linux6 ssh升级7.8

故障现象描述

OpenSSH 7.3之前版本，sshd/auth-passwd.c/auth_password函数未限制密码验证中的密码长度，远程***者通过较长的字符串，利用此漏洞可造成拒绝服务。

实施步骤：
1.把源码包上传到各服务器，共3个
zlib-1.2.11.tar.gz
openssl-fips-2.0.16.tar.gz
openssh-7.8p1.tar.gz
2.安装telnet服务，并保证可以正常登录
yum -y install telnet-server
chkconfig telnet on
service xinetd restart
（进行远程登录，su到root后，设置TMOUT=0，并使用此终端操作）
3.卸载原openssh
service sshd stop
cp /etc/init.d/sshd /etc/init.d/sshd.OLD
cp /etc/pam.d/sshd /etc/pam.d/sshd. OLD
cp -r /etc/ssh /etc/ssh. OLD
rpm -qa | grep openssh
rpm -e openssh --nodeps
rpm -e openssh-server --nodeps
rpm -e openssh-clients --nodeps
rpm -e openssh-askpass --nodeps
4.安装zlib
tar xf zlib-1.2.11.tar.gz
cd zlib-1.2.11
./configure --prefix=/usr/local/zlib
make
make install
5.安装openssl
tar xf openssl -1.0.2p.tar.gz
cd openssl -1.0.2p
./config shared zlib --prefix=/usr/local/openssl 
make
make install
./config -t
make depend
vi /etc/ld.so.conf  /usr/local/openssl/lib
#ldconfig
在etc／的profile的最后一行，添加：

      export OPENSSL=/usr/local/openssl/bin

      export PATH=$OPENSSL:$PATH:$HOME/bin
 
mv /usr/bin/openssl /usr/bin/openssl.old

mv /usr/include/openssl /usr/include/openssl.old

ln -s /usr/local/openssl/bin/openssl /usr/bin/openssl

ln -s /usr/local/openssl/include/openssl /usr/include/openssl

ln -sf /usr/local/openssl/lib/libcrypto.so.1.0.0 /lib/libcrypto.so.6
echo ‘/usr/local/ssl/lib’ >> /etc/ld.so.conf
ldconfig
openssl version -a
6.安装openssh
tar zxf openssh-7.8p1.tar.gz
cd openssh-7.8p1
rm -rf /etc/ssh
./configure --prefix=/usr/local/openssh --sysconfdir=/etc/ssh --with-pam --with-ssl-dir=/usr/local/openssl --with-md5-passwords --mandir=/usr/share/man --with-zlib=/usr/local/zlib --without-hardening
make
make install
cp contrib/redhat/sshd.init /etc/init.d/sshd
chmod 755 /etc/init.d/sshd
chkconfig --add sshd
vim /etc/ssh/sshd_config #修改默认端口号
chkconfig sshd on
vi /etc/sshd/sshd_config
把#PermitRootLogin prohibit-password改为PermitRootLogin no
cp contrib/redhat/sshd.pam /etc/pam.d/sshd
ssh -V
service sshd start
7.验证ssh登录是否正常
8.关闭telnet服务

回退方法
1.使用telnet登录并切换到root用户
2.恢复openssl
service sshd stop
ln -sf /lib64/libcrypto.so.0.9.8e /lib64/libcrypto.so.6
ln -sf /lib64/libssl.so.0.9.8e /lib64/libssl.so.6
rm /usr/include/openssl
mv /usr/include/openssl.OFF1 /usr/include/openssl
rm /usr/bin/openssl
mv /usr/bin/openssl.OFF1 /usr/bin/openssl
vi /etc/ld.so.conf
删除 /usr/local/ssl/lib这行
ldconfig
openssl version -a
3.恢复opensh
chkconfig --del sshd
rm -rf /etc/sshd
rm -f /etc/pam.d/sshd
yum -y install openssh-*
ssh -V
cp /etc/ssh.OFF1/sshd_config /etc/ssh/
cp /etc/pam.d/sshd.OFF1 /etc/pam.d/
service sshd start
登录验证

转载于:https://blog.51cto.com/twj0413/2340994