制作openssl 升级openssl rpm包修复 CVE-2021-3711、CVE-2021-3712

最新推荐文章于 2024-08-16 18:15:32 发布

yuezhilangniao

最新推荐文章于 2024-08-16 18:15:32 发布

阅读量1.5k

点赞数 1

分类专栏： linux_shell_ansible 文章标签： openssl

原文链接：https://cloud.tencent.com/developer/article/1767718

版权

linux_shell_ansible 专栏收录该内容

276 篇文章 7 订阅

订阅专栏

原文：https://cloud.tencent.com/developer/article/1767718
原因：【安全通告】OpenSSL多个漏洞风险公告（CVE-2021-3711、CVE-2021-3712）
https://cloud.tencent.com/announce/detail/1567

cd /root
wget https://www.openssl.org/source/openssl-1.1.1i.tar.gz # 源码包放到 /root/目录下即可

#!/bin/bash
set -e
set -v
mkdir ~/openssl && cd ~/openssl
yum -y install \
    curl \
    which \
    make \
    gcc \
    perl \
    perl-WWW-Curl \
    rpm-build
# Get openssl tarball
cp /root/openssl-1.1.1i.tar.gz ./

# SPEC file
cat << 'EOF' > ~/openssl/openssl.spec
Summary: OpenSSL 1.1.1i for Centos
Name: openssl
Version: %{?version}%{!?version:1.1.1i}
Release: 1%{?dist}
Obsoletes: %{name} <= %{version}
Provides: %{name} = %{version}
URL: https://www.openssl.org/
License: GPLv2+

Source: https://www.openssl.org/source/%{name}-%{version}.tar.gz

BuildRequires: make gcc perl perl-WWW-Curl
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root
%global openssldir /usr/openssl

%description
OpenSSL RPM for version 1.1.1i on Centos

%package devel
Summary: Development files for programs which will use the openssl library
Group: Development/Libraries
Requires: %{name} = %{version}-%{release}

%description devel
OpenSSL RPM for version 1.1.1i on Centos (development package)

%prep
%setup -q

%build
./config --prefix=%{openssldir} --openssldir=%{openssldir}
make

%install
[ "%{buildroot}" != "/" ] && %{__rm} -rf %{buildroot}
%make_install

mkdir -p %{buildroot}%{_bindir}
mkdir -p %{buildroot}%{_libdir}
ln -sf %{openssldir}/lib/libssl.so.1.1 %{buildroot}%{_libdir}
ln -sf %{openssldir}/lib/libcrypto.so.1.1 %{buildroot}%{_libdir}
ln -sf %{openssldir}/bin/openssl %{buildroot}%{_bindir}

%clean
[ "%{buildroot}" != "/" ] && %{__rm} -rf %{buildroot}

%files
%{openssldir}
%defattr(-,root,root)
/usr/bin/openssl
/usr/lib64/libcrypto.so.1.1
/usr/lib64/libssl.so.1.1

%files devel
%{openssldir}/include/*
%defattr(-,root,root)

%post -p /sbin/ldconfig

%postun -p /sbin/ldconfig
EOF


mkdir -p /root/rpmbuild/{BUILD,RPMS,SOURCES,SPECS,SRPMS}
cp ~/openssl/openssl.spec /root/rpmbuild/SPECS/openssl.spec

mv openssl-1.1.1i.tar.gz /root/rpmbuild/SOURCES
cd /root/rpmbuild/SPECS && \
    rpmbuild \
    -D "version 1.1.1i" \
    -ba openssl.spec

# Before Uninstall  Openssl :   rpm -qa openssl
# Uninstall Current Openssl Vesion : yum -y remove openssl
# For install:  rpm -ivvh /root/rpmbuild/RPMS/x86_64/openssl-1.1.1i-1.el7.x86_64.rpm --nodeps
# Verify install:  rpm -qa openssl
#                  openssl version

ansible 安装脚本 (rpm包放在 /root/code/下

---
- name: copy and sh shell
  hosts: "{{ host }}"
  vars:
      local_path: /root/code/
      mypath: /root/code/
  tasks:
  
    - name: mkdir
      shell: mkdir -p {{ local_path }}

    - name: copy shell
      copy: src="{{ mypath }}openssl-1.1.1i-1.el7.x86_64.rpm" dest={{ local_path }}
    - name: yum -y remove
      shell: yum -y remove openssl
    - name: rpm -ivh
      shell: rpm -ivvh {{ local_path }}openssl-1.1.1i-1.el7.x86_64.rpm --nodeps

    - name: rpm -qa openssl
      shell: rpm -qa openssl
      register: check
    - debug: var=check.stdout verbosity=0   #check.stdout 显示出的信息会看的更清晰点