首頁/ 汽車/ 正文

centos7離線升級openssh,漏洞修復

1。 安裝telnet

yum -y install xinetd telnet-server

配置/etc/xinetd。d/telnet

cat > /etc/xinetd。d/telnet <

service telnet

{

disable = yes

flags = REUSE

socket_type = stream

wait = no

user = root

server = /usr/sbin/in。telnetd

log_on_failure += USERID

}

EOF

配置telnet登入的終端型別

cat >> /etc/securetty <

pts/0

pts/1

pts/2

pts/3

EOF

啟動telnet

systemctl enable xinetd ——now

systemctl enable telnet。socket ——now

2。 下載安裝包

wget http://ftp。openbsd。org/pub/OpenBSD/OpenSSH/portable/openssh-8。8p1。tar。gz

wget https://www。openssl。org/source/openssl-1。1。1j。tar。gz ——no-check-certificate

wget http://www。zlib。net/zlib-1。2。12。tar。gz

3。 安裝zlib

tar -zxvf zlib-1。2。12。tar。gz

cd zlib-1。2。12

。/configure ——prefix=/usr/local/zlib

make && make install

4。 安裝openssl

tar -zxvf openssl-1。1。1j。tar。gz

cd openssl-1。1。1j

。/config ——prefix=/usr/local/ssl -d shared

make && make install

echo ‘/usr/local/ssl/lib’ >> /etc/ld。so。conf

ldconfig -v

openssl version -a

5。 安裝openssh

tar -zxvf openssh-8。8p1。tar。gz

cd openssh-8。8p1

。/configure ——prefix=/usr/local/openssh ——with-zlib=/usr/local/zlib ——with-ssl-dir=/usr/local/ssl

make && make install

配置檔案備份和修改

#sshd_config檔案修改

echo ‘PermitRootLogin yes’ >>/usr/local/openssh/etc/sshd_config

echo ‘PubkeyAuthentication yes’ >>/usr/local/openssh/etc/sshd_config

echo ‘PasswordAuthentication yes’ >>/usr/local/openssh/etc/sshd_config

# 備份原有檔案,並將新的配置複製到指定目錄

mv /etc/ssh/sshd_config /etc/ssh/sshd_config。bak

cp /usr/local/openssh/etc/sshd_config /etc/ssh/sshd_config

mv /usr/sbin/sshd /usr/sbin/sshd。bak

cp /usr/local/openssh/sbin/sshd /usr/sbin/sshd

mv /usr/bin/ssh /usr/bin/ssh。bak

cp /usr/local/openssh/bin/ssh /usr/bin/ssh

mv /usr/bin/ssh-keygen /usr/bin/ssh-keygen。bak

cp /usr/local/openssh/bin/ssh-keygen /usr/bin/ssh-keygen

mv /etc/ssh/ssh_host_ecdsa_key。pub /etc/ssh/ssh_host_ecdsa_key。pub。bak

cp /usr/local/openssh/etc/ssh_host_ecdsa_key。pub /etc/ssh/ssh_host_ecdsa_key。pub

# 修改systemd引數(去掉Type或改為Type=simple)

vim /usr/lib/systemd/system/sshd。service

[Unit]

Description=OpenSSH server daemon

Documentation=man:sshd(8) man:sshd_config(5)

After=network。target sshd-keygen。service

Wants=sshd-keygen。service

[Service]

#Type=notify

Type=simple

EnvironmentFile=/etc/sysconfig/sshd

ExecStart=/usr/sbin/sshd -D $OPTIONS

ExecReload=/bin/kill -HUP $MAINPID

KillMode=process

Restart=on-failure

RestartSec=42s

[Install]

WantedBy=multi-user。target

重啟sshd服務

systemctl daemon-reload

systemctl restart sshd

systemctl status sshd

# 驗證是否升級成功

ssh -V

centos7離線升級openssh,漏洞修復

相關文章

頂部