openssh升级到8.4，openssl升级到1.1.1h

1、gcc及openssh升级包

gcc安装包及openssh8.4安装包

2、查看系统当前版本

此次升级适用于redhat6.5及centos6.6,centos7.9其他版本未测试。

centos7.9可忽略gcc安装（升级后旧版本的ssh工具可能无法使用，报秘钥问题，使用新版本即可）

rpm -q zlib

openssl version

ssh -V

lsb_release -a

[root@localhost ~]# rpm -q zlib

zlib-1.2.3-29.el6.x86_64

[root@localhost ~]# openssl version

OpenSSL 1.0.1e-fips 11 Feb 2013

[root@localhost ~]# ssh -V

OpenSSH_5.3p1, OpenSSL 1.0.0-fips 29 Mar 2010

[root@localhost ~]# lsb_release -a

LSB Version: :base-4.0-amd64:base-4.0-noarch:core-4.0-amd64:core-4.0-noarch:graphics-4.0-amd64:graphics-4.0-noa

rch:printing-4.0-amd64:printing-4.0-noarchDistributor ID: RedHatEnterpriseServer

Description: Red Hat Enterprise Linux Server release 6.5 (Santiago)

Release: 6.5

Codename: Santiago

[root@localhost ~]#

[root@localhost ~]#

3、上传gcc安装包及openssh的安装包上传到指定路径下（路径可自行选择本次是上传到/home路径下）

[root@localhost ~]# df -h

Filesystem Size Used Avail Use% Mounted on

/dev/mapper/VolGroup-lv_root 50G 2.8G 44G 6% /

tmpfs 3.9G 76K 3.9G 1% /dev/shm

/dev/sda1 485M 39M 421M 9% /boot

/dev/mapper/VolGroup-lv_home 435G 199M 413G 1% /home

[root@localhost ~]# cd /home

[root@localhost home]#

[root@localhost home]# ls

cloog-ppl-0.15.7-1.2.el6.x86_64.rpm glibc-headers-2.12-1.192.el6.x86_64.rpm mpfr-2.4.1-6.el6.x86_64.rpm

cpp-4.4.7-17.el6.x86_64.rpm install-gcc.sh openssh-8.4p1.tar.gz

gcc-4.4.7-17.el6.x86_64.rpm kernel-headers-2.6.32-642.4.2.el6.x86_64.rpm openssl-1.1.1h.tar.gz

glibc-2.12-1.192.el6.x86_64.rpm libgomp-4.4.7-17.el6.x86_64.rpm ppl-0.10.2-11.el6.x86_64.rpm

glibc-devel-2.12-1.192.el6.x86_64.rpm lost+found zlib-1.2.11.tar.gz

[root@localhost home]#

4、安装gcc包

[root@localhost home]#

[root@localhost home]# chmod 777 install-gcc.sh

[root@localhost home]#

[root@localhost home]#

[root@localhost home]# ./install-gcc.sh

warning: ppl-0.10.2-11.el6.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID c105b9de: NOKEY

Preparing... ########################################### [100%]

1:ppl ########################################### [100%]

warning: cloog-ppl-0.15.7-1.2.el6.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID c105b9de: NOKEY

Preparing... ########################################### [100%]

1:cloog-ppl ########################################### [100%]

warning: mpfr-2.4.1-6.el6.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID c105b9de: NOKEY

Preparing... ########################################### [100%]

1:mpfr ########################################### [100%]

warning: cpp-4.4.7-17.el6.x86_64.rpm: Header V3 RSA/SHA1 Signature, key ID c105b9de: NOKEY

Preparing... ########################################### [100%]

1:cpp ########################################### [100%]

warning: kernel-headers-2.6.32-642.4.2.el6.x86_64.rpm: Header V3 RSA/SHA1 Signature, key ID c105b9de: NOKEY

Preparing... ########################################### [100%]

1:kernel-headers ########################################### [100%]

warning: glibc-headers-2.12-1.192.el6.x86_64.rpm: Header V3 RSA/SHA1 Signature, key ID c105b9de: NOKEY

Preparing... ########################################### [100%]

1:glibc-headers ########################################### [100%]

warning: glibc-devel-2.12-1.192.el6.x86_64.rpm: Header V4 DSA/SHA1 Signature, key ID 192a7d7d: NOKEY

Preparing... ########################################### [100%]

1:glibc-devel ########################################### [100%]

warning: libgomp-4.4.7-17.el6.x86_64.rpm: Header V3 RSA/SHA1 Signature, key ID c105b9de: NOKEY

Preparing... ########################################### [100%]

1:libgomp ########################################### [100%]

warning: gcc-4.4.7-17.el6.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID 41a40948: NOKEY

Preparing... ########################################### [100%]

1:gcc ########################################### [100%]

[root@localhost home]#

5、安装zlib库

[root@localhost home]# tar -zxvf zlib-1.2.11.tar.gz

[root@localhost home]#

[root@localhost home]# cd zlib-1.2.11

[root@localhost zlib-1.2.11]#

[root@localhost zlib-1.2.11]# ./configure

Checking for gcc...

Compiler error reporting is too harsh for ./configure (perhaps remove -Werror).

** ./configure aborting.

[root@localhost ~]# yum install -y gcc-c++

[root@localhost zlib-1.2.11]# ./configure 如果有上面的报错，输入上面的命令

[root@localhost zlib-1.2.11]#

[root@localhost zlib-1.2.11]# make && make install

安装不能有任何报错

6、Openssl升级

解压openssl-1.1.1h.tar.gz

[root@localhost home]#

[root@localhost home]# tar -zxvf openssl-1.1.1h.tar.gz

[root@localhost home]# cd openssl-1.1.1h

[root@localhost openssl-1.1.1h]#

[root@localhost openssl-1.1.1h]#

[root@localhost openssl-1.1.1h]# ./config --prefix=/usr/local/openssl --shared

报错

[root@localhost openssl-1.1.1h]# ./config --prefix=/usr/local/openssl --shared

Operating system: x86_64-whatever-linux2

You need Perl 5.

解决办法

yum -y install wget

[root@localhost openssl-1.1.1h]# wget https://www.cpan.org/src/5.0/perl-5.28.0.tar.gz

[root@localhost openssl-1.1.1h]# tar -zxvf perl-5.28.0.tar.gz

[root@localhost openssl-1.1.1h]# cd perl-5.28.0

[root@localhost perl-5.28.0]# ./Configure -des -Dprefix=$HOME/localperl

[root@localhost perl-5.28.0]# make

[root@localhost perl-5.28.0]# make test

[root@localhost perl-5.28.0]# make install

[root@localhost openssl-1.1.1h]#

[root@localhost openssl-1.1.1h]# make && make install

[root@localhost openssl-1.1.1h]#

[root@localhost openssl-1.1.1h]# ls /usr/local/openssl

bin include lib share ssl

[root@localhost openssl-1.1.1h]# vi /etc/ld.so.conf

在/etc/ld.so.conf文件的最后面，添加如下内容 /usr/local/openssl/lib

[root@localhost openssl-1.1.1h]# ldconfig

[root@localhost openssl-1.1.1h]#

[root@localhost openssl-1.1.1h]#

[root@localhost openssl-1.1.1h]# vi /etc/profile

在/etc目录下的profile文件的最后一行，添加:

export OPENSSL=/usr/local/openssl/bin

export PATH=$OPENSSL:$PATH:$HOME/bin

[root@localhost openssl-1.1.1h]#

[root@localhost openssl-1.1.1h]# source /etc/profile

[root@localhost openssl-1.1.1h]#

[root@localhost openssl-1.1.1h]#

[root@localhost openssl-1.1.1h]# openssl version

OpenSSL 1.1.1h 22 Sep 2020

[root@localhost openssl-1.1.1h]#

7、openssh升级

[root@localhost ~]#

[root@localhost ~]# mkdir /etc/sshbak

[root@localhost ~]#

[root@localhost ~]# mv /etc/ssh/* /etc/sshbak

[root@localhost ~]#

[root@localhost ~]# mv /etc/init.d/sshd /etc/init.d/sshdbak

[root@localhost ~]#

[root@localhost ~]#

[root@localhost ~]# cd /home/

[root@localhost home]#

[root@localhost home]# tar -zxvf openssh-8.4p1.tar.gz

[root@localhost home]# cd openssh-8.4p1

[root@localhost openssh-8.4p1]#

[root@localhost openssh-8.4p1]#

[root@localhost openssh-8.4p1]#

[root@localhost openssh-8.4p1]# ./configure --prefix=/usr/ --sysconfdir=/etc/ssh --with-ssl-dir=/usr/local/openssl

[root@localhost openssh-8.4p1]#

[root@localhost openssh-8.4p1]#

[root@localhost openssh-8.4p1]#

[root@localhost openssh-8.4p1]# make && make install

[root@localhost openssh-8.4p1]#

[root@localhost openssh-8.4p1]# cp -a contrib/redhat/sshd.init /etc/init.d/sshd

[root@localhost openssh-8.4p1]#

[r[root@localhost openssh-8.4p1]#

[root@localhost openssh-8.4p1]# ls /etc/ssh

moduli ssh_host_dsa_key ssh_host_ecdsa_key.pub ssh_host_rsa_key

ssh_config ssh_host_dsa_key.pub ssh_host_ed25519_key ssh_host_rsa_key.pub

sshd_config ssh_host_ecdsa_key ssh_host_ed25519_key.pub

[root@localhost openssh-8.4p1]#

[root@localhost openssh-8.4p1]#

[root@localhost openssh-8.4p1]# vi /etc/ssh/sshd_config

找到#PermitRootLogin prohibit-password

在下面一行添加PermitRootLogin yes

PermitRootLogin yes

在最下面添加 KexAlgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,

diffie-hellman-group14-sha1

[root@localhost openssh-8.4p1]# vi /etc/selinux/config

把SELINUX=enforceing 改成disabled

[root@localhost openssh-8.4p1]# chkconfig sshd on

[root@localhost openssh-8.4p1]#

[root@localhost openssh-8.4p1]#

[root@localhost openssh-8.4p1]# service sshd restart

Stopping sshd: [ OK ]

Starting sshd: [ OK ]

[root@localhost openssh-8.4p1]#

[root@localhost openssh-8.4p1]#

[root@localhost openssh-8.4p1]# ssh -V

OpenSSH_8.4p1, OpenSSL 1.1.1h 22 Sep 2020

[root@localhost openssh-8.4p1]#

[root@localhost openssh-8.4p1]#

整个过程ssh不会断，为防止意外，可开启telnet,或者用虚拟化的界面直接操作

[root@localhost openssh-8.4p1]# reboot

重启系统

Connecting to 211.86.192.252:22…

Connection established.

To escape to local shell, press 'Ctrl+Alt+]'.

WARNING! The remote SSH server rejected X11 forwarding request.

Last login: Sun Nov 1 16:14:08 2020 from 10.10.49.58

[root@localhost ~]#

[root@localhost ~]#

[root@localhost ~]#

[root@localhost ~]# ssh -V

OpenSSH_8.4p1, OpenSSL 1.1.1h 22 Sep 2020

[root@localhost ~]#

[root@localhost ~]#