Centos7升级openssl及ssh

前言: 漏洞CVE-2020-15778,OpenSSH的8.3p1及之前版本中的scp允许在scp.c远程功能中注入命令,攻击者可利用该漏洞执行任意命令。升级为最新版解决!

       注意:

       以防升级失败,连不上服务器,建议先安装telnet,测试可远程,如还有其他方式远程,那直接干吧;ssh在以下过程中移除之后,不能退出当前终端,若退出,无法再次连接ssh了。只能通过telnet或直接控制台打键盘输入了。

关闭firewalld和selinux

sed -i 's/SELINUX=enforcing/SELINUX=disabled/'   /etc/selinux/config

setenforce 0

安装依赖

yum -y install lrzsz zlib-devel  zlib  pcre  pcre-devel pam-devel

下载组件文件

wget  https://www.openssl.org/source/openssl-1.1.1g.tar.gz

tar -zxvf openssl-1.1.1g.tar.gz

cd openssl-1.1.1g

./config --prefix=/usr/local/openssl --openssldir=/usr/local/openssl -Wl,-rpath,/usr/local/openssl/lib shared

make

make install

 

创建软链接

rm  /usr/bin/openssl

ln -s /usr/local/openssl/bin/openssl  /usr/bin/openssl

ln -s /usr/local/openssl/include/openssl /usr/include/openssl

 

更新系统配置

echo "/usr/local/openssl/lib"  >> /etc/ld.so.conf

/sbin/ldconfig

 

检查版本

openssl version

 

安装openssh,选用最新发布的版本

wget  https://openbsd.hk/pub/OpenBSD/OpenSSH/portable/openssh-8.4p1.tar.gz

 

卸载系统预装的openssh

rpm -qa | grep openssh

yum -y remove openssh-clients-7.4p1-16.el7.x86_64  openssh-7.4p1-16.el7.x86_64  openssh-server-7.4p1-16.el7.x86_64

 

备份openssh配置

cp -r /etc/ssh /etc/ssh.bak

rm -rf /etc/ssh  (必须)

 

安装步骤

tar -zxvf openssh-8.4p1.tar.gz

cd  openssh-8.4p1

./configure --prefix=/usr/local/openssh --sysconfdir=/etc/ssh  --with-openssl-includes=/usr/local/openssl/include   --with-ssl-dir=/usr/local/openssl   --with-zlib   --with-md5-passwords   --with-pam   --with-ssl-engine

make

make install

 

创建软链接

ln -s /usr/local/openssh/sbin/sshd /usr/sbin/sshd

ln -s /usr/local/openssh/bin/ssh /usr/bin/ssh

ln -s /usr/local/openssh/bin/ssh-add /usr/bin/ssh-add

ln -s /usr/local/openssh/bin/ssh-keygen /usr/bin/ssh-keygen

ln -s /usr/local/openssh/bin/ssh-keyscan /usr/bin/ssh-keyscan

 

将openssh的服务脚本复制到/etc/init.d目录下

cp /root/openssh-8.4p1/contrib/redhat/sshd.init /etc/init.d/sshd

chmod u+x /etc/init.d/sshd

 

添加sshd服务并设置为开机启动

chkconfig --add sshd

chkconfig  sshd  on

检查openssh版本

ssh -V

OpenSSH_8.4p1, OpenSSL 1.1.1g  21 Apr 2020

 

修改openssh的配置文件,允许root登录

echo 'PermitRootLogin yes' >> /etc/ssh/sshd_config

echo 'PasswordAuthentication yes' >> /etc/ssh/sshd_config

 

重启sshd服务

systemctl daemon-reexec

systemctl restart sshd

systemctl status sshd

 

查看sshd进程监听又回来了

ss -tnlp | grep  sshd

 

这时候putty新建连接是没问题,但SecureCRT即出现

Key exchange failed.

No compatible key-exchange method. The server supports these methods: curve25519-sha256,curve25519-sha256@libssh.org,

ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,

diffie-hellman-group18-sha512,diffie-hellman-group14-sha256

 

原因: 升级了openssh的服务器已经不再支持老版本ssh client的相关协议

 

修改升级后的服务器配置文件使其支持旧版本的协议

cat >>  /etc/ssh/sshd_config <<EOF

KexAlgorithms diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,curve25519-sha256@libssh.org

EOF

 

重载并重启sshd服务

systemctl daemon-reexec

systemctl restart sshd

systemctl status  sshd

 

至此openssh服务升级完成,

不放心的话可以reboot重启机器

上一篇:Ubuntu系统的SSH出现“Connection reset by IP port 22 ”


下一篇:「OpenSSH」- 端口转发 @20210129