Linux：升级openssh（6.8，7.2）

centos6.8 64位亲测可用

centos7 更新 https://www.cnblogs.com/tongchengbin/p/13809096.html

• 建议升级前先开通telnet 服务，以免升级失败后无法通过ssh 连接服务器，参考：Linux：telnet-server安装

• #Centos 7.2升级openssh 精简版（6.8应该也适用）
  
  cp /usr/bin/openssl /usr/bin/openssl_bak
  # cp /usr/include/openssl /usr/include/openssl_bak #7.2中并没有这个目录
  
  tar xfz openssl-1.0.2r.tar.gz
  cd openssl-1.0.2r/
  ./config shared && make && make install
  ln -s /usr/local/ssl/bin/openssl /usr/bin/openssl
  ln -s /usr/local/ssl/include/openssl /usr/include/openssl
  echo "/usr/local/ssl/lib" >> /etc/ld.so.conf
  /sbin/ldconfig
  openssl version
  
  tar xfz openssh-8.0p1.tar.gz
  cd openssh-8.0p1
  yum install zlib-devel pam-devel #可能需要
  ./configure --prefix=/usr/ --sysconfdir=/etc/ssh  --with-openssl-includes=/usr/local/ssl/include --with-ssl-dir=/usr/local/ssl --with-zlib --with-md5-passwords --with-pam 
  make && make install
   
  # sshd_config修改两处配置
  grep "^PermitRootLogin"  /etc/ssh/sshd_config
  PermitRootLogin yes
  grep  "UseDNS"  /etc/ssh/sshd_config
  UseDNS no
  
  cp -a contrib/redhat/sshd.init /etc/init.d/sshd
  cp -a contrib/redhat/sshd.pam /etc/pam.d/sshd.pam
  chmod +x /etc/init.d/sshd
  chkconfig --add sshd
  systemctl enable sshd
  chkconfig sshd on
  service sshd restart
  ssh –V

   

0、需要的包

打包下载地址：https://download.csdn.net/download/www_qitonghui_top/11259710

openssh 下载地址:
http://mirror.internode.on.net/pub/OpenBSD/OpenSSH/portable/
openssl 相关包下载：
http://www.openssl.org/source/
pam 相关包下载：
http://pkgs.org/centos-6/centos-x86_64/
zlib 包下载：
http://zlib.net/

1、安装Zlib、openssl-fips、openssl-devel

tar -zxvf zlib-1.2.11.tar.gz
cd zlib-1.2.11
./configure --prefix=/usr/local/zlib
make
make instal


tar -zxvf openssl-fips-2.0.16.tar.gz
cd openssl-fips-2.0.16
./config
make
make install


rpm -ivh openssl-devel-1.0.1e-57.el6.x86_64.rpm --nodeps --force

 2、将新编译的openssl library 加入系统动态库链接中

echo "/usr/local/ssl/fips-2.0/lib " >> /etc/ld.so.conf
ldconfig

 3、安装pam，首先卸载旧版本

查看版本信息：rpm -qa|grep pam
卸载旧版本：rpm -e --nodeps pam-1.1.1-20.el6.x86_64
安装pam：依次安装
rpm -ivh pam-1.1.1-24.el6.x86_64.rpm
rpm -ivh pam-devel-1.1.1-24.el6.x86_64.rpm
rpm -ivh tcp_wrappers-devel-7.6-58.el6.x86_64.rpm

4、安装OpenSSH

tar -zxvf openssh-7.4p1.tar.gz
cd openssh-7.4p1
./configure \
--prefix=/usr \
--sysconfdir=/etc/ssh \
--with-md5-passwords \
--with-pam \
--with-tcp-wrappers \
--with-ssl-dir=/usr/local/ssl \
--with-zlib=/usr/local/zlib \
--without-hardening
make
make install

mv /etc/init.d/sshd /etc/init.d/sshd_old
cd /xxx/…/openssh-7.4p1/contrib/redhat（openssh 安装包所在路径）
cp sshd.init /etc/init.d/sshd
cp ssh_config /etc/ssh/ssh_config
cp -p sshd_config /etc/ssh/sshd_config

vi /etc/ssh/sshd_config
将“#PermitRootLogin prohibit-password”修改为“PermitRootLogin yes”
将“#X11Forwarding no”修改为“X11Forwarding yes”

chmod u+x /etc/init.d/sshd
chkconfig --add sshd
chkconfig sshd on
# 重启sshd 服务
service sshd restart（或者/etc/init.d/sshd stop/start/restart/status）

5、安装openssl

tar -zxvf openssl-1.1.0k.tar.gz
cd openssl-1.1.0k
./config --prefix=/usr/local/sslshared no-zlib
make
make install

mv /usr/bin/openssl /usr/bin/openssl.bak
mv /usr/include/openssl /usr/include/openssl.bak
ln -s /usr/local/sslshared/bin/openssl /usr/bin/openssl
ln -s /usr/local/sslshared/include/openssl /usr/include/openssl
ln -s /usr/local/sslshared/lib/libssl.so.1.1 /usr/lib64/libssl.so.1.1
ln -s /usr/local/sslshared/lib/libcrypto.so.1.1 /usr/lib64/libcrypto.so.1.1

echo "/usr/local/sslshared/lib" >> /etc/ld.so.conf
ldconfig -v

6、重启sshd，查看版本

service sshd restart（或者/etc/init.d/sshd stop/start/restart/status）

# openssl version -a
OpenSSL 1.1.0k  28 May 2019
built on: reproducible build, date unspecified
platform: linux-x86_64
options:  bn(64,64) rc4(16x,int) des(int) idea(int) blowfish(ptr) 
compiler: gcc -DDSO_DLFCN -DHAVE_DLFCN_H -DNDEBUG -DOPENSSL_THREADS -DOPENSSL_NO_STATIC_ENGINE -DOPENSSL_PIC -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPADLOCK_ASM -DPOLY1305_ASM -DOPENSSLDIR="\"/usr/local/sslshared/ssl\"" -DENGINESDIR="\"/usr/local/sslshared/lib/engines-1.1\""  -Wa,--noexecstack
OPENSSLDIR: "/usr/local/sslshared/ssl"
ENGINESDIR: "/usr/local/sslshared/lib/engines-1.1"


# ssh -V
OpenSSH_8.0p1, OpenSSL 1.0.1e-fips 11 Feb 2013