记一次Centos7.5升级SpenSSH8.0p1,p1


前因:服务器被扫描到有SpenSSH漏洞,所以需要升级版本修复漏洞。

服务器版本:

# cat /etc/redhat-release
CentOS Linux release 7.5.1804 (Core)

升级前ssh版本:

# ssh -V
OpenSSH_7.4p1, OpenSSL 1.0.2k-fips  26 Jan 2017

升级后ssh版本:

# ssh -V
OpenSSH_8.0p1, OpenSSL 1.0.2k-fips  26 Jan 2017

在网上查找升级方法,参照此文章升级成功:https://www.jianshu.com/p/220f7fd908b0

为避免链接失效,现将我的操作记录如下:

为防止升级失败无法远程连接,安装telnet:

# yum install -y telnet-server
# yum install -y xinetd 
# systemctl start telnet.socket
# systemctl start  xinetd

允许root登录:

# echo 'pts/0' >>/etc/securetty
# echo 'pts/1' >>/etc/securetty
# systemctl restart telnet.socket

开启telnet和xinetd开机自动启动,避免reboot后连不上Telnet:

# systemctl enable xinetd.service
# systemctl enable telnet.socket

测试一下telnet连接,然后就可以先放着了,这只是以防万一,接下来还是正常使用ssh连接操作

下载最新版本的包(openssh-8.0p1.tar.gz)并上传到服务器上

备份文件:

# cp -r /etc/ssh /etc/ssh.old

卸载旧的ssh:

# rpm -qa|grep openssh
openssh-server-7.4p1-11.el7.x86_64
openssh-7.4p1-11.el7.x86_64
openssh-clients-7.4p1-11.el7.x86_64
# rpm -e --nodeps openssh-server-7.4p1-11.el7.x86_64
# rpm -e --nodeps openssh-7.4p1-11.el7.x86_64
# rpm -e --nodeps openssh-clients-7.4p1-11.el7.x86_64
# rpm -qa|grep openssh

安装:

# install -v -m700 -d /var/lib/sshd
# chown -v root:sys /var/lib/sshd
# groupadd -g 50 sshd
# useradd -c 'sshd PrivSep' -d /var/lib/sshd -g sshd -s /bin/false -u 50 sshd
# tar -zxvf openssh-8.0p1.tar.gz
# cd openssh-8.0p1
# ./configure --prefix=/usr --sysconfdir=/etc/ssh --with-md5-passwords --with-privsep-path=/var/lib/sshd
# make
# chmod 600 /etc/ssh/ssh_host_rsa_key
# chmod 600 /etc/ssh/ssh_host_ecdsa_key
# chmod 600 /etc/ssh/ssh_host_ed25519_key
# make install
# install -v -m755 contrib/ssh-copy-id /usr/bin
# install -v -m644 contrib/ssh-copy-id.1 /usr/share/man/man1
# install -v -m755 -d /usr/share/doc/openssh-8.0p1
# install -v -m644 INSTALL LICENCE OVERVIEW README* /usr/share/doc/openssh-8.0p1

设置允许root登录:

# echo "PermitRootLogin yes" >> /etc/ssh/sshd_config

设置开机自启动:

# cp -p contrib/redhat/sshd.init /etc/init.d/sshd
# chmod +x /etc/init.d/sshd
# chkconfig --add sshd
# chkconfig sshd on
# chkconfig --list sshd
# systemctl restart sshd

升级完成,查看版本:

# ssh -V
OpenSSH_8.0p1, OpenSSL 1.0.2k-fips  26 Jan 2017

PS1:升级完成后别忘了恢复以前的telnet设置或关闭telnet.

PS2:如果中间有问题升级失败,且之前是rpm包安装的,可以直接以下命令进行回滚:

# yum -y install openssh-clients
# yum -y install openssh-server
# yum -y install openssh

相关内容