CentOS 系列离线升级 OpenSSH

声明：

   此文档只应用于CentOS 6.x、CentOS 7.x及RedHat 6.x、RedHat 7.x， 其它操作系统升级OpenSSh请自行测试。升级失败可能会导致业务受到影响，影响范围请根据业务自行评估。已知受到的影响有: scp，sftp，ssh等

注意：

   升级版本之前请保证telnet或vnc开启，并保持端口常开，如有防火墙配置，请自行放行telnet及vnc端口，升级前，确定telnet及vnc服务可以正常使用！

1.安装包准备

2.安装必要的依赖包

[root@localhost ~]# yum -y install wget gcc make perl pam-devel libselinux-devel

OpenSSH下载地址：OpenSSH
OpenSSL下载地址：OpenSSL
Zlib下载地址：Zlib

上传 zlib、OpenSSL、OpenSSH 至 /opt 目录下

3.安装 zlib 1.3.1

[root@localhost ~]# cd /opt
[root@localhost opt]# tar -xf zlib-1.3.1.tar.gz
[root@localhost opt]# cd zlib-1.3.1
[root@localhost zlib-1.3.1]# ./configure --prefix=/usr/local/zlib --libdir=/lib64
[root@localhost zlib-1.3.1]# make -j `cat /proc/cpuinfo|grep processor|wc -l` 
[root@localhost zlib-1.3.1]# make install

4.安装 OpenSSL 1.1.1.w

[root@localhost ~]# cd /opt/		
[root@localhost opt]# tar -xf openssl-1.1.1w.tar.gz
[root@localhost opt]# cd openssl-1.1.1w/
[root@localhost openssl-1.1.1w]# ./config --prefix=/usr/local/openssl shared zlib \
    --with-zlib-lib=/usr/local/zlib/lib \
    --with-zlib-include=/usr/local/zlib/include
[root@localhost openssl-1.1.1w]# make -j `cat /proc/cpuinfo|grep processor|wc -l`
[root@localhost openssl-1.1.1w]# make install
[root@localhost openssl-1.1.1w]# mv -f /usr/bin/openssl /usr/bin/openssl.bak
[root@localhost openssl-1.1.1w]# ln -s /usr/local/openssl/bin/openssl /usr/bin/openssl
[root@localhost openssl-1.1.1w]# mv -f /usr/lib64/libssl.so.1.1 /usr/lib64/libssl.so.1.1.bak
[root@localhost openssl-1.1.1w]# ln -s /usr/local/openssl/lib/libssl.so.1.1 /usr/lib64/libssl.so.1.1
[root@localhost openssl-1.1.1w]# mv -f /usr/lib64/libcrypto.so.1.1 /usr/lib64/libcrypto.so.1.1.bak
[root@localhost openssl-1.1.1q]# ln -s /usr/local/openssl/lib/libcrypto.so.1.1 /usr/lib64/libcrypto.so.1.1
[root@localhost openssl-1.1.1q]# vim /etc/ld.so.conf
[root@localhost openssl-1.1.1q]# cat /etc/ld.so.conf
include ld.so.conf.d/*.conf

/usr/local/openssl/lib

[root@localhost openssl-1.1.1q]# ldconfig

[root@localhost openssl-1.1.1q]# openssl version

5.安装 OpenSSH 10.0p1

[root@localhost ~]# rpm -qa |grep openssh |xargs rpm -e --nodeps
[root@localhost ~]# mv /usr/bin/ssh /usr/bin/ssh.bak
[root@localhost ~]# mv /usr/sbin/sshd /usr/sbin/sshd.bak
[root@localhost ~]# mv /etc/ssh/ /etc/ssh.bak
[root@localhost ~]# cd /opt/		
[root@localhost opt]# tar -zxvf openssh-10.0p1.tar.gz
[root@localhost opt]# cd openssh-10.0p1
[root@localhost openssh-10.0p1]# ./configure --prefix=/usr/local/openssh \
    --sysconfdir=/etc/ssh \
    --with-ssl-dir=/usr/local/openssl \
    --with-zlib=/usr/local/zlib \
    --with-pam \
    --with-md5-passwords \
    --without-hardening  \
    --with-ldflags
[root@localhost openssh-10.0p1]# make -j `cat /proc/cpuinfo|grep processor|wc -l`
[root@localhost openssh-10.0p1]# make  isntall
[root@localhost openssh-10.0p1]# ln -s /usr/local/openssh/sbin/sshd /usr/sbin/sshd
[root@localhost openssh-10.0p1]# ln -s /usr/local/openssh/bin/ssh /usr/bin/ssh
[root@localhost openssh-10.0p1]# rm -rf /usr/bin/scp
[root@localhost openssh-10.0p1]# ln -s /usr/local/openssh/bin/scp  /usr/bin/scp
[root@localhost openssh-10.0p1]# rm -rf /usr/bin/ssh-keygen /usr/bin/ssh-keygen
[root@localhost openssh-10.0p1]# ln -s /usr/local/openssh/bin/ssh-keygen /usr/bin/ssh-keygen
[root@localhost openssh-10.0p1]# rm -rf /etc/init.d/sshd
[root@localhost openssh-10.0p1]# rm -rf /usr/lib/system/system/sshd.servece
[root@localhost openssh-10.0p1]# cat << EOF > /etc/systemd/system/sshd.service
[Unit]
Description=OpenSSH server daemon
Documentation=man:sshd(8) man:sshd_config(5)
After=network.target sshd-keygen.service
Wants=sshd-keygen.service

[Service]
Type=notify
EnvironmentFile=-/etc/sysconfig/sshd
ExecStart=/usr/local/openssh/sbin/sshd -D $OPTIONS
ExecReload=/bin/kill -HUP $MAINPID
KillMode=process
Restart=on-failure
RestartSec=42s

[Install]
WantedBy=multi-user.target
EOF


[root@localhost openssh-10.0p1]# systemctl daemon-reload
[root@localhost openssh-10.0p1]# systemctl restart sshd
[root@localhost openssh-10.0p1]# systemctl enable sshd
[root@localhost openssh-10.0p1]#sed -i '$aCiphers aes128-cbc,aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr,3des-cbc\nMACs hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-sha1-96,hmac-md5-96\nKexAlgorithms diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,curve25519-sha256@libssh.org' /etc/ssh/sshd_config

[root@localhost openssh-10.0p1]# sed -i '/PermitRootLogin/s/^#//g' /etc/ssh/sshd_config
[root@localhost openssh-10.0p1]# sed -i 's/^PermitRootLogin.*/PermitRootLogin yes/' /etc/ssh/sshd_config
[root@localhost openssh-10.0p1]# sed -i 's/^#\?Port .*/Port 10022/' /etc/ssh/sshd_config
[root@localhost openssh-10.0p1]# chmod 400 /etc/ssh/ssh_*_key
[root@localhost openssh-10.0p1]# ssh -V