centos7升级openSSH(亲测可用)

秒速五厘米 2022-12-05 10:11 1477阅读 0赞

**centos7升级openSSH(修改版)**

*  centos7升级openSSH(修改版) 1
 *  一:查看版本和下载 3
 *  1.1所需安装包目录 3
 *  1.2:查看系统openssh包 3
 *  1.3:查看版本 3
 *  1.4:下载地址 3
 *  二:安装telnet 4
 *  2.1:卸载telnet 4
 *  2.2:上传安装包 4
 *  2.3:安装 5
 *  2.4:启动服务 5
 *  2.5:设置开机自启 5
 *  2.6:查看telnet服务是否启动 5
 *  2.7:root用户登录测试 5
 *  三：编译安装gcc 6
 *  3.1：查看是否安装了gcc 6
 *  3.2：强制安装 6
 *  3.3:查看是否安装成功 7
 *  四:编译安装(升级openSSL) 7
 *  4.1:下载 7
 *  4.2:上传解压安装 8
 *  4.3:相关配置及验证 9
 *  1:加载新配置 9
 *  2:验证 9
 *  五:编译安装(openssl-devel;pam-devel;openSSH) 10
 *  5.1:编译安装openssl-devel 10
 *  5.2编译安装pam-devel 10
 *  1:在线安装 10
 *  2:离线安装 10
 *  5.3:编译安装openSSH 11
 *  六:编译安装openSSH和配置 12
 *  6.1:配置root用户登录 12
 *  6.2:开机自启,服务启动 13
 *  1:拷贝目录 13
 *  2:开机自启 13
 *  3:加入系统服务 13
 *  七:启动服务测试 14
 *  7.1:启停服务,查看端口 14
 *  1:停止ssh服务 14
 *  2:查看端口 14
 *  3:启动ssh服务 14
 *  4:再次查看端口 14
 *  5:重启ssh服务 15
 *  7.2:重启虚拟机,连接xshell测试(查看版本) 15
 *  7.3:关闭telnet服务 15

**一:查看版本和下载**

所有安装包下载地址:

链接：https://pan.baidu.com/s/1INkUPgBCrv2Dx05PE5XVLA   
        提取码：i627

**1.1所需安装包目录**

所有服务器的openssh更新的都是统一的上传文件目录： /tools/openSSH,因为openSSH升级可能涉及到几台甚至几十台服务器,统一的路径便于同时多台服务器做升级操作及后期维护

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI2OTYzNDMz_size_16_color_FFFFFF_t_70][]

**1.2:查看系统openssh包**

rpm -qa|grep openssh

![20200909180311959.png][]

**1.3:查看版本**

ssh  -V

**1.4:下载地址**

[https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/][https_cdn.openbsd.org_pub_OpenBSD_OpenSSH_portable]

**二:安装telnet**

建议安装,如果你升级到一半,VPN突然掉了,或者网络断开,你就连不上xshell了,如果安装了telnet后,就是网络和VPN断开,也可以进行下一步操作

**2.1:卸载telnet**

为了避免在生产上安装openSSH失败,安装telnet

检查telnet是否安装

rpm -qa | grep telnet

没有安装，如果安装，请先卸载后重新安装

列如：

关闭telnet服务

systemctl disable xinetd.service

systemctl stop xinetd.service

systemctl disable telnet.socket

systemctl stop telnet.socket

执行卸载

rpm -e --nodeps telnet-0.17-47.el6.x86\_64

rpm -e --nodeps telnet-server-0.17-64.el7.x86\_64

**2.2:上传安装包**

统一上传路径 /tools/telnet

**2.3:安装**

注意: 需要先安装xinetd,然后安装telnet客户端,再安装telnet服务端,不然可能会报错

cd  /tools/telnet

rpm -ivh xinetd-2.3.14-38.el6.x86\_64.rpm

rpm -ivh telnet-0.17-47.el6.x86\_64.rpm

rpm -ivh telnet-server-0.17-64.el7.x86\_64.rpm

**2.4:启动服务**

systemctl start telnet.socket

systemctl start xinetd

**2.5:设置开机自启**

3:设置xinetd开机自启

systemctl enable xinetd.service

4:设置telnet开机自启

systemctl enable telnet.socket

**2.6:查看telnet服务是否启动**

netstat -antupl | grep 23

cat /etc/services | grep -a 'telnet'

![20200909180604504.png][]

**2.7:root用户登录测试**

开放root用户的权限,编辑以下文件.注释掉这一行:auth       required     pam\_securetty.so

vim /etc/pam.d/remote

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI2OTYzNDMz_size_16_color_FFFFFF_t_70 1][]

然后关闭centos7防火墙

停止firewall

systemctl stop firewalld.service

firewall开机启动

systemctl disable firewalld.service

window测试

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI2OTYzNDMz_size_16_color_FFFFFF_t_70 2][]

**三：编译安装gcc**

**3.1：查看是否安装了gcc**

gcc  -v

![20200909180745511.png][]

表示需要安装gcc

**3.2：强制安装**

进入安装目录

cd  /tools/openSSH/gcc

rpm  -ivh  \*.rpm --nodeps --force

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI2OTYzNDMz_size_16_color_FFFFFF_t_70 3][]

**3.3:查看是否安装成功**

gcc -v

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI2OTYzNDMz_size_16_color_FFFFFF_t_70 4][]

**四:编译安装(升级openSSL)**

**4.1:下载**

[https://ftp.openssl.org/source/old/1.0.2/][https_ftp.openssl.org_source_old_1.0.2]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI2OTYzNDMz_size_16_color_FFFFFF_t_70 5][]

查看当前版本

openssl  version

![20200909180922435.png][]

**4.2:上传解压安装**

**1:解压**

cd  /tools/openSSH

tar   -zxvf     openssl-1.0.2.tar.gz  -C /training/

**2:编译安装**

1:进入到安装目录

cd /training/openssl-1.0.2/

2:编译安装

./config shared && make && make install

以上命令执行完毕，echo $?查看下最后的make install是否有报错，0表示没有问题

**3:检测是否编译正确**

echo $?

如果数字为0，则编译安装成功

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI2OTYzNDMz_size_16_color_FFFFFF_t_70 6][]

**4:备份后做软链接**

1:先进行备份

\[root@gnc-4a-umap-03 openssl-1.0.2\]\# ll /usr/bin/openssl

\[root@gnc-4a-umap-03 openssl-1.0.2\]\#  mv /usr/bin/openssl /usr/bin/openssl\_bak

2:软链接

ln -s /usr/local/ssl/bin/openssl /usr/bin/openssl

ll /usr/bin/openssl

![20200909180945256.png][]

**4.3:相关配置及验证**

**1:加载新配置**

\[root@gnc-4a-umap-03 openssl-1.0.2\]\#  echo "/usr/local/ssl/lib" >> /etc/ld.so.conf

\[root@gnc-4a-umap-03 openssl-1.0.2\]\# /sbin/ldconfig

**2:验证**

openssl version

![20200909181000223.png][]

**五:编译安装(openssl-devel;pam-devel;openSSH)**

**5.1:编译安装openssl-devel**

在本地的centos镜像文件下的O:\\Packages目录下,依次找到下列文件,然后进行上传

/tools/openSSH/openssl-devel

![20200909181055576.png][]

然后直接强制性安装

cd /tools/openSSH/openssl-devel

rpm  -ivh  \*.rpm --nodeps --force

**5.2编译安装pam-devel**

**1:在线安装**

yum install openssl openssl-devel -y

**2:离线安装**

下载地址

[http://rpmfind.net/linux/rpm2html/search.php?query=pam-devel(x86-64)][http_rpmfind.net_linux_rpm2html_search.php_query_pam-devel_x86-64]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI2OTYzNDMz_size_16_color_FFFFFF_t_70 7][]

cd  /tools/openSSH

rpm   -ivh   pam-devel-1.1.8-23.el7.x86\_64.rpm  --nodeps --force

![20200909181217929.png][]

**5.3:编译安装openSSH**

**1:解压**

cd /tools/openSSH

tar -zxvf openssh-8.0p1.tar.gz -C /training/

**2:编译安装**

1:进入安装目录

cd /training/openssh-8.0p1/

2:执行编译安装命令

./configure --prefix=/usr/ --sysconfdir=/etc/ssh  --with-openssl-includes=/usr/local/ssl/include \\

--with-ssl-dir=/usr/local/ssl   --with-zlib   --with-md5-passwords   --with-pam  && make && make install

![20200909181400119.png][]

**3:查看是否安装成功**

echo $?

**4:授予权限（如果不授权，会启动ssh失败）**

1:授予文件可写的权限

chmod 600 /etc/ssh/ssh\_host\_rsa\_key

chmod 600 /etc/ssh/ssh\_host\_ecdsa\_key

chmod 600 /etc/ssh/ssh\_host\_ed25519\_key

2:授予权限后,再次编译安装

./configure --prefix=/usr/ --sysconfdir=/etc/ssh  --with-openssl-includes=/usr/local/ssl/include \\

--with-ssl-dir=/usr/local/ssl   --with-zlib   --with-md5-passwords   --with-pam  && make && make install

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI2OTYzNDMz_size_16_color_FFFFFF_t_70 8][]

**六:编译安装openSSH和配置**

**6.1:配置root用户登录**

修改配置文件

vim  /etc/ssh/sshd\_config

取消注释\#PermitRootLogin yes,也就是说给root登录放行

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI2OTYzNDMz_size_16_color_FFFFFF_t_70 9][]

**6.2:开机自启,服务启动**

下面的文件根据启动需要看是否拷贝,如果启动报sshd:未识别的服务,就需要拷贝下列文件

**1:拷贝目录**

进入到openSSH安装目录:

cd  /training/openssh-8.0p1/

cp -a contrib/redhat/sshd.init /etc/init.d/sshd

cp -a contrib/redhat/sshd.pam /etc/pam.d/sshd.pam

chmod +x /etc/init.d/sshd

把原先的systemd管理的sshd文件删除或者移走或者删除，不移走的话影响我们重启sshd服务

mv  /usr/lib/systemd/system/sshd.service  /training/

**2:开机自启**

chkconfig sshd on

![20200909181513607.png][]

**3:加入系统服务**

chkconfig --add sshd

systemctl enable sshd

**七:启动服务测试**

**7.1:启停服务,查看端口**

1:停止ssh服务

\[root@gnc-4a-umap-03 openssh-8.0p1\]\#  /etc/init.d/sshd stop

![20200909181609634.png][]

2:查看端口

netstat -lntp

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI2OTYzNDMz_size_16_color_FFFFFF_t_70 10][]

3:启动ssh服务

\[root@gnc-4a-umap-03 openssh-8.0p1\]\# /etc/init.d/sshd start

4:再次查看端口

netstat -lntp

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI2OTYzNDMz_size_16_color_FFFFFF_t_70 11][]

5:重启ssh服务

\[root@gnc-4a-umap-03 openssh-8.0p1\]\# /etc/init.d/sshd restart

**7.2:重启虚拟机,连接xshell测试(查看版本)**

**生产环境，不要擅自重启虚拟机**

查看版本

\[root@gnc-4a-umap-03 openssh-8.0p1\]\# ssh -V

OpenSSH\_8.0p1, OpenSSL 1.0.2 22 Jan 2015

已经升级成功了

![20200909181651137.png][]

**7.3****:****关闭telnet服务**

ssh升级成功后，telnet就用不上了，这时可以将其服务关闭,恢复原始状态

systemctl disable xinetd.service

systemctl stop xinetd.service

systemctl disable telnet.socket

systemctl stop telnet.socket

然后卸载掉

rpm -qa | grep telnet

rpm -qa | grep xinetd

rpm -e --nodeps telnet-server-0.17-64.el7.x86\_64

rpm -e --nodeps xinetd-2.3.14-38.el6.x86\_64

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI2OTYzNDMz_size_16_color_FFFFFF_t_70]: /images/20221123/eb0c64c515a94dc8812abb0bc1a918eb.png
[20200909180311959.png]: /images/20221123/5466a156bbf44f4e8cbd091acd511a16.png
[https_cdn.openbsd.org_pub_OpenBSD_OpenSSH_portable]: https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/
[20200909180604504.png]: /images/20221123/05fe65feee144d41b3a8c87c349e7127.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI2OTYzNDMz_size_16_color_FFFFFF_t_70 1]: /images/20221123/144b5d3ea3cc46d18bbb071034739161.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI2OTYzNDMz_size_16_color_FFFFFF_t_70 2]: /images/20221123/60166f0288ec4762a1b4eb8340ec404c.png
[20200909180745511.png]: /images/20221123/bfe699c223384a6c831aeee07ac6bdc8.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI2OTYzNDMz_size_16_color_FFFFFF_t_70 3]: /images/20221123/4c040f37d1084691ab137e426b670db2.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI2OTYzNDMz_size_16_color_FFFFFF_t_70 4]: /images/20221123/028efad3fb0e4cd9a205517aaee9f91a.png
[https_ftp.openssl.org_source_old_1.0.2]: https://ftp.openssl.org/source/old/1.0.2/
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI2OTYzNDMz_size_16_color_FFFFFF_t_70 5]: /images/20221123/6c002b2fad3e430dac827992abacf3d1.png
[20200909180922435.png]: /images/20221123/a335e4c61a35454c815fc137d3cfcead.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI2OTYzNDMz_size_16_color_FFFFFF_t_70 6]: /images/20221123/1668fb2eab2a448f9b20d963675edfd2.png
[20200909180945256.png]: /images/20221123/c067dd201699421b895ecdbddfe462cc.png
[20200909181000223.png]: /images/20221123/8294c6a344514e4fa103a088632c37db.png
[20200909181055576.png]: /images/20221123/6228622238e94469958255b9399f4a8a.png
[http_rpmfind.net_linux_rpm2html_search.php_query_pam-devel_x86-64]: http://rpmfind.net/linux/rpm2html/search.php?query=pam-devel%28x86-64%29
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI2OTYzNDMz_size_16_color_FFFFFF_t_70 7]: /images/20221123/4590dc1fdd354cb0a8fc85280a10edd5.png
[20200909181217929.png]: /images/20221123/4a85355d281f4fb4b8d98336c4d094bd.png
[20200909181400119.png]: /images/20221123/2a9e9342445e4e058439fcd10feee80d.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI2OTYzNDMz_size_16_color_FFFFFF_t_70 8]: /images/20221123/b6bc711fe9dc49cc9ebb69395c2b35ef.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI2OTYzNDMz_size_16_color_FFFFFF_t_70 9]: /images/20221123/a5070ce0cba7473d8ea61520f64da4be.png
[20200909181513607.png]: /images/20221123/3d3647c3b0cb4cf0bd613d9f75dcc5f9.png
[20200909181609634.png]: /images/20221123/8b50f30ff1d7421db6f3d5d4aae73dbd.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI2OTYzNDMz_size_16_color_FFFFFF_t_70 10]: /images/20221123/32af62f92f564fb6ba4cdc9b53654349.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI2OTYzNDMz_size_16_color_FFFFFF_t_70 11]: /images/20221123/6bcea3d1108f48dd861e26b81a70a786.png
[20200909181651137.png]: /images/20221123/04d36eda0a824d92be81b101c4a5cbd9.png