6_2.1 

  zlib-devel.x86_64 0:1.2.3-27.el6        


Dependency Installed:

  keyutils-libs-devel.x86_64 0:1.4-4.el6                                        

  krb5-devel.x86_64 0:1.9-33.el6                                                

  libcom_err-devel.x86_64 0:1.41.12-12.el6                                      

  libselinux-devel.x86_64 0:2.0.94-5.3.el6                                      

  libsepol-devel.x86_64 0:2.0.41-4.el6                                          


Complete!


启动一个服务：systemctl start postfix.service

关闭一个服务：systemctl stop postfix.service

重启一个服务：systemctl restart postfix.service

显示一个服务的状态：systemctl status postfix.service

在开机时启用一个服务：systemctl enable postfix.service

在开机时禁用一个服务：systemctl disable postfix.service

查看服务是否开机启动：systemctl is-enabled postfix.service

查看已启动的服务列表：systemctl list-unit-files|grep enabled

查看启动失败的服务列表：systemctl --failed


PS：使用命令 systemctl is-enabled postfix.service 得到的值可以是enable、disable或static，这里的 static 它是指对应的 Unit 文件中没有定义[Install]区域，因此无法配置为开机启动服务。 


说明：启用服务就是在当前“runlevel”的配置文件目录/etc/systemd/system/multi-user.target.wants/里，建立/usr/lib/systemd/system里面对应服务配置文件的软链接；禁用服务就是删除此软链接，添加服务就是添加软连接


# systemctl enable telnet.socket

ln -s '/usr/lib/systemd/system/telnet.socket' '/etc/systemd/system/sockets.target.wants/telnet.socket'




六、安装zlib


1.解压

#tar -xvf zlib-1.2.11.tar.gz                 


#cd zlib-1.2.11

 

2.配置

#./configure

 

3.编译安装   

#make             


#make install

 

4.查看

#ll /usr/local/lib


total 240

-rw-r--r--. 1 root root 135146 Apr  8 07:59 libz.a

lrwxrwxrwx. 1 root root     14 Apr  8 07:59 libz.so -> libz.so.1.2.11

lrwxrwxrwx. 1 root root     14 Apr  8 07:59 libz.so.1 -> libz.so.1.2.11

-rwxr-xr-x. 1 root root 106088 Apr  8 07:59 libz.so.1.2.11

drwxr-xr-x. 2 root root   4096 Apr  8 07:59 pkgconfig




七、安装openssl-fips-2.0.14


1.解压

#tar -xzvf openssl-fips-2.0.14.tar.gz


#cd openssl-fips-2.0.14

 

2.配置

#./config

 

3.编译安装

#make


#make install 


八、安装openssl-1.0.2k


1.解压

#tar -xzvf openssl-1.0.2k.tar.gz          


#cd openssl-1.0.2k

 

2.配置

#./config

 

3.编译安装

#make


#make test


#make install

 

4.设置软连接


#ln -s /usr/local/ssl/bin/openssl /usr/bin/openssl           #设置软连接，如果提示已存在，则无需再设置


ln: creating symbolic link `/usr/bin/openssl': File exists


5.查看新安装的openssl版本


#openssl version -a


OpenSSL 1.0.0-fips 29 Mar 2010


九、安装openssh-7.4p1


1.解压

#tar -xzvf openssh-7.4p1.tar.gz


#cd openssh-7.4p1

 

2.编译


#./configure --prefix=/usr --sysconfdir=/etc/ssh --with-md5-passwords --with-pam --with-tcp-wrappers --with-ssl-dir=/usr/local/ssl --without-hardening

 

3.编译安装


#make


#make install

 

！！！警告，升级完openssh-7.4p1后，在未修改以下权限前，禁止断开连接，否则连不上ssh

就麻烦了

#chown :root ssh_host_rsa_key

#chmod 600 ssh_host_rsa_key

#systemctl status sshd.service


#chown :root ssh_host_ecdsa_key

#chmod 600 ssh_host_ecdsa_key

#systemctl status sshd.service


#chown :root ssh_host_ed25519_key

#chmod 600 ssh_host_ed25519_key

#system status sshd.service


#启动服务：

#systemctl start sshd.service


#查看服务状态

#systemctl status sshd.service


#添加开机启动

#systemctl enable sshd.service

enable


#验证是否开机启动


#systemctl is-enabled sshd.service


enabled


#验证openssh版本是否升级成功


#ssh -V


查看所有已启动的服务


#systemctl list-units --type=service