首页 > 代码库 > OpenSSH由5.3升级到7.3pl
OpenSSH由5.3升级到7.3pl
第一步 准备升级包
openssh相关包
openssh-7.3p1.tar.gz
openssl-1.0.2j.tar.gz
zlib-1.2.8.tar.gz
telnet相关包
telnet-0.17-47.el6_3.1.x86_64.rpm
telnet-server-0.17-47.el6_3.1.x86_64.rpm
xinetd-2.3.14-39.el6_4.x86_64.rpm
远程操作选择telnet;
第二步 安装工具包
telnet安装
[root@localhost telnet]# rpm -ivh xinetd-2.3.14-39.el6_4.x86_64.rpm warning: xinetd-2.3.14-39.el6_4.x86_64.rpm: Header V3 RSA/SHA256 Signature, key I D fd431d51: NOKEYPreparing... ########################################### [100%] 1:xinetd ########################################### [100%] [root@localhost telnet]# rpm -ivh telnet-0.17-47.el6_3.1.x86_64.rpm warning: telnet-0.17-47.el6_3.1.x86_64.rpm: Header V3 RSA/SHA256 Signature, key I D fd431d51: NOKEYPreparing... ########################################### [100%] 1:telnet ########################################### [100%] [root@localhost telnet]# rpm -ivh telnet-server-0.17-47.el6_3.1.x86_64.rpm warning: telnet-server-0.17-47.el6_3.1.x86_64.rpm: Header V3 RSA/SHA256 Signature , key ID fd431d51: NOKEYPreparing... ########################################### [100%] 1:telnet-server ########################################### [100%]##设置telnet远程登录[root@localhost telnet]# vi /etc/xinetd.d/telnet# default: on# description: The telnet server serves telnet sessions; it uses \# unencrypted username/password pairs for authentication.service telnet { flags = REUSE socket_type = stream wait = no user = root server = /usr/sbin/in.telnetd log_on_failure += USERID disable = no} [root@localhost telnet]# service xinetd restart##添加telnet远程登录用户,(远程root不登录)[root@localhost telnet]# useradd test [root@localhost telnet]# passwd test
第三步 编译安装
删除已安装包
[root@localhost ssh]# rpm -qa|grep openssh openssh-askpass-5.3p1-84.1.el6.x86_64 openssh-clients-5.3p1-84.1.el6.x86_64 openssh-5.3p1-84.1.el6.x86_64 openssh-server-5.3p1-84.1.el6.x86_64 [root@localhost ssh]# rpm -e openssh-askpass-5.3p1-84.1.el6.x86_64 [root@localhost ssh]# rpm -e openssh-clients-5.3p1-84.1.el6.x86_64 --nodeps [root@localhost ssh]# rpm -e openssh-5.3p1-84.1.el6.x86_64 --nodeps [root@localhost ssh]# rpm -e openssh-server-5.3p1-84.1.el6.x86_64
编译安装
[root@localhost ssh]# tar -zxvf zlib-1.2.8.tar.gz [root@localhost ssh]# cd zlib-1.2.8 [root@localhost zlib-1.2.8]# ./configure [root@localhost zlib-1.2.8]# make && make install [root@localhost zlib-1.2.8]# cd .. [root@localhost ssh]# tar -zxvf openssl-1.0.2j.tar.gz [root@localhost ssh]# cd openssl-1.0.2j [root@localhost openssl-1.0.2j]# ./config --prefix=/usr/ --shared [root@localhost openssl-1.0.2j]# make [root@localhost openssl-1.0.2j]# make test [root@localhost openssl-1.0.2j]# make install [root@localhost openssl-1.0.2j]# cd .. [root@localhost ssh]# tar -zxvf openssh-7.3p1.tar.gz [root@localhost ssh]# cd openssh-7.3p1 [root@localhost openssh-7.3p1]# mv /etc/ssh /etc/ssh_bak [root@localhost openssh-7.3p1]# ./configure --prefix=/usr --sysconfdir=/etc/ssh --with-zlib --with-md5-passwords [root@localhost openssh-7.3p1]# make [root@localhost openssh-7.3p1]# make install [root@localhost openssh-7.3p1]# cd contrib/redhat#复制启动脚本[root@localhost redhat]# cp sshd.init /etc/init.d/sshd [root@localhost redhat]# cd /etc/init.d/ [root@localhost redhat]# chmod +x /etc/init.d/sshd [root@localhost init.d]# chkconfig sshd [root@localhost init.d]# chkconfig --add sshd [root@localhost redhat]# cd ..#生成登录密钥[root@localhost openssh-7.3p1]# pwd /mywork/soft/ssh/openssh-7.3p1 [root@localhost openssh-7.3p1]# ./ssh-keygen [root@localhost openssh-7.3p1]# cd /root/.ssh/ [root@localhost .ssh]# ls id_rsa id_rsa.pub [root@localhost .ssh]# cat id_rsa.pub >> authorized_keys [root@localhost .ssh]# service sshd restart Stopping sshd: [ OK ] Starting sshd: [ OK ] [root@localhost ~]# ssh -V OpenSSH_7.3p1, OpenSSL 1.0.2j 26 Sep 2016
第四步 所遇问题
安装完毕后root用户无法ssh登录
由于新版本的ssh禁用了root用户登录,需将允许登录开启[root@localhost ssh]# pwd /etc/ssh#设置允许root用户远程登录[root@localhost ssh]# cat /etc/ssh/sshd_config # Authentication:...#LoginGraceTime 2mPermitRootLogin yes
启动报错
报错效果如下:[root@ssh ~]# service sshd restart Stopping sshd: [ OK ] /sbin/restorecon: lstat(/etc/ssh/ssh_host_key.pub) failed: No such file or dire ctoryStarting sshd: [ OK ] [确定]只要touch该文件即可规避
[root@ssh ~]# touch /etc/ssh/ssh_host_ecdsa_key.pub再重启一下ssh服务,就没有那个报错了
[root@localhost .ssh]# service sshd restart Stopping sshd: [ OK ] Starting sshd: [ OK ]
SecureCRT不能上传文件的解决办法
#将 /etc/ssh/sshd_config 中的Subsystem sftp /usr/libexec/openssh/sftp-server #改为Subsystem sftp internal-sftp#重启sshd后,sftp正常工作了
使用其他工具无法远程连接操作系统
解决方法: =================================================================参考网上解决方法如下: 修改sshd的配置文件 /etc/ssh/sshd_config 在配置文件中添加: Ciphers aes128-cbc,aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr,3des-cbc,arcfour128,arcfour256,arcfour,blowfish-cbc,cast128-cbc MACs hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160,hmac-sha1-96,hmac-md5-96 KexAlgorithms diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,curve25519-sha256@libssh.org 导致此问题的原因是ssh升级后,为了安全,默认不再采用原来一些加密算法,我们手工添加进去即可。 (添加三行或者添加最后一行,重启服务都报错如下) 但重启服务报错如下: [root@db ~]# service sshd restart Stopping sshd:[ OK ] Starting sshd:Unsupported KEX algorithm "ecdh-sha2-nistp521" /etc/ssh/sshd_config line 137: Bad SSH2 KexAlgorithms ‘diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,curve25519-sha256@libssh.org‘. [FAILED] [root@db ~]# ================================================================= 修改为如下: Ciphers aes128-cbc,aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr,3des-cbc,arcfour128,arcfour256,arcfour,blowfish-cbc,cast128-cbc MACs hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160,hmac-sha1-96,hmac-md5-96 KexAlgorithms diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,ecdh-sha2-nistp256,ecdh-sha2-nistp384,diffie-hellman-group1-sha1,curve25519-sha256@libssh.org (此行中去掉ecdh-sha2-nistp521)
重启后登录不上SSH
升级完ssh以后,服务器在重启之后用ssh登录不上,只有telnet上去重新启动一下ssh才行。
解决办法 :vi /etc/selinux/config---SELINUX=disabled关闭SELINUX即可;
本文出自 “GencyaWang” 博客,请务必保留此出处http://gencya.blog.51cto.com/1845309/1876352
OpenSSH由5.3升级到7.3pl
声明:以上内容来自用户投稿及互联网公开渠道收集整理发布,本网站不拥有所有权,未作人工编辑处理,也不承担相关法律责任,若内容有误或涉及侵权可进行投诉: 投诉/举报 工作人员会在5个工作日内联系你,一经查实,本站将立刻删除涉嫌侵权内容。