1、背景因主机安全扫描的原因Centos默认安装的是OpenSSH_7.4p1为了解决安全漏洞需要升级OpenSSH版本。升级方式如下1、通过下载OpenSSH源码编译安装2、预先在同一个操作系统环境制作RPM安装包可以通过RPM安装包执行安装程序。当有多台主机需要整改的时候通过RPM安装包通过脚本批量安装可以较大提升效率。2、安装步骤通过自行编译RPM安装包可以在不同主机上快速部署新版OpenSSH的新版本。1、备份配置[rootlocalhost ~]# cp -r -a /etc/ssh/ /etc/ssh.bak/ [rootlocalhost ~]# cp -r -a /etc/pam.d/ /etc/pam.d.bak/2、执行更新操作[rootlocalhost ~]# unzip openssh-9.3p1.zip [rootlocalhost ~]# rpm -Uvh openssh-*.rpm3、恢复sshd备份的配置[rootlocalhost ~]# echo PermitRootLogin yes /etc/ssh/sshd_config #注意检查UsePAM yes如果不是需要手动调整下 #也可以用备份的/etc/ssh.bak/sshd_config替代4、恢复pam.d/sshd备份的配置[rootlocalhost]# vi /etc/pam.d/sshd可以使用备份的/etc/pam.d.bak/sshd覆盖也可以直接把以下内容替换。pam.d/sshd是解决密码正确但是ssh登录不进去的问题将下列内容拷贝进去#%PAM-1.0 auth required pam_sepermit.so auth substack password-auth auth include postlogin # Used with polkit to reauthorize users in remote sessions -auth optional pam_reauthorize.so prepare account required pam_nologin.so account include password-auth password include password-auth # pam_selinux.so close should be the first session rule session required pam_selinux.so close session required pam_loginuid.so # pam_selinux.so open should only be followed by sessions to be executed in the user context session required pam_selinux.so open env_params session required pam_namespace.so session optional pam_keyinit.so force revoke session include password-auth session include postlogin # Used with polkit to reauthorize users in remote sessions -session optional pam_reauthorize.so prepare5、删除ssh密钥[rootlocalhost ~]# rm -rf /etc/ssh/ssh_host_* #如果发现dsa密钥缺了 [rootlocalhost ~]# ssh-keygen -t dsa -f /etc/ssh/ssh_host_dsa_key6、重启sshd服务# 查看状态 [rootlocalhost ~]# systemctl status sshd # 重启sshd [rootlocalhost ~]# systemctl restart sshd # 再查看sshd状态 [rootlocalhost ~]# systemctl status sshd附上基于centos7编译的openssh9.3的安装包使用x11-ssh-askpass让openssh不在依赖openssl1.1.1。地址https://download.csdn.net/download/enchanterzj/87746629?spm1001.2014.3001.5503
1、背景因主机安全扫描的原因Centos默认安装的是OpenSSH_7.4p1为了解决安全漏洞需要升级OpenSSH版本。升级方式如下1、通过下载OpenSSH源码编译安装2、预先在同一个操作系统环境制作RPM安装包可以通过RPM安装包执行安装程序。当有多台主机需要整改的时候通过RPM安装包通过脚本批量安装可以较大提升效率。2、安装步骤通过自行编译RPM安装包可以在不同主机上快速部署新版OpenSSH的新版本。1、备份配置[rootlocalhost ~]# cp -r -a /etc/ssh/ /etc/ssh.bak/ [rootlocalhost ~]# cp -r -a /etc/pam.d/ /etc/pam.d.bak/2、执行更新操作[rootlocalhost ~]# unzip openssh-9.3p1.zip [rootlocalhost ~]# rpm -Uvh openssh-*.rpm3、恢复sshd备份的配置[rootlocalhost ~]# echo PermitRootLogin yes /etc/ssh/sshd_config #注意检查UsePAM yes如果不是需要手动调整下 #也可以用备份的/etc/ssh.bak/sshd_config替代4、恢复pam.d/sshd备份的配置[rootlocalhost]# vi /etc/pam.d/sshd可以使用备份的/etc/pam.d.bak/sshd覆盖也可以直接把以下内容替换。pam.d/sshd是解决密码正确但是ssh登录不进去的问题将下列内容拷贝进去#%PAM-1.0 auth required pam_sepermit.so auth substack password-auth auth include postlogin # Used with polkit to reauthorize users in remote sessions -auth optional pam_reauthorize.so prepare account required pam_nologin.so account include password-auth password include password-auth # pam_selinux.so close should be the first session rule session required pam_selinux.so close session required pam_loginuid.so # pam_selinux.so open should only be followed by sessions to be executed in the user context session required pam_selinux.so open env_params session required pam_namespace.so session optional pam_keyinit.so force revoke session include password-auth session include postlogin # Used with polkit to reauthorize users in remote sessions -session optional pam_reauthorize.so prepare5、删除ssh密钥[rootlocalhost ~]# rm -rf /etc/ssh/ssh_host_* #如果发现dsa密钥缺了 [rootlocalhost ~]# ssh-keygen -t dsa -f /etc/ssh/ssh_host_dsa_key6、重启sshd服务# 查看状态 [rootlocalhost ~]# systemctl status sshd # 重启sshd [rootlocalhost ~]# systemctl restart sshd # 再查看sshd状态 [rootlocalhost ~]# systemctl status sshd附上基于centos7编译的openssh9.3的安装包使用x11-ssh-askpass让openssh不在依赖openssl1.1.1。地址https://download.csdn.net/download/enchanterzj/87746629?spm1001.2014.3001.5503
