升級OpenSSL和OpenSSH
目前版本OpenSSH_7.4p1, OpenSSL 1.0.2k-fips 26 Jan 2017
升級到OpenSSH_9.8p1, OpenSSL 1.1.1u 30 May 2023
服務器CentOS Linux release 7.6.1810 (Core)
一、升級OpenSSL到1.1.1u
-
下載并編譯 OpenSSL（推薦目錄
/usr/local/openssl）wget https://www.openssl.org/source/openssl-1.1.1u.tar.gz tar zxvf openssl-1.1.1u.tar.gz cd openssl-1.1.1u./config --prefix=/usr/local/openssl --openssldir=/usr/local/openssl shared zlib make -j$(nproc) make install -
設置 OpenSSL 環境變量
echo "/usr/local/openssl/lib" > /etc/ld.so.conf.d/openssl.conf ldconfigexport PATH=/usr/local/openssl/bin:$PATH export LD_LIBRARY_PATH=/usr/local/openssl/libvim /etc/profile追加下邊兩行，避免重啟后失效。export PATH=/usr/local/openssl/bin:$PATH export LD_LIBRARY_PATH=/usr/local/openssl/libsource /etc/profile -
驗證 OpenSSL 是否生效
openssl versionOpenSSL 1.1.1u 30 May 2023
二、升級OpenSSH到9.8p1
-
安裝依賴
yum groupinstall -y "Development Tools" yum install -y wget pam-devel zlib-devel openssl-devel -
下載并準備 OpenSSH 9.8p1
wget https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-9.8p1.tar.gz tar -zxvf openssh-9.8p1.tar.gz cd openssh-9.8p1 -
備份舊 SSHD
cp /usr/sbin/sshd /usr/sbin/sshd.bak.$(date +%F-%H-%M-%S) cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak.$(date +%F-%H-%M-%S) -
配置并編譯安裝 OpenSSH 9.8p1（指定新版 OpenSSL 路徑）
./configure --prefix=/usr --sysconfdir=/etc/ssh --with-md5-passwords --with-pam --with-ssl-dir=/usr/local/openssl make -j$(nproc) make install -
設置 sshd 服務（如無 systemd 單元文件）
if [ ! -f /usr/lib/systemd/system/sshd.service ]; thencp contrib/redhat/sshd.init /etc/init.d/sshdchmod +x /etc/init.d/sshdsystemctl daemon-reexecsystemctl daemon-reloadsystemctl enable sshd fi -
重啟 SSH 服務并驗證版本
安全提示（強烈建議）
在你執行
systemctl restart sshd之前：- 開兩個 SSH 會話，防止斷連；
- 設置自動回滾任務（如果失敗自動恢復舊版本）：
echo "cp /usr/sbin/sshd.bak* /usr/sbin/sshd && systemctl restart sshd" | at now + 5 minutessystemctl restart sshd /usr/sbin/sshd -VOpenSSH_10.0p1, OpenSSL 1.1.1u ...
三、解決yum install -y wget pam-devel zlib-devel openssl-devel下載失敗問題
在可以正常執行 yum install -y wget pam-devel zlib-devel openssl-devel的服務器執行下列命令
- 安裝
yum-utils（包含yumdownloader）
yum install -y yum-utils
-
創建存放 RPM 的目錄并下載所有依賴包
mkdir -p /tmp/rpms cd /tmp/rpms yumdownloader --resolve wget pam-devel zlib-devel openssl-devel -
檢查下載的 RPM 文件
ls -l /tmp/rpms/*.rpm-rw-r--r-- 1 root root 1582172 Jun 17 16:17 openssl-devel-1.0.2k-26.el7_9.i686.rpm -rw-r--r-- 1 root root 1582400 Jun 17 16:17 openssl-devel-1.0.2k-26.el7_9.x86_64.rpm -rw-r--r-- 1 root root 1021796 Jun 17 16:17 openssl-libs-1.0.2k-26.el7_9.i686.rpm -rw-r--r-- 1 root root 736976 Jun 17 16:17 pam-1.1.8-23.el7.i686.rpm -rw-r--r-- 1 root root 189152 Jun 17 16:17 pam-devel-1.1.8-23.el7.i686.rpm -rw-r--r-- 1 root root 189124 Jun 17 16:17 pam-devel-1.1.8-23.el7.x86_64.rpm -rw-r--r-- 1 root root 430428 Jun 17 16:17 pcre-8.32-17.el7.i686.rpm -rw-r--r-- 1 root root 560272 Jun 17 16:17 wget-1.14-18.el7_6.1.x86_64.rpm -rw-r--r-- 1 root root 93224 Jun 17 16:17 zlib-1.2.7-21.el7_9.i686.rpm -rw-r--r-- 1 root root 51524 Jun 17 16:17 zlib-devel-1.2.7-21.el7_9.i686.rpm -rw-r--r-- 1 root root 51488 Jun 17 16:17 zlib-devel-1.2.7-21.el7_9.x86_64.rpm ...... -
將 RPM 包復制到目標服務器
scp -r /tmp/rpms root@目標服務器IP:/tmp/ -
在目標服務器上手動安裝
cd /tmp/rpms rpm -ivh *.rpm --nodeps --force
四、OpenSSH make install 報如下錯誤
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: UNPROTECTED PRIVATE KEY FILE! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0640 for '/etc/ssh/ssh_host_rsa_key' are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.
Unable to load host key "/etc/ssh/ssh_host_rsa_key": bad permissions
Unable to load host key: /etc/ssh/ssh_host_rsa_key
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: UNPROTECTED PRIVATE KEY FILE! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0640 for '/etc/ssh/ssh_host_ecdsa_key' are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.
Unable to load host key "/etc/ssh/ssh_host_ecdsa_key": bad permissions
Unable to load host key: /etc/ssh/ssh_host_ecdsa_key
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: UNPROTECTED PRIVATE KEY FILE! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0640 for '/etc/ssh/ssh_host_ed25519_key' are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.
Unable to load host key "/etc/ssh/ssh_host_ed25519_key": bad permissions
Unable to load host key: /etc/ssh/ssh_host_ed25519_key
sshd: no hostkeys available -- exiting.
make: [Makefile:396: check-config] Error 1 (ignored)
解決方案：修復私鑰權限
chmod 600 /etc/ssh/ssh_host_*_key
