Centos7.x升級(jí)Openssl

1.先確認(rèn)openssl版本

[root@zuozuo ~]# openssl version
OpenSSL 1.0.2k-fips 26 Jan 2017

2更新安裝依賴包

[root@zuozuo ~]# yum install -y gcc gcc-c++ glibc make autoconf openssl openssl-devel pcre-devel pam-devel

3更新openssl（注意每一步不要有報(bào)錯(cuò)，有報(bào)錯(cuò)就不要繼續(xù)了，尤其是make的操作）

wget https://www.openssl.org/source/openssl-1.1.1k.tar.gz
tar xvf openssl-1.1.1k.tar.gz
cd openssl-1.1.1k
./config --prefix=/opt/openssl shared zlib
make
make install
mv -f /usr/bin/openssl /usr/bin/openssl.OFF
mv -f /usr/include/openssl /usr/include/openssl.OFF
ln -s /opt/openssl/bin/openssl  /usr/bin/openssl
ln -s /opt/openssl/include/openssl /usr/include/openssl
echo '/opt/openssl/lib >> /etc/ld.so.conf

ldconfig -v 
ldconfig

4查看版本號(hào)

[root@zuozuo ~]#  openssl version
OpenSSL 1.1.1k 25 Mar 2021

====================================================================================

Centos7.x升級(jí)Openssh

1查看版本號(hào)

[root@zuozuo ~]# rpm -qa|grep openssh
openssh-clients-7.4p1-21.el7.x86_64
openssh-7.4p1-21.el7.x86_64
openssh-server-7.4p1-21.el7.x86_64

2.安裝openssh依賴包

[root@zuozuo ~]# yum -y install openssl openssl-devel zlib-devel pam-devel tcp_wrappers tcp_wrappers-devel gcc gcc-c++ make automake autoconf libtool

3.下載openssh軟件包安裝（注意不要有報(bào)錯(cuò)，有報(bào)錯(cuò)就不要繼續(xù)了，尤其是make的操作）
----configure那個(gè)部分要根據(jù)您的實(shí)際情況修改（openssl dir）

[root@zuozuo ~]# wget https://openbsd.hk/pub/OpenBSD/OpenSSH/portable/openssh-8.6p1.tar.gz
[root@zuozuo ~]# tar xvf openssh-8.6p1.tar.gz
[root@zuozuo ~]# cd openssh-8.6p1
[root@zuozuo ~]# ./configure --prefix=/usr --sysconfdir=/etc/ssh --with-ssl -with-ssl-dir=/opt/openssl --with-zlib --with-md5-passwords --with-pam
[root@zuozuo ~]# make
[root@zuozuo ~]# make install
[root@zuozuo ~]# ssh -V

4.其他收尾工作
創(chuàng)建賬號(hào)（避免SSH重啟之后連不上,先創(chuàng)建一個(gè)普通用戶）

[root@www ~]# useradd useradmin
[root@www ~]# passwd useradmin

SSH權(quán)限優(yōu)化設(shè)置
chmod 600 /etc/ssh/ssh_host_ecdsa_key
chmod 600 /etc/ssh/ssh_host_rsa_key
chmod 600 /etc/ssh/ssh_host_ed25519_key
sed -i '93s/^/#/' /etc/ssh/sshd_config
sed -i '94s/^/#/' /etc/ssh/sshd_config
sed -i '123s/^/#/' /etc/ssh/sshd_config
cp -a contrib/redhat/sshd.init /etc/init.d/sshd
cp -a contrib/redhat/sshd.pam /etc/pam.d/sshd.pam
systemctl enable sshd
cp ./contrib/redhat/sshd.init /etc/init.d/sshd
chmod +x /etc/init.d/sshd
chkconfig --add sshd

ssh權(quán)限修改
sed -i '/^GSSAPICleanupCredentials/s/GSSAPICleanupCredentials yes/#GSSAPICleanupCredentials yes/' /etc/ssh/sshd_config

sed -i '/^GSSAPIAuthentication/s/GSSAPIAuthentication yes/#GSSAPIAuthentication yes/' /etc/ssh/sshd_config

sed -i '/^GSSAPIAuthentication/s/GSSAPIAuthentication no/#GSSAPIAuthentication no/' /etc/ssh/sshd_config

/etc/init.d/sshd restart
ssh -V