服务器安装openssh9.9p1

11.81.2.19
更新 SSL

• 备份原有设置
  

1.1 查看 openssl 版本
   openssl version

1. OpenSSL 1.0.2k-fips  26 Jan 2017

复制代码

1.2 查看 openssl 路径
   whereis openssl

1. openssl: /usr/bin/openssl /usr/lib64/openssl /usr/include/openssl /usr/share/man/man1/openssl.1ssl.gz

复制代码

1.3 备份 openssl 文件
   cp /usr/bin/openssl /usr/bin/openssl_old
cp -r /usr/include/openssl /usr/include/openssl_old
  

• 下载新 openssl 文件
  

下载地点：https://openssl-library.org/source/index.html
选择的版本是 openssl-3.0.15.tar.gz，恒久支持版本，支持到 2026年 7月
上传到服务器： /data/soft

• 升级 openssl
  

3.1 解压并进入
   tar -zxvf openssl-3.0.15.tar.gz
cd openssl-3.0.15.tar.gz
  3.2 设置 openssl 安装目录
   ./config --prefix=/usr/local/openssl

1. Can't locate IPC/Cmd.pm in @INC (@INC contains: /data/soft/openssl-3.0.15/util/perl /usr/local/lib64/perl5 /usr/local/share/perl5 /usr/lib64/perl5/vendor_perl /usr/share/perl5/vendor_perl /usr/lib64/perl5 /usr/share/perl5 . /data/soft/openssl-3.0.15/external/perl/Text-Template-1.56/lib) at /data/soft/openssl-3.0.15/util/perl/OpenSSL/config.pm line 19.
2. BEGIN failed--compilation aborted at /data/soft/openssl-3.0.15/util/perl/OpenSSL/config.pm line 19.
3. Compilation failed in require at /data/soft/openssl-3.0.15/Configure line 23.
4. BEGIN failed--compilation aborted at /data/soft/openssl-3.0.15/Configure line 23.

复制代码

报错解决方案：
方案一：利用 perl-CPAN 安装依靠【不保举】
1）安装perl-CPAN
   yum install -y perl-CPAN
  2）进入CPAN的shell模式
注意：首次进入需要设置shell，按照提示操作即可，我这里是一路回车，安装需要肯定时间
   perl -MCPAN -e shell
【日志见附1】
  3）在shell中安装缺少的模块
cpan[1]> install IPC/Cmd.pm
【日志见附2，未完成，换yum直接安装方式】
方案二：利用 yum 安装依靠
或者yum下令安装perl-IPC/Cmd 【更快】：
yum -y install zlib* perl pam* gcc* perl-IPC-Cmd
【日志见附3】
安装成功后，再次编译OpenSSL就成功啦
   ./config --prefix=/usr/local/openssl

1. Configuring OpenSSL version 3.0.15 for target linux-x86_64
2. Using os-specific seed configuration
3. Created configdata.pm
4. Running configdata.pm
5. Created Makefile.in
6. Created Makefile
7. Created include/openssl/configuration.h
9. **********************************************************************
10. ***                                                                ***
11. ***   OpenSSL has been successfully configured                     ***
12. ***                                                                ***
13. ***   If you encounter a problem while building, please open an    ***
14. ***   issue on GitHub <https://github.com/openssl/openssl/issues>  ***
15. ***   and include the output from the following command:           ***
16. ***                                                                ***
17. ***       perl configdata.pm --dump                                ***
18. ***                                                                ***
19. ***   (If you are new to OpenSSL, you might want to consult the    ***
20. ***   'Troubleshooting' section in the INSTALL.md file first)      ***
21. ***                                                                ***
22. **********************************************************************

复制代码

3.3 编译&&安装
   make && make install
需要肯定的时间
  3.4 创建软连接
说明：创建的软链接和之前没升级通过whereis openssl保持一致即可。
   mv /usr/bin/openssl /usr/bin/openssl_bak
ln -s /usr/local/openssl/bin/openssl /usr/bin/openssl
mv /usr/include/openssl /usr/include/openssl_bak
ln -s /usr/local/openssl/include/openssl /usr/include/openssl
  3.5 添加动态链接库数据
   cat /etc/ld.so.conf

1. include ld.so.conf.d/*.conf

复制代码

  echo “/usr/local/openssl/lib64/” >> /etc/ld.so.conf
cat /etc/ld.so.conf

1. include ld.so.conf.d/*.conf
3. /usr/local/openssl/lib64/

复制代码

3.6 更新动态链接库
   ldconfig -v
  4 验证 openssl 版本
说明：-a参数能表现更完整的信息
   openssl version -a
  更新完成
升级 openSSH

• 查抄版本
  

   ssh -V
OpenSSH_8.0p1, OpenSSL 1.0.2k-fips 26 Jan 2017
  

• 下载新版本
  下载地点：https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/
  选择版本 openssh-9.9p1.tar.gz
  上传到服务器： /data/soft
  
• 解压并进入
  

   tar -zxvf openssh-9.9p1.tar.gz
cd openssh-9.9p1
  

• 安装依靠
  

   yum -y install gcc pam-devel zlib-devel openssl-devel net-tools

1. Package gcc-4.8.5-39.el7.ns7.01.x86_64 already installed and latest version
2. Package pam-devel-1.1.8-22.el7.x86_64 already installed and latest version
3. Package zlib-devel-1.2.7-18.el7.x86_64 already installed and latest version
4. Package 1:openssl-devel-1.0.2k-21.el7_9.ns7.01.x86_64 already installed and latest version
5. Package net-tools-2.0-0.24.20131004git.el7.ns7.01.x86_64 already installed and latest version
6. Nothing to do

复制代码

• 备份原始文件
  

   cp -r -a /etc/ssh/ /etc/ssh.bak
    cp -r -a /etc/pam.d/ /etc/pam.d.bak
    cp -r -a /usr/sbin/sshd /usr/sbin/sshd.bak
    cp -r -a /usr/bin/ssh /usr/bin/ssh.bak
    cp -r -a /usr/bin/ssh-keygen /usr/bin/ssh-keygen.bak
  

• 卸载原体系的openssh包
  

   rpm -e --nodeps rpm -qa | grep openssh
  

• 编译安装openssh【注意，此步调之后不能断开连接，直到设置完成才气建立新连接】
  

注意修改 ssl 目录为先前设置的目录
   ./configure --prefix=/usr/local/openssh-9.9p1 --sysconfdir=/etc/ssh --with-pam --with-ssl-dir=/usr/local/openssl --with-md5-passwords --with-zlib
    make && make install

1. cc -std=gnu11 -o ssh-sk-helper ssh-sk-helper.o ssh-sk.o sk-usbhid.o -L. -Lopenbsd-compat/ -L/usr/local/openssl/lib64  -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -fstack-protector-strong -pie  -lssh -lopenbsd-compat -lssh -lopenbsd-compat -ldl -lutil  -lresolv  -lcrypto  -lz
2. /usr/bin/mkdir -p /usr/local/openssh-9.9p1/bin
3. /usr/bin/mkdir -p /usr/local/openssh-9.9p1/sbin
4. /usr/bin/mkdir -p /usr/local/openssh-9.9p1/share/man/man1
5. /usr/bin/mkdir -p /usr/local/openssh-9.9p1/share/man/man5
6. /usr/bin/mkdir -p /usr/local/openssh-9.9p1/share/man/man8
7. /usr/bin/mkdir -p /usr/local/openssh-9.9p1/libexec
8. /usr/bin/mkdir -p -m 0755 /var/empty
9. /usr/bin/install -c -m 0755 -s ssh /usr/local/openssh-9.9p1/bin/ssh
10. /usr/bin/install -c -m 0755 -s scp /usr/local/openssh-9.9p1/bin/scp
11. /usr/bin/install -c -m 0755 -s ssh-add /usr/local/openssh-9.9p1/bin/ssh-add
12. /usr/bin/install -c -m 0755 -s ssh-agent /usr/local/openssh-9.9p1/bin/ssh-agent
13. /usr/bin/install -c -m 0755 -s ssh-keygen /usr/local/openssh-9.9p1/bin/ssh-keygen
14. /usr/bin/install -c -m 0755 -s ssh-keyscan /usr/local/openssh-9.9p1/bin/ssh-keyscan
15. /usr/bin/install -c -m 0755 -s sshd /usr/local/openssh-9.9p1/sbin/sshd
16. /usr/bin/install -c -m 0755 -s sshd-session /usr/local/openssh-9.9p1/libexec/sshd-session
17. /usr/bin/install -c -m 4711 -s ssh-keysign /usr/local/openssh-9.9p1/libexec/ssh-keysign
18. /usr/bin/install -c -m 0755 -s ssh-pkcs11-helper /usr/local/openssh-9.9p1/libexec/ssh-pkcs11-helper
19. /usr/bin/install -c -m 0755 -s ssh-sk-helper /usr/local/openssh-9.9p1/libexec/ssh-sk-helper
20. /usr/bin/install -c -m 0755 -s sftp /usr/local/openssh-9.9p1/bin/sftp
21. /usr/bin/install -c -m 0755 -s sftp-server /usr/local/openssh-9.9p1/libexec/sftp-server
22. /usr/bin/install -c -m 644 ssh.1.out /usr/local/openssh-9.9p1/share/man/man1/ssh.1
23. /usr/bin/install -c -m 644 scp.1.out /usr/local/openssh-9.9p1/share/man/man1/scp.1
24. /usr/bin/install -c -m 644 ssh-add.1.out /usr/local/openssh-9.9p1/share/man/man1/ssh-add.1
25. /usr/bin/install -c -m 644 ssh-agent.1.out /usr/local/openssh-9.9p1/share/man/man1/ssh-agent.1
26. /usr/bin/install -c -m 644 ssh-keygen.1.out /usr/local/openssh-9.9p1/share/man/man1/ssh-keygen.1
27. /usr/bin/install -c -m 644 ssh-keyscan.1.out /usr/local/openssh-9.9p1/share/man/man1/ssh-keyscan.1
28. /usr/bin/install -c -m 644 moduli.5.out /usr/local/openssh-9.9p1/share/man/man5/moduli.5
29. /usr/bin/install -c -m 644 sshd_config.5.out /usr/local/openssh-9.9p1/share/man/man5/sshd_config.5
30. /usr/bin/install -c -m 644 ssh_config.5.out /usr/local/openssh-9.9p1/share/man/man5/ssh_config.5
31. /usr/bin/install -c -m 644 sshd.8.out /usr/local/openssh-9.9p1/share/man/man8/sshd.8
32. /usr/bin/install -c -m 644 sftp.1.out /usr/local/openssh-9.9p1/share/man/man1/sftp.1
33. /usr/bin/install -c -m 644 sftp-server.8.out /usr/local/openssh-9.9p1/share/man/man8/sftp-server.8
34. /usr/bin/install -c -m 644 ssh-keysign.8.out /usr/local/openssh-9.9p1/share/man/man8/ssh-keysign.8
35. /usr/bin/install -c -m 644 ssh-pkcs11-helper.8.out /usr/local/openssh-9.9p1/share/man/man8/ssh-pkcs11-helper.8
36. /usr/bin/install -c -m 644 ssh-sk-helper.8.out /usr/local/openssh-9.9p1/share/man/man8/ssh-sk-helper.8
37. /usr/bin/mkdir -p /etc/ssh
38. /etc/ssh/ssh_config already exists, install will not overwrite
39. /etc/ssh/sshd_config already exists, install will not overwrite
40. /etc/ssh/moduli already exists, install will not overwrite
41. /usr/local/openssh-9.9p1/sbin/sshd -t -f /etc/ssh/sshd_config
42. /etc/ssh/sshd_config line 79: Unsupported option GSSAPIAuthentication
43. /etc/ssh/sshd_config line 80: Unsupported option GSSAPICleanupCredentials
44. @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
45. @         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
46. @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
47. Permissions 0640 for '/etc/ssh/ssh_host_rsa_key' are too open.
48. It is required that your private key files are NOT accessible by others.
49. This private key will be ignored.
50. Unable to load host key "/etc/ssh/ssh_host_rsa_key": bad permissions
51. Unable to load host key: /etc/ssh/ssh_host_rsa_key
52. @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
53. @         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
54. @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
55. Permissions 0640 for '/etc/ssh/ssh_host_ecdsa_key' are too open.
56. It is required that your private key files are NOT accessible by others.
57. This private key will be ignored.
58. Unable to load host key "/etc/ssh/ssh_host_ecdsa_key": bad permissions
59. Unable to load host key: /etc/ssh/ssh_host_ecdsa_key
60. @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
61. @         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
62. @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
63. Permissions 0640 for '/etc/ssh/ssh_host_key' are too open.
64. It is required that your private key files are NOT accessible by others.
65. This private key will be ignored.
66. Unable to load host key "/etc/ssh/ssh_host_key": bad permissions
67. Unable to load host key: /etc/ssh/ssh_host_key
68. sshd: no hostkeys available -- exiting.
69. make: [check-config] Error 1 (ignored)
70. make: warning:  Clock skew detected.  Your build may be incomplete.

复制代码

• 复制新设置到原来的目录
  

   cp /usr/local/openssh-9.9p1/sbin/sshd /usr/sbin/sshd
会报 cp: cannot create regular file ‘/usr/sbin/sshd’: Text file busy
可以先 > mv /usr/sbin/sshd /usr/sbin/sshd.bak 然后再实行
    cp /usr/local/openssh-9.9p1/bin/ssh /usr/bin/ssh
    cp /usr/local/openssh-9.9p1/bin/ssh-keygen /usr/bin/ssh-keygen
    cp -p contrib/redhat/sshd.init /etc/init.d/sshd
  我装完这个已经在里面了，假如没有则复制一下
   cp /usr/local/openssh-9.9p1/etc/sshd_config /etc/ssh/sshd_config
  

• 修改设置(重要)
  

   chmod +x /etc/init.d/sshd
    vim /etc/ssh/sshd_config
  将设置文件中这几个改为yes：

• PermitRootLogin yes
  
• PubkeyAuthentication yes
  
• PasswordAuthentication yes
  

说明：
PermitRootLogin yes：答应root用户通过SSH登录到体系（最最最重要这个肯定要设置，否则你重启sshd服务之后就不能远程连接了）
PubkeyAuthentication yes：启用公钥身份验证
PasswordAuthentication yes：启用暗码身份验证

• 开机自启
  

   systemctl enable sshd
  

• 重启 sshd
  

   systemctl restart sshd
  报错

1. Job for sshd.service failed because the control process exited with error code. See "systemctl status sshd.service" and "journalctl -xe" for details.
3. 查看错误
4. systemctl status sshd.service
5. ● sshd.service - OpenSSH server daemon
6.    Loaded: loaded (/usr/lib/systemd/system/sshd.service; enabled; vendor preset: enabled)
7.    Active: activating (auto-restart) (Result: exit-code) since Fri 2024-09-20 03:49:26 CST; 16s ago
8.      Docs: man:sshd(8)
9.            man:sshd_config(5)
10.   Process: 83036 ExecStart=/usr/sbin/sshd -D $OPTIONS (code=exited, status=1/FAILURE)
11. Main PID: 83036 (code=exited, status=1/FAILURE)
13. Sep 20 03:49:26  sshd[83036]: @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
14. Sep 20 03:49:26  sshd[83036]: Permissions 0640 for '/etc/ssh/ssh_host_key' are too open.
15. Sep 20 03:49:26  sshd[83036]: It is required that your private key files are NOT accessible by others.
16. Sep 20 03:49:26  sshd[83036]: This private key will be ignored.
17. Sep 20 03:49:26  sshd[83036]: Unable to load host key "/etc/ssh/ssh_host_key": bad permissions
18. Sep 20 03:49:26  sshd[83036]: Unable to load host key: /etc/ssh/ssh_host_key
19. Sep 20 03:49:26  sshd[83036]: sshd: no hostkeys available -- exiting.
20. Sep 20 03:49:26  systemd[1]: Failed to start OpenSSH server daemon.
21. Sep 20 03:49:26  systemd[1]: Unit sshd.service entered failed state.
22. Sep 20 03:49:26  systemd[1]: sshd.service failed.

复制代码

解决方案
修改目录权限
   chmod -R 600 /etc/ssh
  再次重启服务
   systemctl restart sshd
  

• 查抄版本
  

   sshd -V
  另建立一个新会话，查看连接是否正常。

免责声明：如果侵犯了您的权益，请联系站长，我们会及时删除侵权内容，谢谢合作！更多信息从访问主页：qidao123.com:ToB企服之家，中国第一个企服评测及商务社交产业平台。