前言： 漏洞CVE-2020-15778，OpenSSH的8.3p1及之前版本中的scp允许在scp.c远程功能中注入命令，攻击者可利用该漏洞执行任意命令。升级为最新版解决！
注意：
以防升级失败，连不上服务器，建议先安装telnet，测试可远程，如还有其他方式远程，那直接干吧；ssh在以下过程中移除之后，不能退出当前终端，若退出，无法再次连接ssh了。只能通过telnet或直接控制台打键盘输入了。
关闭firewalld和selinux
sed -i 's/SELINUX=enforcing/SELINUX=disabled/' /etc/selinux/config
setenforce 0
安装依赖
yum -y install lrzsz zlib-devel zlib pcre pcre-devel pam-devel
下载组件文件
wget https://www.openssl.org/source/openssl-1.1.1g.tar.gz
tar -zxvf openssl-1.1.1g.tar.gz
cd openssl-1.1.1g
./config --prefix=/usr/local/openssl --openssldir=/usr/local/openssl -Wl,-rpath,/usr/local/openssl/lib shared
make
make install
创建软链接
rm /usr/bin/openssl
ln -s /usr/local/openssl/bin/openssl /usr/bin/openssl
ln -s /usr/local/openssl/include/openssl /usr/include/openssl
更新系统配置
echo "/usr/local/openssl/lib" >> /etc/ld.so.conf
/sbin/ldconfig
检查版本
openssl version
安装openssh，选用最新发布的版本
wget https://openbsd.hk/pub/OpenBSD/OpenSSH/portable/openssh-8.4p1.tar.gz
卸载系统预装的openssh
rpm -qa | grep openssh
yum -y remove openssh-clients-7.4p1-16.el7.x86_64 openssh-7.4p1-16.el7.x86_64 openssh-server-7.4p1-16.el7.x86_64
备份openssh配置
cp -r /etc/ssh /etc/ssh.bak
rm -rf /etc/ssh (必须)
安装步骤
tar -zxvf openssh-8.4p1.tar.gz
cd openssh-8.4p1
./configure --prefix=/usr/local/openssh --sysconfdir=/etc/ssh --with-openssl-includes=/usr/local/openssl/include --with-ssl-dir=/usr/local/openssl --with-zlib --with-md5-passwords --with-pam --with-ssl-engine
make
make install
创建软链接
ln -s /usr/local/openssh/sbin/sshd /usr/sbin/sshd
ln -s /usr/local/openssh/bin/ssh /usr/bin/ssh
ln -s /usr/local/openssh/bin/ssh-add /usr/bin/ssh-add
ln -s /usr/local/openssh/bin/ssh-keygen /usr/bin/ssh-keygen
ln -s /usr/local/openssh/bin/ssh-keyscan /usr/bin/ssh-keyscan
将openssh的服务脚本复制到/etc/init.d目录下
cp /root/openssh-8.4p1/contrib/redhat/sshd.init /etc/init.d/sshd
chmod u+x /etc/init.d/sshd
添加sshd服务并设置为开机启动
chkconfig --add sshd
chkconfig sshd on
检查openssh版本
ssh -V
OpenSSH_8.4p1, OpenSSL 1.1.1g 21 Apr 2020
修改openssh的配置文件，允许root登录
echo 'PermitRootLogin yes' >> /etc/ssh/sshd_config
echo 'PasswordAuthentication yes' >> /etc/ssh/sshd_config
重启sshd服务
systemctl daemon-reexec
systemctl restart sshd
systemctl status sshd
查看sshd进程监听又回来了
ss -tnlp | grep sshd
这时候putty新建连接是没问题，但SecureCRT即出现
Key exchange failed.
No compatible key-exchange method. The server supports these methods: curve25519-sha256,curve25519-sha256@libssh.org,
ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,
diffie-hellman-group18-sha512,diffie-hellman-group14-sha256
原因： 升级了openssh的服务器已经不再支持老版本ssh client的相关协议
修改升级后的服务器配置文件使其支持旧版本的协议
cat >> /etc/ssh/sshd_config <<EOF
KexAlgorithms diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,curve25519-sha256@libssh.org
EOF
重载并重启sshd服务
systemctl daemon-reexec
systemctl restart sshd
systemctl status sshd
至此openssh服务升级完成，
不放心的话可以reboot重启机器