1、ansible宿主機準備好環境，并寫好hosts文件
[root@oxidized ansible]# cat hosts
[all]
10.10.200.33
10.10.200.34
10.10.200.35跑playbook之前記得提前發送秘鑰
ssh-copy-id 10.10.200.33/34/35
2、下載好安裝包，然后編寫yml
[root@oxidized ansible]# cat loudongBD.yml
- name: 漏洞修復hosts: alltasks:- name: copy opensslcopy:src: /openssh_upgrade_9.7/openssl-3.1.5.tar.gzdest: /usr/local/src/openssl-3.1.5.tar.gz- name: copy opensshcopy:src: /openssh_upgrade_9.7/openssh-9.7p1.tar.gzdest: /usr/local/src/openssh-9.7p1.tar.gz- name: copy upgrade腳本copy:src: /etc/ansible/loudongBD_ssh.shdest: /usr/local/src/loudongBD_ssh.sh- name:copy:src: /etc/ansible/loudongBD_ssl.shdest: /usr/local/src/loudongBD_ssl.sh- name: openssl升級shell: sh /usr/local/src/loudongBD_ssl.sh- name: openssh升級shell: sh /usr/local/src/loudongBD_ssh.sh
3、兩個shell腳本內容如下
openssl升級腳本：
[root@oxidized ansible]# cat loudongBD_ssl.sh
#!/bin/bash
cd /etc/yum.repos.d/ && mkdir bak
mv *.repo bak/
cat >>/etc/yum.repos.d/local.repo <<EOF
[base]
name=Nexus
baseurl=http://10.10.200.20:8081/repository/yumHosted/
enabled=1
gpgcheck=0
EOFyum makecache fastyum install gcc gcc-c++ openssl-devel libstdc++* libcap* pam-devel zlib-devel perl perl-IPC-Cmd -ycd /usr/local/src/mv /usr/lib64/openssl /usr/lib64/openssl.oldyum -y remove openssltar xf openssl-3.1.5.tar.gzcd /usr/local/src/openssl-3.1.5./config --prefix=/usrmake && make install
openssh升級腳本：
[root@oxidized ansible]# cat loudongBD_ssh.sh#!/bin/bashcd /usr/local/src/tar xf openssh-9.7p1.tar.gzmkdir /etc/ssh.bakmv /etc/ssh/ /etc/ssh.bakcd /usr/local/src/openssh-9.7p1./configure --prefix=/usr --sysconfdir=/etc/ssh --with-ssl-dir=/usr/local/openssl --with-md5-passwordsmake && make installcp /usr/local/src/openssh-9.7p1/contrib/redhat/sshd.init /etc/init.d/sshdmv /usr/lib/systemd/system/sshd.service /usr/lib/systemd/system/sshd.service.bakcp /etc/ssh/sshd_config{,.bak}sed -i 's/^PermitRootLogin/#&/' /etc/ssh/sshd_configsed -i '32i PermitRootLogin yes' /etc/ssh/sshd_configchkconfig --add sshdsystemctl daemon-reloadsystemctl restart sshd
4、環境準備好后，直接運行劇本即可
[root@oxidized ansible]# ansible-playbook loudongBD.yml
5、升級后檢查ssh版本
[root@oxidized ansible]# ssh -V
OpenSSH_9.7p1, OpenSSL 3.1.5 30 Jan 2024
