問題描述：OpenSSH 用戶枚舉漏洞(CVE-2018-15473)【原理掃描】
? ? ? ? ? ? ? ? ? OpenSSH do_setup_env函數(shù)權(quán)限提升漏洞(CVE-2015-8325)
? ? ? ? ? ? ? ? ?OpenSSH auth_password函數(shù)拒絕服務(wù)漏洞(CVE-2016-6515)
? ? ? ? ? ? ? ? ? OpenSSH多個(gè)拒絕服務(wù)漏洞（CVE-2016-10708）
? ? ? ? ? ? ? ? ? OpenSSH 安全限制繞過漏洞(CVE-2016-10012)
? ? ? ? ? ? ? ? ? OpenSSH 遠(yuǎn)程代碼執(zhí)行漏洞(CVE-2016-10009)
? ? ? ? ? ? ? ? ? OpenSSH 安全漏洞(CVE-2016-1908)
解決方案：OpenSSH升級版本到最新(8.7)版本
具體操作：
1苛聘、依賴軟件包：
yum install wget gcc -y
yum install -y zlib-devel openssl-devel
yum install pam-devel libselinux-devel zlib-devel openssl-devel -y
2、下載安裝包OpenSSH8.7上傳至服務(wù)器或wget直接下載
wget https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-8.7p1.tar.gz
3忠聚、刪除低版本OpenSSH的的rpm包
rpm -e --nodeps `rpm -qa | grep openssh`
4设哗、安裝openssh
解壓
tar -zxvf openssh-8.7p1.tar.gz
cd ?openssh-8.7p1
?./configure ??--prefix=/usr ??--sysconfdir=/etc/ssh ???--with-md5-passwords ??--with-pam --with-zlib ??--with-tcp-wrappers ???--with-ssl-dir=/usr/local/ssl ??--without-hardening
編譯安裝
Make
make install
賦權(quán)
chmod 600 /etc/ssh/ssh_host_rsa_key /etc/ssh/ssh_host_ecdsa_key /etc/ssh/ssh_host_ed25519_key
復(fù)制配置文件并設(shè)置允許root用戶遠(yuǎn)程登錄
cp -a contrib/redhat/sshd.init ?/etc/init.d/sshd
cp -a contrib/redhat/sshd.pam /etc/pam.d/sshd.pam
chmod u+x /etc/init.d/sshd
vim /etc/ssh/sshd_config
1.修改#PermitRootLogin prohibit-password項(xiàng)，去掉注釋#并把prohibit-password改為yes咒林，修改后即為PermitRootLogin yes
2.去掉注釋#PasswordAuthentication yes變?yōu)镻asswordAuthentication yes
添加添加自啟服務(wù)ssh到開機(jī)啟動項(xiàng)
chkconfig --add sshdchkconfig sshd on
重啟服務(wù)
systemctl restart sshd
查看下安裝結(jié)果：
ssh -V
注意：高版本升級會導(dǎo)致xshell或者xftp登陸報(bào)錯(cuò)
第一步檢查/etc/ssh/sshd_config文件中配置
PermitRootLogin yes
PubkeyAuthentication yes
PasswordAuthentication yes
第二步檢查是否開啟防火墻
setenforce 0
第三步檢查/etc/pam.d/sshd文件是否存在
/etc/pam.d/sshd文件必須存在熬拒，不存在就無法通過驗(yàn)證
centos7下的/etc/pam.d/sshd文件內(nèi)容：
#%PAM-1.0
auth ??????required ????pam_sepermit.so
auth ??????substack ????password-auth
auth ??????include ?????postlogin
# Used with polkit to reauthorize users in remote sessions
-auth ?????optional ????pam_reauthorize.so prepare
account ???required ????pam_nologin.so
account ???include ?????password-auth
password ??include ?????password-auth
# pam_selinux.so close should be the first session rule
session ???required ????pam_selinux.so close
session ???required ????pam_loginuid.so
# pam_selinux.so open should only be followed by sessions to be executed in the user context
session ???required ????pam_selinux.so open env_params
session ???required ????pam_namespace.so
session ???optional ????pam_keyinit.so force revoke
session ???include ?????password-auth
session ???include ?????postlogin
# Used with polkit to reauthorize users in remote sessions
-session ??optional ????pam_reauthorize.so prepare
（再重啟sshd服務(wù)systemctl restart sshd）
