银河麒麟系统升级openssh至9.7p1

升级过程建议参照链接

https://blog.csdn.net/zt19820204/article/details/137877652

当前环境

开始安装

<code># 1.查看当前服务器的openssh版本

ssh -V

# 2.openssh下载地址

https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/

# 3.升级openssh，很容易导致远程连接失败，强烈建议参照如下链接，开启telnet的备用访问方式；

https://www.cnblogs.com/subsea/p/17628083.html

systemctl start telnet.socket

#查看telnet服务状态

systemctl status telnet.socket

systemctl enable telnet.socket

#要确保telnet服务开机能自启

firewall-cmd --list-all

firewall-cmd --permanent --add-port=23/tcp

firewall-cmd --reload

升级步骤

备份原有OpenSSH

#备份openssh配置

cp -rf /etc/ssh /etc/ssh.bak

cp -rf /usr/bin/openssl /usr/bin/openssl.bak

cp -rf /etc/pam.d /etc/pam.d.bak

cp -rf /usr/lib/systemd/system /system.bak

#几个命令

find / -name sshd.service

less /usr/lib/systemd/system/sshd.service

安装zlib

#1.进入zlib-1.3.1目录

cd /usr/local/soft

tar -zxvf zlib-1.2.13.tar.gz

cd /usr/local/soft/zlib-1.2.13

#2.配置

./configure --prefix=/usr/local/zlib_1.2.13

#3.编译及安装（编译时间预计几分钟，视机器而定）

make -j 4 && make test && make install

升级openssl

#注：如果已安装openssl，则先卸载再安装 kylin v10 sp2:

yum -y remove openssl

tar -zxvf openssl-3.3.0.tar.gz

cd openssl-3.3.0

mkdir /usr/local/openssl_3.3.0

ls -l /usr/local/openssl_3.3.0

mkdir build

cd build

../config --prefix=/usr/local/openssl_3.3.0

make -j 4 && make install

#清理旧版本文件

rm -rf /usr/bin/openssl

rm -rf /usr/include/openssl

rm -rf /usr/lib64/libssl.so

rm -rf /usr/lib64/libcrypto.so

rm -rf /usr/lib/libssl.so

rm -rf /usr/lib/libcrypto.so

rm -rf /usr/lib/libssl.so.3

rm -rf /usr/lib64/libssl.so.3

rm -rf /usr/lib64/libcrypto.so.3

rm -rf /usr/lib/libcrypto.so.3

#建立库文件软链接

sudo ln -s /usr/local/openssl_3.3.0/bin/openssl /usr/bin/openssl

sudo ln -s /usr/local/openssl_3.3.0/lib64/libssl.so /usr/lib/libssl.so

sudo ln -s /usr/local/openssl_3.3.0/lib64/libssl.so /usr/lib64/libssl.so

sudo ln -s /usr/local/openssl_3.3.0/lib64/libcrypto.so /usr/lib/libcrypto.so

sudo ln -s /usr/local/openssl_3.3.0/lib64/libcrypto.so /usr/lib64/libcrypto.so

sudo ln -s /usr/local/openssl_3.3.0/lib64/libssl.so.3 /usr/lib/libssl.so.3

sudo ln -s /usr/local/openssl_3.3.0/lib64/libssl.so.3 /usr/lib64/libssl.so.3

sudo ln -s /usr/local/openssl_3.3.0/lib64/libcrypto.so.3 /usr/lib64/libcrypto.so.3

sudo ln -s /usr/local/openssl_3.3.0/lib64/libcrypto.so.3 /usr/lib/libcrypto.so.3

#查看openssl版本号

openssl version

升级openssh

#老版本卸载

#1.卸载openssh7.4p1

yum remove -y openssh

#2.清理残余文件

rm -rf /etc/ssh/*

tar -xzf openssh-9.7p1.tar.gz

#1.进入openssh-9.7p1目录

cd openssh-9.7p1

#2.配置

./configure --prefix=/usr/local/ssh --sysconfdir=/etc/ssh --with-pam --with-ssl-dir=/usr/local/openssl_3.3.0 --with-zlib=/usr/local/zlib_1.2.13

#3.编译及安装

make -j 4 && make install

#4.查看目录版本

/usr/local/ssh/bin/ssh -V

#5.复制新ssh文件

cp -rf /usr/local/soft/openssh-9.7p1/contrib/redhat/sshd.init /etc/init.d/sshd

cp -rf /usr/local/soft/openssh-9.7p1/contrib/redhat/sshd.pam /etc/pam.d/sshd

cp -rf /usr/local/ssh/sbin/sshd /usr/sbin/sshd

cp -rf /usr/local/ssh/bin/ssh /usr/bin/ssh

cp -rf /usr/local/ssh/bin/ssh-keygen /usr/bin/ssh-keygen

#6.允许root登录

echo 'PermitRootLogin yes' >> /etc/ssh/sshd_config

echo 'PasswordAuthentication yes' >> /etc/ssh/sshd_config

#重启sshd服务

/etc/init.d/sshd restart

#或者

systemctl daemon-reload

#查看服务运行状态

/etc/init.d/sshd status

#添加开机启动

chkconfig --add sshd

#查看升级后ssh版本

ssh -V

关闭telnet自启动服务

#禁止服务自启动

systemctl disable telnet.socket

systemctl stop telnet.socket

systemctl status telnet.service

#关闭防火墙23端口

firewall-cmd --permanent --zone=public --remove-port=23/tcp

firewall-cmd --reload