openssl&&openssh平滑升级

Bertha 。 2022-09-21 01:28 275阅读 0赞

系统安装完成后，默认安装的openssl跟openssh版本较低，有安全隐患，于是对其进行升级，加固安全，首先升级openssl至1.0.2g版本，升级步骤如下

#!/bin/bash
    yum install zlib zlib-devel -y
    yum remove openssl-devel
    cd /data
    wget https://openssl.org/source/openssl-1.0.2g.tar.gz
    tar zvxf openssl-1.0.2g.tar.gz
    cd openssl-1.0.2g
    ./config shared zlib
    make depend
    make && make install
    mkdir -pv /tmp/usr/{bin,include}
    mv /usr/bin/openssl /tmp/usr/bin/
    mv /usr/include/openssl /tmp/usr/include/
    ln -sv /usr/local/ssl/bin/openssl /usr/bin/openssl
    ln -sv /usr/local/ssl/include/openssl/ /usr/include/openssl
    echo "/usr/local/ssl/lib" >> /etc/ld.so.conf 
    ldconfig -v | grep openssl
    openssl version -a

升级openssl完成后再升级openssh，首先添加普通用户并加入wheel组

groupadd test
    useradd tide -g test
    usermod -G wheel test
    echo "截取以下随机数设置test用户密码，用于升级后登录服务器"
    openssl rand -base64 30
    passwd tide

只允许wheel用户组的用户su切换，其他用户切换root，即使输对密码也会提示 incorrect password

vim /etc/pam.d/su
    auth            required        pam_wheel.so use_uid取消注释

下载安装openssh7.2版本，该版本成功升级后默认不允许root登录

cd /data
    mv /etc/ssh /etc/ssh.bak
    yum remove openssh
    yum install pam-devel
    wget http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-7.2p2.tar.gz
    tar zxf openssh-7.2p2.tar.gz 
    cd openssh-7.2p2
    ./configure --prefix=/usr --sysconfdir=/etc/ssh --with-pam --with-zlib --with-md5-passwordsmake
    make && make install
    chkconfig --add sshd
    chkconfig sshd --list
    ssh -V
    #远程连接服务器操作不可执行restart或者reload，否则会断开连接
    service sshd start

安装过程如果服务器启动不了，可能是缺少sshd服务启动脚本

#!/bin/bash
    #
    # Init file for OpenSSH server daemon
    #
    # chkconfig: 2345 55 25
    # description: OpenSSH server daemon
    #
    # processname: sshd
    # config: /etc/ssh/ssh_host_key
    # config: /etc/ssh/ssh_host_key.pub
    # config: /etc/ssh/ssh_random_seed
    # config: /etc/ssh/sshd_config
    # pidfile: /var/run/sshd.pid
    
    # source function library
    . /etc/rc.d/init.d/functions
    
    # pull in sysconfig settings
    [ -f /etc/sysconfig/sshd ] && . /etc/sysconfig/sshd
    
    RETVAL=0
    prog="sshd"
    
    # Some functions to make the below more readable
    SSHD=/usr/sbin/sshd
    PID_FILE=/var/run/sshd.pid
    
    do_restart_sanity_check()
    {
        $SSHD -t
        RETVAL=$?
        if [ $RETVAL -ne 0 ]; then
            failure $"Configuration file or keys are invalid"
            echo
        fi
    }
    
    start()
    {
        # Create keys if necessary
        /usr/bin/ssh-keygen -A
        if [ -x /sbin/restorecon ]; then
            /sbin/restorecon /etc/ssh/ssh_host_key.pub
            /sbin/restorecon /etc/ssh/ssh_host_rsa_key.pub
            /sbin/restorecon /etc/ssh/ssh_host_dsa_key.pub
            /sbin/restorecon /etc/ssh/ssh_host_ecdsa_key.pub
        fi
    
        echo -n $"Starting $prog:"
        $SSHD $OPTIONS && success || failure
        RETVAL=$?
        [ $RETVAL -eq 0 ] && touch /var/lock/subsys/sshd
        echo
    }
    
    stop()
    {
        echo -n $"Stopping $prog:"
        killproc $SSHD -TERM
        RETVAL=$?
        [ $RETVAL -eq 0 ] && rm -f /var/lock/subsys/sshd
        echo
    }
    
    reload()
    {
        echo -n $"Reloading $prog:"
        killproc $SSHD -HUP
        RETVAL=$?
        echo
    }
    
    case "$1" in
        start)
            start
            ;;
        stop)
            stop
            ;;
        restart)
            stop
            start
            ;;
        reload)
            reload
            ;;
        condrestart)
            if [ -f /var/lock/subsys/sshd ] ; then
                do_restart_sanity_check
                if [ $RETVAL -eq 0 ] ; then
                    stop
                    # avoid race
                    sleep 3
                    start
                fi
            fi
            ;;
        status)
            status $SSHD
            RETVAL=$?
            ;;
        *)
            echo $"Usage: $0 {start|stop|restart|reload|condrestart|status}"
            RETVAL=1
    esac
    exit $RETVAL

接下来配置只能使用密钥文件登录

ssh-keygen -t rsa -P "%fg8PY4DQg=" #密码使用随机openssl生成随机字符串，默认路径，回车
    mv id_rsa.pub authorized_keys
    chmod 600 authorized_keys

而后下载私钥文件 id\_rsa 到本地（可重命名为IP\_user\_id\_rsa），安全保存。  
接下来编辑sshd配置文件，取消注释

vim /etc/ssh/sshd_config
    RSAAuthentication yes
    PubkeyAuthentication yes
    AuthorizedKeysFile      .ssh/authorized_keys
    #关闭密码认证，建议测试完秘钥可登录再开启此项，否则远程连接端口，只能去机房操作服务器
    PasswordAuthentication no
    PermitEmptyPasswords no
    #重启sshd服务，生效配置
    service sshd restart

以后登录这台主机就必须以 test用户使用私钥，配合密码短语来登录  
其他安全设置

*  限制登录IP  
    `vim /etc/hosts.deny sshd:all vim /etc/hosts.allow sshd:192.168.1.1`
 *  在/etc/profile中添加：  
    登录超时，用户在线5分钟无操作则超时断开连接，  
    `export TMOUT=300 readonly TMOUT`  
    减少history命令记录  
    `HISTSIZE=1000 将该值调小`  
    每次退出时清理history  
    `history -c`
 *  增强特殊文件权限  
    `chattr +i /etc/passwd /etc/shadow /etc/ssh/sshd_config lsattr /etc/passwd /etc/shadow /etc/ssh/sshd_config`  
    修改配置需要先取消特殊权限chattr -i filename
 *  禁ping  
    `vim /etc/rc.d/rc.local echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all 或者通过iptables规则限制 ping本机 iptables -A INPUT -p icmp --icmp-type 0 -s 0/0 -j DROP ping其他主机 iptables -A OUTPUT -p icmp --icmp-type 8 -j DROP`

参考博文  
[https://segmentfault.com/a/1190000002532945][https_segmentfault.com_a_1190000002532945]

[https_segmentfault.com_a_1190000002532945]: https://segmentfault.com/a/1190000002532945