美文网首页
【OpenSSH】CentOS7.x上编译rpm升级OpenSS

【OpenSSH】CentOS7.x上编译rpm升级OpenSS

作者: Bogon | 来源:发表于2024-07-03 09:39 被阅读0次

    OpenSSH漏洞预警：无需用户交互，可提权至 root
    https://mp.weixin.qq.com/s/c_gATfwcjyXVGj0g6xXIBg

    OpenSSH远程代码执行漏洞分析及POC（CVE-2024-6387）
    https://mp.weixin.qq.com/s/79P1zpb36D0ku-gwwXfPtQ

    OenSSH官方只提供源码包，我们考虑自己将源码编译为rpm包来升级环境的OpenSSH。
    当然编译过程也尽量简单化，这里我们直接使用开源的脚本进行编译。
    https://github.com/boypt/openssh-rpms

    # yum -y install epel-release 
 
# yum -y install  git   zip  unzip
 
# yum -y groupinstall  "Development Tools"
 
# yum -y install  imake rpm-build pam-devel krb5-devel zlib-devel libXt-devel libX11-devel gtk2-devel


    # git clone https://github.com/boypt/openssh-rpms.git
 
# cd openssh-rpms-main
 
# ls -l
-rwxr-xr-x. 1 root root 1959 9月   3 21:44 compile.sh
drwxr-xr-x. 2 root root  114 9月   3 21:40 downloads
drwxr-xr-x. 7 root root   72 8月  10 15:22 el5
drwxr-xr-x. 7 root root   72 8月  10 15:22 el6
drwxr-xr-x. 8 root root   89 9月   3 21:44 el7
-rwxr-xr-x. 1 root root 1304 9月   3 21:39 pullsrc.sh
-rw-r--r--. 1 root root 1440 8月  10 15:22 README.md
-rw-r--r--. 1 root root  255 8月  10 15:22 version.env
 
 将出现 source  version.env 行改为  source ./version.env 
# grep "version.env"   *.sh
compile.sh:source ./version.env
pullsrc.sh:source ./version.env
 
将出现 wget 的行加上 --no-check-certificate 参数，避免因为证书问题导致源码下载失败。
#  grep  "wget"  pullsrc.sh
wget --no-check-certificate $OPENSSLMIR/$OPENSSLSRC
wget --no-check-certificate $OPENSSHMIR/$OPENSSHSRC
wget --no-check-certificate $ASKPASSMIR/$ASKPASSSRC

    #  sh  pullsrc.sh

#  sh  compile.sh
 
 
Obsoletes: ssh-server
处理文件：openssh-debuginfo-9.8p1-1.el7.x86_64
Provides: openssh-debuginfo = 9.8p1-1.el7 openssh-debuginfo(x86-64) = 9.8p1-1.el7
Requires(rpmlib): rpmlib(FileDigests) <= 4.6.0-1 rpmlib(PayloadFilesHavePrefix) <= 4.0-1 rpmlib(CompressedFileNames) <= 3.0.4-1
检查未打包文件：/usr/lib/rpm/check-files /root/openssh-rpms-main/el7/BUILDROOT/openssh-9.8p1-1.el7.x86_64
写道:/root/openssh-rpms-main/el7/SRPMS/openssh-9.8p1-1.el7.src.rpm
写道:/root/openssh-rpms-main/el7/RPMS/x86_64/openssh-9.8p1-1.el7.x86_64.rpm
写道:/root/openssh-rpms-main/el7/RPMS/x86_64/openssh-clients-9.8p1-1.el7.x86_64.rpm
写道:/root/openssh-rpms-main/el7/RPMS/x86_64/openssh-server-9.8p1-1.el7.x86_64.rpm
写道:/root/openssh-rpms-main/el7/RPMS/x86_64/openssh-debuginfo-9.8p1-1.el7.x86_64.rpm
执行(%clean): /bin/sh -e /var/tmp/rpm-tmp.GHFx0p
+ umask 022
+ cd /root/openssh-rpms-main/el7/BUILD
+ cd openssh-9.8p1
+ rm -rf /root/openssh-rpms-main/el7/BUILDROOT/openssh-9.8p1-1.el7.x86_64
+ exit 0
~/openssh-rpms-main

    # ll /root/openssh-rpms-main/el7/RPMS/x86_64/
 
总用量 15408
-rw-r--r--. 1 root root 5150056 9月   3 21:44 openssh-9.8p1-1.el7.x86_64.rpm
-rw-r--r--. 1 root root 5179640 9月   3 21:45 openssh-clients-9.8p1-1.el7.x86_64.rpm
-rw-r--r--. 1 root root 3911916 9月   3 21:45 openssh-debuginfo-9.8p1-1.el7.x86_64.rpm
-rw-r--r--. 1 root root 1527088 9月   3 21:45 openssh-server-9.8p1-1.el7.x86_64.rpm

    #  yum -y localinstall  /root/openssh-rpms-main/el7/RPMS/x86_64/*.rpm
 
#  systemctl restart sshd
Job for sshd.service failed because the control process exited with error code. See "systemctl status sshd.service" and "journalctl -xe" for details.

 
# systemctl  status   sshd
 sshd.service - SYSV: OpenSSH server daemon
   Loaded: loaded (/etc/rc.d/init.d/sshd; bad; vendor preset: enabled)
   Active: failed (Result: exit-code) since 日 2023-09-03 21:47:05 CST; 9s ago
     Docs: man:systemd-sysv-generator(8)
  Process: 85319 ExecStop=/etc/rc.d/init.d/sshd stop (code=exited, status=0/SUCCESS)
  Process: 85344 ExecStart=/etc/rc.d/init.d/sshd start (code=exited, status=1/FAILURE)
 Main PID: 1079 (code=exited, status=0/SUCCESS)
 
9月 03 21:47:05 localhost.localdomain sshd[85344]: @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
9月 03 21:47:05 localhost.localdomain sshd[85344]: Permissions 0640 for '/etc/ssh/ssh_host_ed25519_key' are too open.
9月 03 21:47:05 localhost.localdomain sshd[85344]: It is required that your private key files are NOT accessible by others.
9月 03 21:47:05 localhost.localdomain sshd[85344]: This private key will be ignored.
9月 03 21:47:05 localhost.localdomain sshd[85344]: sshd: no hostkeys available -- exiting.
9月 03 21:47:05 localhost.localdomain sshd[85344]: [失败]
9月 03 21:47:05 localhost.localdomain systemd[1]: sshd.service: control process exited, code=exited status=1
9月 03 21:47:05 localhost.localdomain systemd[1]: Failed to start SYSV: OpenSSH server daemon.
9月 03 21:47:05 localhost.localdomain systemd[1]: Unit sshd.service entered failed state.
9月 03 21:47:05 localhost.localdomain systemd[1]: sshd.service failed.
 
 
# chmod  400 /etc/ssh/*key
 
# systemctl  restart sshd
 
# systemctl  status   sshd
 
# systemctl  status   sshd
 sshd.service - SYSV: OpenSSH server daemon
   Loaded: loaded (/etc/rc.d/init.d/sshd; bad; vendor preset: enabled)
   Active: active (running) since 日 2023-09-03 21:47:46 CST; 6s ago
     Docs: man:systemd-sysv-generator(8)
  Process: 85319 ExecStop=/etc/rc.d/init.d/sshd stop (code=exited, status=0/SUCCESS)
  Process: 85364 ExecStart=/etc/rc.d/init.d/sshd start (code=exited, status=0/SUCCESS)
 Main PID: 85372 (sshd)
    Tasks: 1
   Memory: 772.0K
   CGroup: /system.slice/sshd.service
           └─85372 sshd: /usr/sbin/sshd [listener] 0 of 10-100 startups
 
9月 03 21:47:46 localhost.localdomain systemd[1]: Starting SYSV: OpenSSH server daemon...
9月 03 21:47:46 localhost.localdomain sshd[85364]: /sbin/restorecon:  lstat(/etc/ssh/ssh_host_dsa_key.pub) failed:  No such file or directory
9月 03 21:47:46 localhost.localdomain sshd[85364]: Starting sshd:[  确定  ]
9月 03 21:47:46 localhost.localdomain sshd[85372]: Server listening on 0.0.0.0 port 22.
9月 03 21:47:46 localhost.localdomain sshd[85372]: Server listening on :: port 22.
9月 03 21:47:46 localhost.localdomain systemd[1]: Can't open PID file /var/run/sshd.pid (yet?) after start: No such file or directory
9月 03 21:47:46 localhost.localdomain systemd[1]: Started SYSV: OpenSSH server daemon.

    OpenSSH 从 7.0 后开始对于version 1.x 就不支持了，相应的RSA1算法也不再支持了
    编译OpenSSH 源码的时候也不会在/etc/ssh目录下面生成ssh_host_key/ssh_host_key.pub
    http://www.openssh.com/txt/release-6.9

    将 /sbin/restorecon /etc/ssh/ssh_host_dsa_key.pub 行注释掉

    # sed -i '/ssh_host_dsa_key.pub/s/^/#/'  /etc/init.d/sshd

    # systemctl daemon-reload
# systemctl  restart sshd

# systemctl  status   sshd
sshd.service - SYSV: OpenSSH server daemon
  Loaded: loaded (/etc/rc.d/init.d/sshd; bad; vendor preset: enabled)
  Active: active (running) since 日 2023-09-03 21:51:03 CST; 2s ago
    Docs: man:systemd-sysv-generator(8)
 Process: 85457 ExecStop=/etc/rc.d/init.d/sshd stop (code=exited, status=0/SUCCESS)
 Process: 85464 ExecStart=/etc/rc.d/init.d/sshd start (code=exited, status=0/SUCCESS)
Main PID: 85471 (sshd)
   Tasks: 1
  Memory: 788.0K
  CGroup: /system.slice/sshd.service
          └─85471 sshd: /usr/sbin/sshd [listener] 0 of 10-100 startups

9月 03 21:51:03 localhost.localdomain systemd[1]: Starting SYSV: OpenSSH server daemon...
9月 03 21:51:03 localhost.localdomain sshd[85471]: Server listening on 0.0.0.0 port 22.
9月 03 21:51:03 localhost.localdomain sshd[85471]: Server listening on :: port 22.
9月 03 21:51:03 localhost.localdomain sshd[85464]: Starting sshd:[  确定  ]
9月 03 21:51:03 localhost.localdomain systemd[1]: Started SYSV: OpenSSH server daemon.

    # ssh -V
OpenSSH_9.8p1, OpenSSL 1.1.1w  1 Aug 2023
 
# sshd  -V
OpenSSH_9.4, OpenSSL 1.1.1w  1 Aug 2023
 
# rpm -qa | grep openssh
openssh-9.8p1-1.el7.x86_64
openssh-clients-9.8p1-1.el7.x86_64
openssh-debuginfo-9.8p1-1.el7.x86_64
openssh-server-9.8p1-1.el7.x86_64

    # mkdir  install_openssh-9.8p1
# cd  install_openssh-9.8p1
# cp  /root/openssh-rpms-main//el7/BUILD/openssh-9.8p1/contrib/ssh-copy-id   ./
# cp /root/openssh-rpms-main/el7/RPMS/x86_64/*   ./

    cat install_openssh-9.8p1.sh

    
#!/bin/bash
 
if ! yum -y localinstall *.rpm ; then
  echo "OpenSSH rpm 安装失败！"
  exit 1
fi
 
chmod 400 /etc/ssh/ssh_host_*_key
 
cp ssh-copy-id  /usr/bin/
chmod  755  /usr/bin/ssh-copy-id

sed -i '/ssh_host_dsa_key.pub/s/^/#/' /etc/init.d/sshd
 
systemctl daemon-reload
 
systemctl restart sshd
systemctl enable  sshd
systemctl status sshd
 
rpm -qa | grep openssh
ssh  -V

    参考

    如何编译打包OpenSSH 9.4并实现批量升级
    https://mp.weixin.qq.com/s/XHyHJjwnO4P2XO5WUS4Ehw

    CentOS7下快速升级至OpenSSH9.8p1安全版本
    https://mp.weixin.qq.com/s/HokRwGqzK6uiSgCId3E0QA

    OpenSSH重启，/sbin/restorecon:lstat(/etc/ssh/ssh_host_key.pub) failed报错
    https://blog.51cto.com/kk876435928/1737597

    sed 在行首或者行尾添加文本
    https://blog.csdn.net/w2909526/article/details/102587577

    相关文章

      网友评论

          本文标题：【OpenSSH】CentOS7.x上编译rpm升级OpenSS

          本文链接：https://www.haomeiwen.com/subject/bpybcjtx.html

          延伸阅读

          深度阅读

          • 您也可以注册成为美文阅读网的作者，发表您的原创作品、分享您的心情！

          栏目导航

          热点阅读

          关于我们|服务条款|联系我们|【OpenSSH】CentOS7.x上编译rpm升级OpenSS|投稿指南|网站地图|RSS订阅|排版工具|手机版

          提供经典美文摘抄,优美散文欣赏,现代诗歌精选,短篇小说,心情随笔,表白情书范文,故事会在线阅读欣赏

          Copyright © 2014-2023 Haomeiwen.com All Rights Reserved. 好美文阅读网 版权所有

          备案信息：桂公网安备 45052102000051号 · 桂ICP备13007215号-3

          本站所收录作品、热点评论等信息部分来源互联网，目的只是为了系统归纳学习和传递资讯

          所有作品版权归原创作者所有，与本站立场无关，如不慎侵犯了你的权益，请联系我们告知，我们将做删除处理！