Red Hat linux环境openssh升级到openssh-10.0p1

原创已于 2025-05-09 15:00:10 修改 · 2k 阅读

18 ·

CC 4.0 BY-SA版权

文章标签：

#linux #服务器 #运维

于 2025-05-07 20:39:28 首次发布

Liunx 专栏收录该内容

3 篇文章

订阅专栏

由于外网服务器扫描出SSH高危漏洞，需要升级SSH版本。

一、新版本SSH下载：https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/ 解压、编译配置(注意正确配置openssl路径)、编译、安装：

tar -zxvf openssh-10.0p1.tar.gz

cd openssh-10.0p1

./configure --prefix=/usr/local/openssh --with-ssl-dir=/usr/local/openssl341 --sysconfdir=/etc/ssh --with-pam --with-gssapi --with-rsa --with-rhosts-allowed --with-zlib --with-md5-passwords

make && make install

在configure openssh时，有参数 --with-pam，会提示：
PAM is enabled. You may need to install a PAM control file for sshd, otherwise password authentication may fail. Example PAM control files can be found in the contrib/subdirectory
就是如果启用PAM，需要有一个控制文件，按照提示的路径找到redhat/sshd.pam，并复制到/etc/pam.d/sshd，在/etc/ssh/sshd_config中设置UsePAM yes。
/etc/pam.d/sshd中内容如下：

# 文件内容如下
#%PAM-1.0
auth	   required	pam_sepermit.so
auth       substack     password-auth
auth       include      postlogin
# Used with polkit to reauthorize users in remote sessions
-auth      optional     pam_reauthorize.so prepare
account    required     pam_nologin.so
account    include      password-auth
password   include      password-auth
# pam_selinux.so close should be the first session rule
session    required     pam_selinux.so close
session    required     pam_loginuid.so
# pam_selinux.so open should only be followed by sessions to be executed in the user context
session    required     pam_selinux.so open env_params
session    required     pam_namespace.so
session    optional     pam_keyinit.so force revoke
session    include      password-auth
session    include      postlogin
# Used with polkit to reauthorize users in remote sessions
-session   optional     pam_reauthorize.so prepare

/etc/ssh/sshd_config 中设置UsePAM yes

二、替换原openssh
1、备份替换相关文件

mv /usr/sbin/sshd /usr/sbin/sshd_bak
mv /usr/bin/ssh /usr/bin/ssh_bak
mv /usr/bin/ssh-keygen /usr/bin/ssh-keygen_bak

2、建立软连接

ln -s /usr/local/openssh/sbin/sshd /usr/sbin/sshd //建立软连接
ln -s /usr/local/openssh/bin/ssh /usr/bin/ssh //建立软连接
ln -s /usr/local/openssh/bin/ssh-keygen /usr/bin/ssh-keygen //建立软连接

或复制文件

cp -rf /usr/local/openssh/sbin/sshd /usr/sbin/sshd
cp -rf /usr/local/openssh/bin/ssh /usr/bin/ssh
cp -rf /usr/local/openssh/bin/ssh-keygen /usr/bin/ssh-keygen

三、修改配置：
解决root不能远程SSH登录问题(如果不需要root帐户登陆不用配置)