当前位置：首页 > news >正文

CentOS 7.9升级OpenSSH到9.9p2

news 2025/7/13 8:13:56

初始版本
ssh -V
OpenSSH_7.4p1, OpenSSL 1.0.2k-fips 26 Jan 2017

1.安装编译依赖

yum install -y gcc perl make zlib-devel pam-devel openssl-devel wget

2.升级OpenSSL到1.1.1版本

2.1 备份当前OpenSSL配置

sudo cp -r /usr/bin/openssl /usr/bin/openssl.bak
sudo cp -r /usr/include/openssl /usr/include/openssl.bak
sudo cp -r /usr/lib64/openssl /usr/lib64/openssl.bak
sudo cp -r /usr/lib64/libssl* /usr/lib64/libssl.bak/
sudo cp -r /usr/lib64/libcrypto* /usr/lib64/libcrypto.bak/

2.2 下载源代码

cd /usr/src
#sudo wget https://www.openssl.org/source/openssl-1.1.1w.tar.gz
sudo wget https://download.clickpaas.tech/image/openssl-1.1.1w.tar.gz
sudo tar -xzf openssl-1.1.1w.tar.gz
cd openssl-1.1.1w

2.3 编译安装

sudo ./config --prefix=/usr --openssldir=/etc/ssl --libdir=lib64 shared zlib
sudo make
sudo make test # 运行测试（可选但推荐）
sudo make install

2.4 创建必要的符号链接：

sudo ln -sf /usr/lib64/libssl.so.1.1 /usr/lib64/libssl.so
sudo ln -sf /usr/lib64/libcrypto.so.1.1 /usr/lib64/libcrypto.so

2.5 更新系统库缓存

sudo ldconfig

2.6 验证安装

openssl version

OpenSSL 1.1.1w 11 Sep 2023

2.7 重建依赖OpenSSL的软件

sudo yum reinstall -y openssh-clients openssh-server postfix

2.8 更新CA证书

sudo yum reinstall ca-certificates

3.升级OpenSSH到9.9p2版本

3.1 备份ssh和sshd配置

sudo cp -p /etc/ssh/sshd_config /etc/ssh/sshd_config.bak
sudo cp -p /etc/ssh/ssh_config /etc/ssh/ssh_config.bak

3.2 下载源代码

cd /usr/src
#sudo wget https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-9.9p2.tar.gz
sudo wget https://download.clickpaas.tech/image/openssh-9.9p2.tar.gz
sudo tar -xzf openssh-9.9p2.tar.gz
cd openssh-9.9p2

3.3 编译安装

sudo ./configure --prefix=/usr --sysconfdir=/etc/ssh --with-md5-passwords --with-privsep-path=/var/lib/sshd --with-ssl-dir=/usr/local/ssl
sudo make
sudo make install

3.4 检查sshd的配置

#sudo cp /etc/ssh/sshd_config.bak /etc/ssh/sshd_config

/usr/sbin/sshd -t -f /etc/ssh/sshd_config

如：

/etc/ssh/sshd_config line 78: Unsupported option GSSAPIAuthentication
/etc/ssh/sshd_config line 79: Unsupported option GSSAPICleanupCredentials
/etc/ssh/sshd_config line 93: Unsupported option UsePAM

注释这些不再支持的配置

sshd -t