离线升级openssh8.8

安装包和依赖均在百度网盘
https://pan.baidu.com/s/1jKaZGBDg4R0U9bYMfW7Zjw
提取码：ir33

需要openssh-8.8p1.tar.gz、openssl-1.1.1l.tar.gz、rpm.tar.gz

创建目录并传包

mkdir upload
cd upload
rz               //使用rz命令将包上传到upload文件夹中

解压安装包
tar -xvf openssl-1.1.1l.tar.gz
tar -xvf openssh-8.8p1.tar.gz
tar -xvf zlib-1.2.11.tar.gz


安装依赖
cd rpm
rpm -Uvh *.rpm --nodeps --force


安装openssl
cd ../openssl-1.1.1l
./config --prefix=/usr/local/ssl -d shared
make && make install
echo '/usr/local/ssl/lib' >> /etc/ld.so.conf
ldconfig -v


安装openssh
cd ../openssh-8.8p1
./configure --prefix=/usr/local/openssh --with-zlib=/usr/local/zlib --with-ssl-dir=/usr/local/ssl
make && make install


sshd_config文件修改
echo 'PermitRootLogin yes' >>/usr/local/openssh/etc/sshd_config
echo 'PubkeyAuthentication yes' >>/usr/local/openssh/etc/sshd_config
echo 'PasswordAuthentication yes' >>/usr/local/openssh/etc/sshd_config


替换/etc/ssh里的文件
mv /usr/sbin/sshd /usr/sbin/sshd.bak
 cp  /usr/local/openssh/sbin/sshd /usr/sbin/sshd

mv /usr/bin/ssh /usr/bin/ssh.bak
 cp  /usr/local/openssh/bin/ssh /usr/bin/ssh

mv /usr/bin/ssh-keygen /usr/bin/ssh-keygen.bak
 cp  /usr/local/openssh/bin/ssh-keygen /usr/bin/ssh-keygen

mv /etc/ssh/ssh_host_ecdsa_key.pub /etc/ssh/ssh_host_ecdsa_key.pub.bak
cp /usr/local/openssh/etc/ssh_host_ecdsa_key.pub /etc/ssh/ssh_host_ecdsa_key.pub

mv /etc/ssh/ssh_host_dsa_key.pub /etc/ssh/ssh_host_dsa_key.pub.bak
cp /usr/local/openssh/etc/ssh_host_dsa_key.pub /etc/ssh/ssh_host_dsa_key.pub


更换openssl文件
mv /usr/bin/openssl /usr/bin/openssl_bak
cp /usr/local/ssl/bin/openssl /usr/bin/openssl

mv /usr/include/openssl /usr/include/openssl_bak
 ln -s /usr/local/ssl/include/openssl /usr/include/openssl

echo "/usr/local/ssl/lib" >> /etc/ld.so.conf
/sbin/ldconfig


替换启动文件
cd  upload/openssh-8.8p1/
cp -a contrib/redhat/sshd.init /etc/init.d/sshd
 cp -a contrib/redhat/sshd.pam /etc/pam.d/sshd.pam
chmod +x /etc/init.d/sshd
chkconfig --add  sshd
systemctl enable sshd


sshd.service 会跟etc/init.d/sshd 文件形成冲突，而sshd.socket重启之后会发生报错所以进行移除
mv  /usr/lib/systemd/system/sshd.service   /usr/lib/systemd/system/sshd.service_bak
mv  /usr/lib/systemd/system/sshd.socket   /usr/lib/systemd/system/sshd.socket_bak

添加ssh开机启动
chkconfig sshd on
/etc/init.d/sshd restart

查看版本
ssh -V





升级过程中遇到的问题

1、KexAlgorithms 加密算法不支持报错， 先看一下报错信息

cat /var/log/message 

 Nov  4 16:03:20 localhost sshd[15961]: Unable to negotiate with 192.100.0.112 port 50581: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1 [preauth]

解释一下报错原因在openssh升级之后，默认不支持这四种加密算法，需要在本地sshd_config添加这四种算法，如果是按照我这种方法安装的只需下面这一条命令即可：

echo 'KexAlgorithms diffie-hellman-group1-sha1,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1' >>/usr/local/openssh/etc/sshd_config 

因为现在sshd 调用的配置文件在/usr/local/openssh/etc/sshd_config  而不是在/etc/ssh/sshd_config 最后再用sshd -T | grep kex验证一下，完美解决。

[root@localhost ~]# sshd -T | grep kex
kexalgorithms diffie-hellman-group1-sha1,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1

2、没有匹配的host key found 先看一下报错信息

Nov  4 16:26:11 localhost sshd[16438]: Unable to negotiate with 192.100.0.112 port 50725: no matching host key type found. Their offer: ssh-rsa,ssh-dss [preauth]

这个很简，单确认好sshd调用的配置文件后 

echo 'HostKeyAlgorithms +ssh-rsa,ssh-dss' >>/usr/local/openssh/etc/sshd_config

只需一条命令可以完全解决

3、出现create slice 死循环问题 先看日志

Jul 24 08:50:01 example.com systemd: Created slice user-0.slice.
Jul 24 08:50:01 example.com systemd: Starting Session 150 of user root.
Jul 24 08:50:01 example.com systemd: Started Session 150 of user root.
Jul 24 09:00:01 example.com systemd: Created slice user-0.slice.
Jul 24 09:00:02 example.com systemd: Starting Session 151 of user root.
Jul 24 09:00:02 example.com systemd: Started Session 151 of user root.
解决方法过滤掉相关的日志报警

echo 'if $programname == "systemd" and ($msg contains "Starting Session" or $msg contains "Started Session"
or $msg contains "Created slice" or $msg contains "Starting user-" or $msg contains "Starting User Slice
of" or $msg contains "Removed session" or $msg contains "Removed slice User Slice of" or $msg contains
"Stopping User Slice of") then stop' >/etc/rsyslog.d/ignore-systemd-session-slice.conf