1、查看当前当前环境信息
1.1、查看openssh当前版本
linux-oz6w:~ # openssl version OpenSSL 1.0.2j-fips 26 Sep 2016 linux-oz6w:~ # ssh -V OpenSSH_7.2p2, OpenSSL 1.0.2j-fips 26 Sep 2016
1.2、查看当前linux发行版
linux-oz6w:~ # cat /etc/os-release NAME="SLES" VERSION="12-SP3" VERSION_ID="12.3" PRETTY_NAME="SUSE Linux Enterprise Server 12 SP3" ID="sles" ANSI_COLOR="0;32" CPE_NAME="cpe:/o:suse:sles:12:sp3"
2、部署telnet-server
2.1、下载telnet-server
linux-oz6w:~ # zypper in telnet-server xinetd
2.2、配置telnet-server
linux-oz6w:~ # ll /etc/xinetd.d/telnet -rw-r--r-- 1 root root 408 Sep 21 2014 /etc/xinetd.d/telnet linux-oz6w:~ # vim /etc/xinetd.d/telnet # default: off # description: Telnet is the old login server which is INSECURE and should \ # therefore not be used. Use secure shell (openssh). # If you need telnetd not to "keep-alives" (e.g. if it runs over a ISDN \ # uplink), add "-n". See 'man telnetd' for more details. service telnet { socket_type = stream protocol = tcp wait = no user = root server = /usr/sbin/in.telnetd } "去掉telnet文件里面的disable=yes，这样telnet就会随着xinetd的启动而启动"
2.3、配置telnet登录的终端类型
linux-oz6w:~ # cat >> /etc/securetty <<EOF pts/0 pts/1 pts/2 pts/3 EOF
2.4、启动telnet服务
linux-oz6w:~ # systemctl enable xinetd.service linux-oz6w:~ # systemctl restart xinetd.service linux-oz6w:~ # ss -nltp | grep 23 LISTEN 0 64 *:23 *:* users:(("xinetd",pid=2597,fd=5))
2.5、切换链接终端的方式
- 后面的操作都是在telnet链接的方式下进行，避免ssh中断导致升级失败
- 以telnet方式登录的时候，注意选择协议和端口，协议为telnet，端口为23
3、升级openssh
3.1、下载依赖包和openssh源码包
linux-oz6w:~ # zypper in gcc gcc-c++ glibc make autoconf openssl openssl-devel linux-oz6w:~ # wget https://www.openssl.org/source/openssl-1.1.1i.tar.gz linux-oz6w:~ # wget http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-8.4p1.tar.gz linux-oz6w:~ # tar xf openssl-1.1.1i.tar.gz linux-oz6w:~ # tar xf openssh-8.4p1.tar.gz
3.2、编译安装openssl
"备份老版本的openssl" linux-oz6w:~ # mv /usr/bin/openssl{,-1.0.2j-fips} linux-oz6w:~ # mv /usr/include/openssl{,-1.0.2j-fips}
linux-oz6w:~ # cd openssl-1.1.1i/ linux-oz6w:~/openssl-1.1.1i # ./config shared && make && make install
"编译完成后，建立软连接，更新openssl版本" linux-oz6w:~ # ln -s /usr/local/bin/openssl /usr/bin/openssl linux-oz6w:~ # ln -s /usr/local/include/openssl/ /usr/include/openssl linux-oz6w:~ # echo "/usr/local/lib64" >> /etc/ld.so.conf linux-oz6w:~ # /sbin/ldconfig linux-oz6w:~ # openssl version OpenSSL 1.1.1i 8 Dec 2020
3.3、编译安装openssh
"备份老版本ssh" linux-oz6w:~ # mv /etc/ssh{,-7.2p2}
linux-oz6w:~ # cd openssh-8.4p1/ linux-oz6w:~/openssh-8.4p1 # ./configure --prefix=/usr/local/openssh \ --sysconfdir=/etc/ssh \ --with-openssl-includes=/usr/local/include \ --with-ssl-dir=/usr/local/lib64 \ --with-zlib \ --with-md5-passwords && \ make && \ make install
3.3.1、配置sshd_config
linux-oz6w:~ # sed -i 's/^#UseDNS.*/UseDNS no/' /etc/ssh/sshd_config linux-oz6w:~ # sed -i 's/^#PermitRootLogin.*/PermitRootLogin yes/' /etc/ssh/sshd_config linux-oz6w:~ # sed -i 's/^#PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config linux-oz6w:~ # sed -i 's/^#PasswordAuthentication.*/PasswordAuthentication yes/' /etc/ssh/sshd_config
"如果是图形化界面，需要x11，需要修改如下配置" linux-oz6w:~ # sed -i 's/^#X11Forwarding.*/X11Forwarding yes/' /etc/ssh/sshd_config linux-oz6w:~ # sed -i 's/^#X11UseLocalhost.*/X11UseLocalhost no/' /etc/ssh/sshd_config linux-oz6w:~ # sed -i 's%^#XAuthLocation.*%XAuthLocation /usr/bin/xauth%' /etc/ssh/sshd_config
"建立软连接，更新ssh版本" linux-oz6w:~ # mv /usr/sbin/sshd{,-7.2p2} linux-oz6w:~ # mv /usr/bin/ssh{,-7.2p2} linux-oz6w:~ # mv /usr/bin/ssh-keygen{,-7.2p2} linux-oz6w:~ # ln -s /usr/local/openssh/bin/ssh /usr/bin/ssh linux-oz6w:~ # ln -s /usr/local/openssh/bin/ssh-keygen /usr/bin/ssh-keygen linux-oz6w:~ # ln -s /usr/local/openssh/sbin/sshd /usr/sbin/sshd
3.3.2、重新启动ssh服务
linux-oz6w:~ # mv /usr/lib/systemd/system/sshd.service{,-7.2p2} linux-oz6w:~ # cp -a openssh-8.4p1/contrib/suse/rc.sshd /etc/init.d/sshd linux-oz6w:~ # chmod +x /etc/init.d/sshd linux-oz6w:~ # chkconfig --add sshd linux-oz6w:~ # systemctl enable sshd --now
3.3.3、验证ssh
linux-oz6w:~ # ssh root@192.168.145.133 linux-oz6w:~ # ssh -V OpenSSH_8.4p1, OpenSSL 1.1.1i 8 Dec 2020 linux-oz6w:~ # systemctl disable xinetd.service --now
