ansible批量漏洞升级openssh版本

1、ansible宿主机准备好环境，并写好hosts文件

[root@oxidized ansible]# cat hosts
[all]
10.10.200.33
10.10.200.34
10.10.200.35

跑playbook之前记得提前发送秘钥
ssh-copy-id 10.10.200.33/34/35

2、下载好安装包，然后编写yml

[root@oxidized ansible]# cat loudongBD.yml
- name: 漏洞修复
  hosts: all
  tasks:
    - name: copy openssl
      copy:
        src: /openssh_upgrade_9.7/openssl-3.1.5.tar.gz
        dest: /usr/local/src/openssl-3.1.5.tar.gz
    - name: copy openssh
      copy:
        src: /openssh_upgrade_9.7/openssh-9.7p1.tar.gz
        dest: /usr/local/src/openssh-9.7p1.tar.gz
    - name: copy upgrade脚本
      copy:
        src: /etc/ansible/loudongBD_ssh.sh
        dest: /usr/local/src/loudongBD_ssh.sh
    - name:
      copy:
        src: /etc/ansible/loudongBD_ssl.sh
        dest: /usr/local/src/loudongBD_ssl.sh
    - name: openssl升级
      shell: sh /usr/local/src/loudongBD_ssl.sh
    - name: openssh升级
      shell: sh /usr/local/src/loudongBD_ssh.sh

3、两个shell脚本内容如下

openssl升级脚本：

[root@oxidized ansible]# cat loudongBD_ssl.sh
#!/bin/bash
cd /etc/yum.repos.d/ && mkdir bak
mv *.repo bak/
cat >>/etc/yum.repos.d/local.repo <<EOF
[base]
name=Nexus
baseurl=http://10.10.200.20:8081/repository/yumHosted/
enabled=1
gpgcheck=0
EOF

yum makecache fast


yum install gcc gcc-c++ openssl-devel libstdc++* libcap* pam-devel zlib-devel perl perl-IPC-Cmd -y

cd /usr/local/src/

mv /usr/lib64/openssl /usr/lib64/openssl.old

yum -y remove openssl

tar xf openssl-3.1.5.tar.gz

cd /usr/local/src/openssl-3.1.5

./config --prefix=/usr

make && make install

openssh升级脚本：

[root@oxidized ansible]# cat loudongBD_ssh.sh
 #!/bin/bash

cd  /usr/local/src/

tar xf openssh-9.7p1.tar.gz

mkdir /etc/ssh.bak

mv /etc/ssh/ /etc/ssh.bak

cd /usr/local/src/openssh-9.7p1

./configure --prefix=/usr --sysconfdir=/etc/ssh --with-ssl-dir=/usr/local/openssl --with-md5-passwords

make && make install

cp /usr/local/src/openssh-9.7p1/contrib/redhat/sshd.init /etc/init.d/sshd

mv /usr/lib/systemd/system/sshd.service /usr/lib/systemd/system/sshd.service.bak

cp /etc/ssh/sshd_config{,.bak}

sed -i 's/^PermitRootLogin/#&/' /etc/ssh/sshd_config

sed -i '32i PermitRootLogin yes' /etc/ssh/sshd_config

chkconfig --add sshd

systemctl daemon-reload

systemctl restart sshd

4、环境准备好后，直接运行剧本即可

[root@oxidized ansible]# ansible-playbook loudongBD.yml

5、升级后检查ssh版本

[root@oxidized ansible]# ssh -V
OpenSSH_9.7p1, OpenSSL 3.1.5 30 Jan 2024