由於之前的項目用的ssh的版本較低，最近被頻繁查出有安全漏洞
不得不進行升級避免安全問題
操作步驟
一、開啟telnet
記得先測試telnet能否成功登錄再升級openssh不然ssh會掛掉，當然如果你是在本機升級可以省略這一步 yum install telnet-server telnet systemctl start telnet.socket systemctl enable telnet.socket lsof -i:23 #開放防火牆策略 firewall-cmd --zone=public --add-port=23/tcp --permanent
二、備份舊的ssh
#查詢ssh目錄 whereis sshd mv /usr/sbin/sshd /usr/sbin/sshd.bak whereis ssh mv /usr/bin/ssh /usr/bin/ssh.bak whereis ssh-keygen mv /usr/bin/ssh-keygen /usr/bin/ssh-keygen.bak
三、卸載舊的openssh-server
yum remove openssh-server
四、安裝新的openssh-server
# 安裝依賴
yum install zlib-devel openssl-devel -y
cd /usr/local wget https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-8.8p1.tar.gz tar -zxvf openssh-8.8p1.tar.gz cd openssh-8.8p1 ./configure make & make install # 設置全局使用 cp /usr/local/sbin/sshd /usr/sbin cp /usr/local/bin/ssh /usr/bin cp /usr/local/bin/ssh-keygen /usr/bin/
五、查看新本版
ssh -V
六、啟動ssh 並設置開機自啟
cp /usr/local/openssh-8.8p1/contrib/redhat/sshd.init /etc/init.d/sshd /etc/init.d/sshd restart systemctl status sshd systemctl enable sshd
七、安裝后可能會導致ssh無法連接，解決辦法如下
第一步： cp /usr/local/openssh-8.8p1/sshd_config /etc/ssh/ 第二步： vim /etc/ssh/sshd_config 找到PermitRootLogin without-password 改成PermitRootLogin yes 第三步： vim /etc/init.d/sshd 在48行下面加上 OPTIONS="-f /etc/ssh/sshd_config"
第四步： systemctl daemon-reload systemctl restart sshd
如果報如下異常：
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the ECDSA key sent by the remote host is
SHA256:9XvufSSIeZ7MAurIZ1Qw9Z13YV1Zcim2kthmAlECgYw.
Please contact your system administrator.
Add correct host key in /root/.ssh/known_hosts to get rid of this message.
Offending ECDSA key in /root/.ssh/known_hosts:8
ECDSA host key for 192.168.122.100 has changed and you have requested strict checking.
Host key verification failed.
lost connection
嘗試刪除 rm -rf ~/.ssh/known_hosts
還有本地的：~/.ssh/known_hosts