Anolis OS 8.4上编译rpm升级OpenSSH至 9.

作者: 前浪浪奔浪流 | 来源:发表于2024-08-22 17:22 被阅读0次

centos7 安装openssh8.3
制作openssh的rpm升级包
ubantu升级openssh到8.4
【OpenSSH】OpenSSH编译升级，导致普通用户打开句柄数
CentOS6升级OpenSSH
Centos7制作openssh的rpm包
centos 7 升级openssh到OpenSSH_8.2p1
Anolis8部署Elasticsearch单节点
OpenSSH升级版本到最新(8.4)
Ubuntu 16.04 升级OpenSSH至7.9p1

OpenSSH漏洞预警：无需用户交互，可提权至 root
https://mp.weixin.qq.com/s/c_gATfwcjyXVGj0g6xXIBg

OpenSSH远程代码执行漏洞分析及POC（CVE-2024-6387）
https://mp.weixin.qq.com/s/79P1zpb36D0ku-gwwXfPtQ

OenSSH官方只提供源码包，我们考虑自己将源码编译为rpm包来升级环境的OpenSSH。
当然编译过程也尽量简单化，这里我们直接使用开源的脚本进行编译。
https://github.com/boypt/openssh-rpms

# yum -y install epel-release 
# yum -y install  git   zip  unzip
# yum -y groupinstall  "Development Tools"
# yum -y install  imake rpm-build pam-devel krb5-devel zlib-devel libXt-devel libX11-devel gtk2-devel

# git clone https://github.com/boypt/openssh-rpms.git
#百度网盘下载链接: https://pan.baidu.com/s/1gS0ltu3YNmgPIAMHxc0xiw?pwd=sgpa 
# cd openssh-rpms-main
# ll
总用量 32
drwxr-xr-x 7 root root    72 8月  23 15:16 amzn1
drwxr-xr-x 7 root root    72 8月  23 15:16 amzn2
drwxr-xr-x 7 root root    72 8月  23 15:16 amzn2023
-rwxr-xr-x 1 root root  4044 8月  23 15:24 compile.sh
drwxr-xr-x 2 root root   149 8月  23 15:16 docker
-rw-r--r-- 1 root root 11802 8月  23 15:16 docker.README.md
drwxr-xr-x 2 root root   114 8月  23 15:28 downloads
drwxr-xr-x 7 root root    72 8月  23 15:16 el5
drwxr-xr-x 7 root root    72 8月  23 15:16 el6
drwxr-xr-x 8 root root    89 8月  23 15:44 el7
-rwxr-xr-x 1 root root  1874 8月  23 15:26 pullsrc.sh
-rw-r--r-- 1 root root  4394 8月  23 15:16 README.md
-rw-r--r-- 1 root root   336 8月  23 15:16 version.env

将出现 source version.env 的行，改为 source ./version.env

# grep "version.env"   *.sh
compile.sh:source ./version.env
pullsrc.sh:source ./version.env
vim compile.sh
第70行
source  version.env
改为
source ./version.env
并保存退出。
vim pullsrc.sh
第23行
source  version.env
改为
source ./version.env
并保存退出。

将出现 wget 的行加上 --no-check-certificate 参数，避免因为证书问题导致源码下载失败。

#  grep  "wget"  pullsrc.sh

wget --no-check-certificate $OPENSSLMIR/$OPENSSLSRC
wget --no-check-certificate $OPENSSHMIR/$OPENSSHSRC
wget --no-check-certificate $ASKPASSMIR/$ASKPASSSRC

image.png

#  sh  pullsrc.sh
#  sh  compile.sh
Recommends: openssh-debugsource(x86-64) = 9.8p1-1.an8
检查未打包文件：/usr/lib/rpm/check-files /root/openssh-rpms-main/el7/BUILDROOT/openssh-9.8p1-1.an8.x86_64
已写至：/root/openssh-rpms-main/el7/SRPMS/openssh-9.8p1-1.an8.src.rpm
已写至：/root/openssh-rpms-main/el7/RPMS/x86_64/openssh-9.8p1-1.an8.x86_64.rpm
已写至：/root/openssh-rpms-main/el7/RPMS/x86_64/openssh-clients-9.8p1-1.an8.x86_64.rpm
已写至：/root/openssh-rpms-main/el7/RPMS/x86_64/openssh-server-9.8p1-1.an8.x86_64.rpm
已写至：/root/openssh-rpms-main/el7/RPMS/x86_64/openssh-debugsource-9.8p1-1.an8.x86_64.rpm
已写至：/root/openssh-rpms-main/el7/RPMS/x86_64/openssh-debuginfo-9.8p1-1.an8.x86_64.rpm
已写至：/root/openssh-rpms-main/el7/RPMS/x86_64/openssh-clients-debuginfo-9.8p1-1.an8.x86_64.rpm
已写至：/root/openssh-rpms-main/el7/RPMS/x86_64/openssh-server-debuginfo-9.8p1-1.an8.x86_64.rpm
正在执行(%clean)：/bin/sh -e /var/tmp/rpm-tmp.CqEtsN
+ umask 022
+ cd /root/openssh-rpms-main/el7/BUILD
+ cd openssh-9.8p1
+ rm -rf /root/openssh-rpms-main/el7/BUILDROOT/openssh-9.8p1-1.an8.x86_64
+ exit 0
~/openssh-rpms-main

# ll /root/openssh-rpms-main/el7/RPMS/x86_64/
总用量 22512
-rw-r--r-- 1 root root 6674000 8月  23 15:47 openssh-9.8p1-1.an8.x86_64.rpm
-rw-r--r-- 1 root root 6816912 8月  23 15:47 openssh-clients-9.8p1-1.an8.x86_64.rpm
-rw-r--r-- 1 root root 1987868 8月  23 15:47 openssh-clients-debuginfo-9.8p1-1.an8.x86_64.rpm
-rw-r--r-- 1 root root 1522876 8月  23 15:47 openssh-debuginfo-9.8p1-1.an8.x86_64.rpm
-rw-r--r-- 1 root root  853532 8月  23 15:47 openssh-debugsource-9.8p1-1.an8.x86_64.rpm
-rw-r--r-- 1 root root 3616880 8月  23 15:47 openssh-server-9.8p1-1.an8.x86_64.rpm
-rw-r--r-- 1 root root 1561984 8月  23 15:47 openssh-server-debuginfo-9.8p1-1.an8.x86_64.rpm

#  yum -y localinstall  /root/openssh-rpms-main/el7/RPMS/x86_64/*.rpm
 
#  systemctl restart sshd
Job for sshd.service failed because the control process exited with error code. See "systemctl status sshd.service" and "journalctl -xe" for details.

# systemctl  status   sshd
● sshd.service - OpenSSH 9 server daemon
   Loaded: loaded (/usr/lib/systemd/system/sshd.service; enabled; vendor preset: enabled)
   Active: active (running) since Fri 2024-08-23 16:47:26 CST; 16s ago
     Docs: man:sshd(8)
           man:sshd_config(5)
 Main PID: 83903 (sshd)
    Tasks: 1 (limit: 50648)
   Memory: 756.0K
   CGroup: /system.slice/sshd.service
           └─83903 sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups

8月 23 16:47:26 anolis8 systemd[1]: Started OpenSSH 9 server daemon.
8月 23 16:47:26 anolis8 sshd[83903]: Server listening on 0.0.0.0 port 22.
8月 23 16:47:26 anolis8 sshd[83903]: Server listening on :: port 22.
 
 
# chmod  400 /etc/ssh/*key
# systemctl  restart  sshd.service
# systemctl  status  sshd.service

● sshd.service - OpenSSH 9 server daemon
   Loaded: loaded (/usr/lib/systemd/system/sshd.service; enabled; vendor preset: enabled)
   Active: active (running) since Fri 2024-08-23 16:47:26 CST; 1min 23s ago
     Docs: man:sshd(8)
           man:sshd_config(5)
 Main PID: 83903 (sshd)
    Tasks: 1 (limit: 50648)
   Memory: 756.0K
   CGroup: /system.slice/sshd.service
           └─83903 sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups

8月 23 16:47:26 anolis8 systemd[1]: Started OpenSSH 9 server daemon.
8月 23 16:47:26 anolis8 sshd[83903]: Server listening on 0.0.0.0 port 22.
8月 23 16:47:26 anolis8 sshd[83903]: Server listening on :: port 22.

OpenSSH 从 7.0 后开始对于version 1.x 就不支持了，相应的RSA1算法也不再支持了
编译OpenSSH 源码的时候也不会在/etc/ssh目录下面生成ssh_host_key/ssh_host_key.pub
http://www.openssh.com/txt/release-6.9

将 /sbin/restorecon /etc/ssh/ssh_host_dsa_key.pub 行注释掉

# sed -i '/ssh_host_dsa_key.pub/s/^/#/'  /etc/init.d/sshd

# systemctl daemon-reload
# systemctl  restart sshd
# systemctl status sshd
● sshd.service - OpenSSH 9 server daemon
   Loaded: loaded (/usr/lib/systemd/system/sshd.service; enabled; vendor preset: enabled)
   Active: active (running) since Fri 2024-08-23 17:04:41 CST; 21s ago
     Docs: man:sshd(8)
           man:sshd_config(5)
 Main PID: 84066 (sshd)
    Tasks: 1 (limit: 50648)
   Memory: 716.0K
   CGroup: /system.slice/sshd.service
           └─84066 sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups

8月 23 17:04:41 anolis8 systemd[1]: Started OpenSSH 9 server daemon.
8月 23 17:04:41 anolis8 sshd[84066]: Server listening on 0.0.0.0 port 22.
8月 23 17:04:41 anolis8 sshd[84066]: Server listening on :: port 22.
8月 23 17:04:48 anolis8 sshd-session[84067]: Accepted password for root from 172.16.17.128 port 52337 ssh2
8月 23 17:04:48 anolis8 sshd-session[84067]: pam_unix(sshd:session): session opened for user root by (uid=0)

# ssh -V
OpenSSH_9.8p1, OpenSSL 1.1.1w  11 Sep 2023
# sshd  -V
OpenSSH_9.8p1, OpenSSL 1.1.1w  11 Sep 2023
# rpm -qa | grep openssh
openssh-clients-9.8p1-1.el8.x86_64
openssh-9.8p1-1.el8.x86_64
openssh-server-9.8p1-1.el8.x86_64

#cd 
# mkdir  install_openssh-9.8p1
# cd  install_openssh-9.8p1
# cp  /root/openssh-rpms-main/el7/BUILD/openssh-9.8p1/contrib/ssh-copy-id   ./
# cp /root/openssh-rpms-main/el7/RPMS/x86_64/*   ./
# ll
总用量 22528
-rw-r--r-- 1 root root 6674000 8月  23 17:19 openssh-9.8p1-1.an8.x86_64.rpm
-rw-r--r-- 1 root root 6816912 8月  23 17:19 openssh-clients-9.8p1-1.an8.x86_64.rpm
-rw-r--r-- 1 root root 1987868 8月  23 17:19 openssh-clients-debuginfo-9.8p1-1.an8.x86_64.rpm
-rw-r--r-- 1 root root 1522876 8月  23 17:19 openssh-debuginfo-9.8p1-1.an8.x86_64.rpm
-rw-r--r-- 1 root root  853532 8月  23 17:19 openssh-debugsource-9.8p1-1.an8.x86_64.rpm
-rw-r--r-- 1 root root 3616880 8月  23 17:19 openssh-server-9.8p1-1.an8.x86_64.rpm
-rw-r--r-- 1 root root 1561984 8月  23 17:19 openssh-server-debuginfo-9.8p1-1.an8.x86_64.rpm
-rw-r--r-- 1 root root   13078 8月  23 17:19 ssh-copy-id

cat install_openssh-9.8p1.sh

#!/bin/bash
 
if ! yum -y localinstall *.rpm ; then
  echo "OpenSSH rpm 安装失败！"
  exit 1
fi
 
chmod 400 /etc/ssh/ssh_host_*_key
 
cp ssh-copy-id  /usr/bin/
chmod  755  /usr/bin/ssh-copy-id

sed -i '/ssh_host_dsa_key.pub/s/^/#/' /etc/init.d/sshd
 
systemctl daemon-reload
 
systemctl restart sshd
systemctl enable  sshd
systemctl status sshd
 
rpm -qa | grep openssh
ssh  -V

转载自https://www.jianshu.com/p/46011da1047c

centos7 安装openssh8.3
Centos7 通过 rpm 升级 OpenSSH 8.3版本背景：安全扫描，openssh 8.1之...
制作openssh的rpm升级包
制作openssh的rpm升级包 1. 检查本机openssh版本，查看yum源中最新的版本 2. 建立目录下载源...
ubantu升级openssh到8.4
参考https://www.cnblogs.com/y593216/p/13647033.html[https:/...
【OpenSSH】OpenSSH编译升级，导致普通用户打开句柄数
一、背景通过绿盟等安扫软件扫描到服务器OpenSSH存在漏洞，需要升级修复，通过编译最新OpenSSH完成升级后...
CentOS6升级OpenSSH
概要 CentOS6的OpenSSH5.x很多漏洞，现直接打包rpm文件升级升级后发现无法登录，原因是升级了Op...
Centos7制作openssh的rpm包
Centos7制作openssh的rpm包每个系统都会经历漏洞扫描，可能大家遇到最多的漏洞就是ssh升级，升级到最...
centos 7 升级openssh到OpenSSH_8.2p1
一、参考CentOS7 OpenSSH_7.4p1升级到OpenSSH_8.2p1(编译安装)http://not...
Anolis8部署Elasticsearch单节点
涉及版本声明： Linux: Anolis8.4 64位, 且已经安装好epel源。Jdk: 1....
OpenSSH升级版本到最新(8.4)
以下是安装过程：1、依赖软件包：yum install wget gcc -yyum group install ...
Ubuntu 16.04 升级OpenSSH至7.9p1
一、openssh 升级因网安漏洞扫描扫出OpenSSH漏洞，需要对OpenSSH进行升级操作 1、下载zlib...

Anolis OS 8.4上编译rpm升级OpenSSH至 9.

相关文章

centos7 安装openssh8.3

制作openssh的rpm升级包

ubantu升级openssh到8.4

【OpenSSH】OpenSSH编译升级，导致普通用户打开句柄数

CentOS6升级OpenSSH

Centos7制作openssh的rpm包

centos 7 升级openssh到OpenSSH_8.2p1

Anolis8部署Elasticsearch单节点

OpenSSH升级版本到最新(8.4)

Ubuntu 16.04 升级OpenSSH至7.9p1

网友评论

延伸阅读

深度阅读

栏目导航

热点阅读