说明：在Centos7.6的自带SSH组件早些年已经爆出漏洞，虽然项目运行在内网，但修复仍然有必要性。
前置准备
上传文件夹到root目录
1
| scp -r /root/openssh_fix root@10.128.136.138:/root/
|
1、安装telnet/telnet-server
1
2
3
4
5
6
7
8
9
10
11
12
|
cd /root/openssh_fix/telnet
yum localinstall *.rpm -y
systemctl start telnet.socket && systemctl enable telnet.socket
systemctl status telnet.socket
netstat -ntlp |grep 23
|
2、放开防火墙
1
2
3
4
5
6
7
| # 防火墙放行23端口
firewall-cmd --zone=public --add-port=23/tcp --permanent
firewall-cmd --reload
firewall-cmd --list-all
#
telnet 10.128.136.138
|
3、安装依赖
1
2
3
4
5
6
7
8
| #下载编译依赖包
# yum install -y gcc gcc-c++ glibc make automake autoconf zlib zlib-devel pcre-devel perl perl-Test-Simple --downloadonly --downloaddir=/root/telnet --downloadonly --downloaddir=/root/openssh_fix/relypackage
cd /root/openssh_fix/relypackage
yum localinstall *.rpm -y
# yum install openssl openssl-devel --downloadonly --downloaddir=/root/ssl
cd /root/openssh_fix/ssl
yum localinstall *.rpm -y
|
4、卸载openssh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
| # 停止openssh服务
systemctl stop sshd
# 备份
cp -a /etc/ssh /etc/ssh.bak
cp -a /usr/sbin/sshd /usr/sbin/sshd.bak
cp -a /usr/bin/ssh /usr/bin/ssh.bak
# 卸载
[root@localhost telnet]# rpm -qa | grep openssh
openssh-clients-7.4p1-16.el7.x86_64
openssh-7.4p1-16.el7.x86_64
openssh-server-7.4p1-16.el7.x86_64
[root@localhost telnet]# rpm -e `rpm -qa | grep openssh` --nodeps
[root@localhost telnet]# rpm -qa | grep openssh
|
5、安装openssh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
| cd /root/openssh_fix/openssh9
tar -zxvf openssh-9.0p1.tar.gz
cd openssh-9.0p1
cat INSTALL
# 配置编译
./configure --prefix=/usr/local/openssh --with-ssl-dir=/usr/local/openssl --with-zlib
# 编译
make
# 安装
make install
# 检查旧版本启动文件
ls /usr/lib/systemd/system/ssh*
rm -f /usr/lib/systemd/system/ssh*
# 拷贝启动脚本
cp contrib/redhat/sshd.init /etc/init.d/sshd
# 建立软连接
ln -s /usr/local/openssh/etc /etc/ssh
ln -s /usr/local/openssh/sbin/sshd /usr/sbin/
ln -s /usr/local/openssh/bin/* /usr/bin/
# 启动并设置开机自启动
systemctl daemon-reload
systemctl start sshd && systemctl enable sshd
# 查看状态，已经是 running 状态了
systemctl status sshd
# 确认版本
ssh -V
|
6、修改openssh配置
1
2
3
4
5
6
| vi /usr/local/openssh/etc/sshd_config
PermitRootLogin yes
# 重启
systemctl restart sshd
|
7、停止telnet服务
1
2
| systemctl stop telnet.socket
systemctl disable telnet.socket
|
7、参考
https://zhuanlan.zhihu.com/p/553027729?utm_id=0
