在對(duì)操作系統(tǒng)進(jìn)行定期漏洞掃描的過(guò)程中，碰到了openssh的高位漏洞問(wèn)題，遂更新openssh批销，更新版本openssh-9.8p1洒闸。在查閱過(guò)程當(dāng)中，也碰到了不少棘手的問(wèn)題均芽，遂寫此篇記錄之丘逸。
一、安裝telent
為了防止openssh安裝失敗掀宋，導(dǎo)致服務(wù)器遠(yuǎn)程無(wú)法連接的問(wèn)題深纲，首先安裝telent。
1.查看selinux的狀態(tài)布朦，必須為關(guān)閉狀態(tài)
getenforce
2.查看防火墻的狀態(tài)囤萤，必須為關(guān)閉狀態(tài)
systemctl status firewalld
systemctl stop firewalld
3.安裝telnet
yum install -y telnet
yum install -y telnet-server
4.重啟服務(wù)
systemctl enable telnet.socket
systemctl start telnet.socket
5.檢測(cè)端口
netstat -lntp|grep 23
測(cè)試登錄：
telnet 127.0.0.1
6.切換到telnet方式登錄，以后的操作都在telnet終端下操作是趴，防止ssh連接意外中斷造成升級(jí)失敗
二涛舍、在線安裝openssh
1.卸載舊版本的ssh
rpm -aq openssh
rpm -e --nodeps openssh-8.7p1-43.el9.x86_64
2.在線安裝openssh
安裝編譯依賴
dnf install openssl-devel zlib-devel gcc gcc-c++ make autoconf pam-devel -y
cd /usr/local/src
下載源碼
wget https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-9.8p1.tar.gz
解壓
tar -zvxf openssh-9.8p1.tar.gz
cd openssh-9.8p1
編譯
./configure --prefix=/usr --sysconfdir=/etc/ssh --with-pam --with-ssl-dir=/usr/lib64/openssl --with-zlib
make -j $(nproc)
3.安裝之前需要注釋部分不支持的算法
echo "CRYPTO_POLICY=" >> /etc/sysconfig/sshd
sed -i 's/^GSSAPIKexAlgorithms/#&/' /etc/crypto-policies/back-ends/openssh.config
sed -i 's/^GSSAPIKexAlgorithms/#&/' /etc/crypto-policies/back-ends/opensshserver.config
sed -i 's/^GSSAPIAuthentication/#&/' /etc/ssh/sshd_config.d/50-redhat.conf
sed -i 's/^GSSAPICleanupCredentials/#&/' /etc/ssh/sshd_config.d/50-redhat.conf
4.修改文件權(quán)限
chmod 0600 /etc/ssh/ssh_host_rsa_key
chmod 0600 /etc/ssh/ssh_host_ecdsa_key
chmod 0600 /etc/ssh/ssh_host_ed25519_key
5.安裝
make install
6.重啟
systemctl restart sshd
三、關(guān)閉telnet
systemctl disable telnet.socket
systemctl stop telnet.socket
