一、環境介紹
查看openssh、openssl版本 [root@localhost ~]# openssl version OpenSSL 1.0.2k-fips 26 Jan 2017 [root@localhost ~]# ssh -V OpenSSH_7.4p1, OpenSSL 1.0.2k-fips 26 Jan 2017
查看linux發行版和內核 [root@localhost ~]# cat /etc/os-release NAME="CentOS Linux" VERSION="7 (Core)" ID="centos" ID_LIKE="rhel fedora" VERSION_ID="7" PRETTY_NAME="CentOS Linux 7 (Core)" ANSI_COLOR="0;31" CPE_NAME="cpe:/o:centos:centos:7" HOME_URL="https://www.centos.org/" BUG_REPORT_URL="https://bugs.centos.org/" CENTOS_MANTISBT_PROJECT="CentOS-7" CENTOS_MANTISBT_PROJECT_VERSION="7" REDHAT_SUPPORT_PRODUCT="centos" REDHAT_SUPPORT_PRODUCT_VERSION="7" [root@localhost ~]# uname -r 3.10.0-957.el7.x86_64
二、安裝配置telnet
2.1、安裝telnet-server
[root@localhost ~]# yum -y install xinetd telnet-server
2.2、配置telnet
`先看一下xinetd.d目錄下是否有telnet文件` [root@localhost ~]# ll /etc/xinetd.d/telnet ls: cannot access /etc/xinetd.d/telnet: No such file or directory `如果有，則將文件里面的disable = no改成disable = yes` `如果沒有，就進行下面的操作` [root@localhost ~]# cat > /etc/xinetd.d/telnet <<EOF service telnet { disable = yes flags = REUSE socket_type = stream wait = no user = root server = /usr/sbin/in.telnetd log_on_failure += USERID } EOF
2.3、配置telnet登錄的終端類型
[root@localhost ~]# cat >> /etc/securetty <<EOF pts/0 pts/1 pts/2 pts/3 EOF
2.4、啟動telnet服務
[root@localhost ~]# systemctl enable xinetd --now [root@localhost ~]# systemctl enable telnet.socket --now [root@localhost ~]# ss -nltp | grep 23 LISTEN 0 128 :::23 :::* users:(("systemd",pid=1,fd=46)) `23端口起來了，表示telnet服務正常運行`
三、切換登錄方式為telnet
后面的操作都是在telnet鏈接的方式下進行，避免ssh中斷導致升級失敗
以telnet方式登錄的時候，注意選擇協議和端口，協議為telnet，端口為23
四、開始升級OpenSSH
4.1、下載升級所需依賴包
[root@localhost ~]# yum -y install gcc gcc-c++ glibc make autoconf openssl openssl-devel pcre-devel pam-devel
4.2、下載OpenSSL和OpenSSH
openssl官網：https://www.openssl.org/
openssh官網：http://www.openssh.com/
[root@localhost ~]# wget https://www.openssl.org/source/openssl-1.1.1i.tar.gz [root@localhost ~]# wget http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-8.6p1.tar.gz [root@localhost ~]# tar xf openssl-1.1.1i.tar.gz [root@localhost ~]# tar xf openssh-8.6p1.tar.gz
4.3、編譯安裝OpenSSL
`開始之前，先備份一下原有的OpenSSL文件` [root@localhost ~]# mv /usr/bin/openssl{,.bak} [root@localhost ~]# mv /usr/include/openssl{,.bak}
[root@localhost ~]# cd openssl-1.1.1i/ [root@localhost openssl-1.1.1i]# ./config shared && make && make install
`編譯完成后，可以在/usr/local目錄下找到openssl的二進制文件和目錄` [root@localhost ~]# ll /usr/local/bin/openssl -rwxr-xr-x 1 root root 749136 Jan 14 14:25 /usr/local/bin/openssl [root@localhost ~]# ll -d /usr/local/include/openssl/ drwxr-xr-x 2 root root 4096 Jan 14 14:25 /usr/local/include/openssl/
`建立軟連接` [root@localhost ~]# ln -s /usr/local/bin/openssl /usr/bin/openssl [root@localhost ~]# ln -s /usr/local/include/openssl/ /usr/include/openssl [root@localhost ~]# ll /usr/bin/openssl lrwxrwxrwx 1 root root 22 Jan 14 14:32 /usr/bin/openssl -> /usr/local/bin/openssl [root@localhost ~]# ll -d /usr/include/openssl lrwxrwxrwx 1 root root 27 Jan 14 14:33 /usr/include/openssl -> /usr/local/include/openssl/
`重新加載配置，驗證openssl版本` [root@localhost ~]# echo "/usr/local/lib64" >> /etc/ld.so.conf [root@localhost ~]# /sbin/ldconfig [root@localhost ~]# openssl version OpenSSL 1.1.1i 8 Dec 2020
4.3.1、可能會有的一些報錯和解決方法
[root@localhost ~]# openssl version
openssl: error while loading shared libraries: libssl.so.1.1: cannot open shared object file: No such file or directory "這是因為libssl.so.1.1文件找不到，執行find / -name 'libssl.so.1.1'，將/etc/ld.so.conf里面的lib64改成find出來的路徑即可"
[root@localhost ~]# find / -name "openssl" "編譯完，可以用上面的find命令看一下openssl所在的路徑，以及include/openssl所在的路徑"
4.4、編譯安裝OpenSSH
`備份原有的ssh目錄`
[root@localhost ~]# mv /etc/ssh{,.bak} [root@localhost ~]# mkdir /usr/local/openssh [root@localhost ~]# cd openssh-8.4p1/ [root@localhost openssh-8.4p1]# ./configure --prefix=/usr/local/openssh \ --sysconfdir=/etc/ssh \ --with-openssl-includes=/usr/local/include \ --with-ssl-dir=/usr/local/lib64 \ --with-zlib \ --with-md5-passwords \ --with-pam && \ make && \ make install
4.4.1、配置sshd_config文件
[root@localhost ~]# echo "UseDNS no" >> /etc/ssh/sshd_config [root@localhost ~]# echo 'PermitRootLogin yes' >> /etc/ssh/sshd_config [root@localhost ~]# echo 'PubkeyAuthentication yes' >> /etc/ssh/sshd_config [root@localhost ~]# echo 'PasswordAuthentication yes' >> /etc/ssh/sshd_config
`如果是圖形化界面，需要x11的話，需要配置如下` [root@localhost ~]# echo "X11Forwarding yes" >> /etc/ssh/sshd_config [root@localhost ~]# echo "X11UseLocalhost no" >> /etc/ssh/sshd_config [root@localhost ~]# echo "XAuthLocation /usr/bin/xauth" >> /etc/ssh/sshd_config
4.4.2、創建新的sshd二進制文件
[root@localhost ~]# mv /usr/sbin/sshd{,.bak} [root@localhost ~]# mv /usr/bin/ssh{,.bak} [root@localhost ~]# mv /usr/bin/ssh-keygen{,.bak} [root@localhost ~]# ln -s /usr/local/openssh/bin/ssh /usr/bin/ssh [root@localhost ~]# ln -s /usr/local/openssh/bin/ssh-keygen /usr/bin/ssh-keygen [root@localhost ~]# ln -s /usr/local/openssh/sbin/sshd /usr/sbin/sshd `查看openssh當前版本` [root@localhost ~]# ssh -V OpenSSH_8.4p1, OpenSSL 1.1.1i 8 Dec 2020
4.4.3、重新啟動openssh服務
[root@localhost ~]# systemctl disable sshd --now [root@localhost ~]# mv /usr/lib/systemd/system/sshd.service{,.bak} [root@localhost ~]# systemctl daemon-reload [root@localhost ~]# cp -a openssh-8.6p1/contrib/redhat/sshd.init /etc/init.d/sshd [root@localhost ~]# cp -a openssh-8.6p1/contrib/redhat/sshd.pam /etc/pam.d/sshd.pam [root@localhost ~]# chkconfig --add sshd [root@localhost ~]# systemctl enable sshd --now
4.5、ssh鏈接成功后的處理
[root@localhost ~]# ssh root@192.168.****** `成功連接上之后，可以關閉telnet服務，當然，也可以不關閉` [root@localhost ~]# systemctl disable xinetd.service --now [root@localhost ~]# systemctl disable telnet.socket --now