1:简介

最近浙江电信对线上服务器进行漏洞扫描,暴露出原有的openssh有漏洞,建议升级openssh版本;
2:操作环境
Red Hat Enterprise Linux Server release 6.4
3:所需软件包
(1)gcc zlib zlib-devel make pam pam-devel  (升级过程中所需依赖包)
(2)dropbear-2014.66.tar.bz2(代替原有用pm包安装openssh环境)
(3)openssh-6.7.tar.gz(升级的软件包)
4:操作过程
(1)安装dropbear包代替openssh
[root@localhost ~]#tar -xvf dropbear-2014.66.tar.bz2 
[root@localhost ~]# cd dropbear-2014.66
[root@localhost dropbear-2014.66]#./configure --prefix=/usr/local/dropbear
[root@localhost dropbear-2014.66]# make
[root@localhost dropbear-2014.66]#make install
[root@localhost ~]# mkdir /etc/dropbear
[root@localhost ~]#/usr/local/dropbear/bin/dropbearkey -t rsa -s 2048 -f /etc/dropbear/dropbear_rsa_host_key
Generating key, this may take a while...
Public key portion is:
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCCBQJeoEhvNKkoEO3Y43++TOJl6dneodImEqnfyrfeFpjPQatYH5aQTxghO71KptR5pWYitdRarUcBJGw1fKsfhpwa6is6n6/YyQ2VljqFV+2caHSM3MxmPUHx+A6fzBbvw8u9kDFBz22xXKKSeNpmUyzqvXw8xxt2iu24kkvUYfGfxcHUyauFyiwEDBtz3JbfxlNpTO7eggMi0FT1Q8ndpgf2rg1FbflPweYjjuEtJwqEP6z0CHBsK5/KOAeanlhrkGiJ7EtyP19JxLinNWQeenknERA9IOWox928BjE3ZQ8Fa3JqAQg/w9jNNaugTgxedeLxn897DQBe9lgaatwR root@localhost.localdomain
Fingerprint: md5 dd:75:10:cf:a0:0f:19:96:bd:49:69:05:ab:d6:d6:51
[root@localhost ~]# /usr/local/dropbear/sbin/dropbear -p 1213
[root@localhost ~]# netstat -tunlp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address               Foreign Address             State       PID/Program name  
tcp        0      0 0.0.0.0:111                 0.0.0.0:*                   LISTEN      809/rpcbind        
tcp        0      0 192.168.122.1:53            0.0.0.0:*                   LISTEN      1281/dnsmasq       
tcp        0      0 0.0.0.0:22                  0.0.0.0:*                   LISTEN      1651/sshd          
tcp        0      0 127.0.0.1:25                0.0.0.0:*                   LISTEN      1123/master        
tcp        0      0 0.0.0.0:1213                0.0.0.0:*                   LISTEN      8037/dropbear      
tcp        0      0 0.0.0.0:40328               0.0.0.0:*                   LISTEN      827/rpc.statd      
tcp        0      0 :::111                      :::*                        LISTEN      809/rpcbind        
tcp        0      0 :::59889                    :::*                        LISTEN      827/rpc.statd      
tcp        0      0 :::22                       :::*                        LISTEN      1651/sshd          
tcp        0      0 ::1:25                      :::*                        LISTEN      1123/master        
tcp        0      0 :::1213                     :::*                        LISTEN      8037/dropbear      
tcp        0      0 :::3306                     :::*                        LISTEN      14315/mysqld       
udp        0      0 0.0.0.0:1003                0.0.0.0:*                               827/rpc.statd      
udp        0      0 0.0.0.0:111                 0.0.0.0:*                               809/rpcbind        
udp        0      0 0.0.0.0:38790               0.0.0.0:*                               827/rpc.statd      
udp        0      0 192.168.122.1:53            0.0.0.0:*                               1281/dnsmasq       
udp        0      0 0.0.0.0:67                  0.0.0.0:*                               1281/dnsmasq       
udp        0      0 0.0.0.0:984                 0.0.0.0:*                               809/rpcbind        
udp        0      0 :::111                      :::*                                    809/rpcbind        
udp        0      0 :::40854                    :::*                                    827/rpc.statd      
udp        0      0 :::984                      :::*                                    809/rpcbind    
注:以上操作,已经做到替代原有的openssh软件,还需要注意的是关闭防火墙;或者放行1213端口,该端口是我们任意指定;
5:dropbear环境测试
操作方法:
登陆别的主机对该主机进行ssh登陆
[root@localhost ~]# ssh -p1213 192.168.10.120
The authenticity of host '192.168.10.120 (192.168.10.120)' can't be established.
RSA key fingerprint is 46:de:1b:14:42:5d:83:56:d6:29:15:13:c2:b2:d6:05.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.10.120' (RSA) to the list of known hosts.
root@192.168.10.120's password:
Last login: Tue Feb  3 10:18:15 2015 from 192.168.10.130
说明:测试主机地址:192.168.10.130,升级主机地址:192.168.10.120
6:升级openssh
(1)操作步骤
[root@localhost ~]# mv /etc/ssh /etc/ssh.bak
[root@localhost ~]# rpm -qa |grep openssh
openssh-server-5.3p1-84.1.el6.x86_64
openssh-5.3p1-84.1.el6.x86_64
openssh-clients-5.3p1-84.1.el6.x86_64
[root@localhost ~]# rpm -e --nodeps `rpm -qa |grep openssh`
[root@localhost ~]# tar -xvf openssh-6.7p1.tar.gz
[root@localhost openssh-6.7p1]# ./configure --prefix=/usr --sysconfdir=/etc/ssh --with-pam --with-zlib --with-md5-passwords
[root@localhost openssh-6.7p1]#make
[root@localhost openssh-6.7p1]#make install
[root@localhost ~]# /usr/sbin/sshd -t -f /etc/ssh/sshd_config
[root@localhost openssh-6.7p1]# ssh -V
OpenSSH_6.7p1, OpenSSL 1.0.0-fips 29 Mar 2010
[root@localhost openssh-6.7p1]# cp contrib/redhat/sshd.init /etc/init.d/sshd
[root@localhost openssh-6.7p1]# /etc/init.d/sshd start
[root@localhost ~]# killall dropbear
[root@localhost ~]# netstat -tunlp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address               Foreign Address             State       PID/Program name  
tcp        0      0 0.0.0.0:111                 0.0.0.0:*                   LISTEN      809/rpcbind        
tcp        0      0 192.168.122.1:53            0.0.0.0:*                   LISTEN      1281/dnsmasq       
tcp        0      0 0.0.0.0:22                  0.0.0.0:*                   LISTEN      20720/sshd         
tcp        0      0 127.0.0.1:25                0.0.0.0:*                   LISTEN      1123/master        
tcp        0      0 0.0.0.0:40328               0.0.0.0:*                   LISTEN      827/rpc.statd      
tcp        0      0 :::111                      :::*                        LISTEN      809/rpcbind        
tcp        0      0 :::59889                    :::*                        LISTEN      827/rpc.statd      
tcp        0      0 :::22                       :::*                        LISTEN      20720/sshd         
tcp        0      0 ::1:25                      :::*                        LISTEN      1123/master        
tcp        0      0 :::3306                     :::*                        LISTEN      14315/mysqld       
udp        0      0 0.0.0.0:1003                0.0.0.0:*                               827/rpc.statd      
udp        0      0 0.0.0.0:111                 0.0.0.0:*                               809/rpcbind        
udp        0      0 0.0.0.0:38790               0.0.0.0:*                               827/rpc.statd      
udp        0      0 192.168.122.1:53            0.0.0.0:*                               1281/dnsmasq       
udp        0      0 0.0.0.0:67                  0.0.0.0:*                               1281/dnsmasq       
udp        0      0 0.0.0.0:984                 0.0.0.0:*                               809/rpcbind        
udp        0      0 :::111                      :::*                                    809/rpcbind        
udp        0      0 :::40854                    :::*                                    827/rpc.statd      
udp        0      0 :::984                      :::*                                    809/rpcbind        
[root@localhost openssh-6.7p1]# /etc/init.d/sshd start
/sbin/restorecon:  lstat(/etc/ssh/ssh_host_ecdsa_key.pub) failed:  No such file or directory
Starting sshd:[  OK  ]
[root@localhost openssh-6.7p1]# service sshd start
/sbin/restorecon:  lstat(/etc/ssh/ssh_host_ecdsa_key.pub) failed:  No such file or directory
Starting sshd:[  OK  ]
[root@localhost openssh-6.7p1]# service sshd status
sshd (pid  20720) is running...
[root@localhost openssh-6.7p1]# chkconfig --add sshd
[root@localhost openssh-6.7p1]# chkconfig --list sshd
sshd            0:off   1:off   2:on    3:on    4:on    5:on    6:off
7:考虑到主机之前使用ssh互信,升级完成后原来生成的公钥将会失效,需要采用升级包中的工具重新生成公钥,操作步骤如下:
7.1:生成公私秘钥
[root@oracle openssh-7.1p1]#pwd
/root/openssh-7.1p1
[root@oracle openssh-7.1p1]#./ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:2ErdCAuGntgVI7+Xx76hDrer1obSRVuoEznksksTDJk root@oracle
The key's randomart image is:
+---[RSA 2048]----+
| o. o            |
|E  +.o           |
| o.o=...         |
| +++=ooO.o       |
|. ++.=*oS .      |
|  + ooo+         |
| . +.=o o        |
|  o +ooo o       |
|   o.+=..        |
+----[SHA256]-----+
注:执行这个命令的时候,不需要填写任何的东西,“Enter”就好,完成以后会在“/root/.ssh”目录下生成两个文件id_rsa,id_rsa.pub;
7.2:生成“authorized_keys”文件;
[root@oracle .ssh]#cat id_rsa.pub >> authorized_keys
注:需要互通的主机之间,都想要对方的公钥,相互拷入即可;
7.3:重启sshd服务
service sshd restart
希望渎者多提意见,
联系方式QQ:1486483698
QQ交流群:431392633

redhat6.4升级openssh至6.7的更多相关文章

  1. 升级OpenSSH详细步骤

    由于系统扫描到OpenSSH版本太低,所以需要将其升级到高版本.网上搜罗数个文章,都多多少少有点疏漏.加上自己之前没升级过SSH,参考好几个文章查缺补漏才升级成功,着实废了不少劲儿.所以综合一下前辈们 ...

  2. centos升级openssh的两种方式

    此文介绍的是服务器在有网络和无网络情况下升级openssh方式. 一.首先介绍一个无网络如何升级: 1.准备相关的包 openssh下载地址:  http://mirror.internode.on. ...

  3. CentOS 6.9 升级OpenSSH版本 关闭ssh服务后门

    最近用低版本的OpenSSH(5.9p1版本) 的漏洞给系统留了个后门 , 可以劫持root密码或者给root开启后门密码 : 利用Openssh后门 劫持root密码 如果公司还在用CentOS6的 ...

  4. linux升级openssh到7.9

    客户linux主机ssh存在高危漏洞,需要进行升级修复. linux联网后,直接命令行: [root@gw ~]# yum update openssl -y 此命令只是小版本的升级,比如将opens ...

  5. centos升级openssh版本

    似乎升级就是简单的安装ssh包就行了,没进行其他修改,虚拟机24个中高低漏洞解决 安装最新包: 1.下载:https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/por ...

  6. 升级OPENSSH 和 OPENSSL

    升级OPENSSH 和 OPENSSL   首先安装telnet服务,防止在操作过程中导致ssh远程中断   # 安装Telnetyum install telnet-server -y chkcon ...

  7. Centos6.5升级openssh至7.4版本

    一,备份配置文件,以备升级失败进行回退 二,下载安装包 wget http://www.zlib.net/zlib-1.2.11.tar.gz wget https://openbsd.mirror. ...

  8. CentOS 升级 openSSH

    openSSH作为linux远程连接工具,容易受到攻击,必须更新版本来解决,低版本有如下等漏洞: a. OpenSSH 远程代码执行漏洞(CVE-2016-10009) b.  OpenSSH aut ...

  9. redhat linux6.5升级openssh

    1.下载最新的openssh包 http://www.openssh.com/portable.html#http 2.升级openssh之前要先打开服务器telnet,通过telnet登录服务器,因 ...

随机推荐

  1. Kafka源码中的Producer Record定义

    1.ProducerRecord 含义: 发送给Kafka Broker的key/value 值对 2.内部数据结构: -- Topic (名字) -- PartitionID ( 可选) -- Ke ...

  2. [转载]mysql的binlog安全删除

    [转载]mysql的binlog安全删除  理论上,应该在配置文件/etc/my.cnf中加上binlog过期时间的配置项,expire_logs_days = 10 但是如果没有加这一项,随着产生越 ...

  3. You must SET PASSWORD before executing this statement解决

    [转载] MySql5.6操作时报错:You must SET PASSWORD before executing this statement解决 转载: http://blog.csdn.net/ ...

  4. Need to add a caption to a jpg, python can't find the image

    importImage,ImageDraw,ImageFont, os, glob list = glob.glob('*.jpg')for infile in list:print infile f ...

  5. IOS中bounds和frame

    * 用bounds和frame来修改尺寸是有一些小区别的 三.isEqual:方法 1> 系统会根据对象isEqual方法的返回值来决定两个对象是否相同 * 比如判断对象a和b是否相同,就会查看 ...

  6. HDU 5353 Average 糖果分配(模拟,图)

    题意:有n个人坐在圆桌上,每个人带着糖果若干,每次只能给旁边的人1科糖果,而且坐相邻的两个人最多只能给一次(要么你给我,要么我给你),问是否能将糖果平均分了. 思路: 明显每个人最多只能多于平均值2个 ...

  7. C的输入输出函数的基本用法

    printf输出函数: printf()函数是格式化输出函数, 一般用于向标准输出设备按规定格式输出信息. printf()函数的调用格式为: printf("<格式化字符串>& ...

  8. 【英语】Bingo口语笔记(47) - 关于马的表达

    beat a dead horse 浪费口舌

  9. python的subprocess无法进行通信(无法通过管道输入数据)的问题解决

    1.在主进程使用 p.stdin.write("something\n") 要有回车!要有回车!要有回车! 2.在子进程使用 data = raw_input() 读取数据,再用 ...

  10. mysql Access denied for user \'root\'@\'localhost\'”解决办法总结,下面我们对常见的出现的一些错误代码进行分析并给出解决办法,有需要的朋友可参考一下。

    mysql Access denied for user \'root\'@\'localhost\'”解决办法总结,下面我们对常见的出现的一些错误代码进行分析并给出解决办法,有需要的朋友可参考一下. ...