概述

之前因为漏洞问题，做安全加固的时候参考了百度的一些教程，里面有些地方很坑，写的乱七八糟，导致升级失败了，所以今天才抽空测试了下下面3种方式，都是没什么问题的，整理一下分享给大家。

下面实验是基于redhat6.8 64位系统做测试（7的版本有比较多注意的点，后面有空再整）

这里提供3个方式：1个是rpm包手动升级，一个是rpm包脚本升级，一个是脚本yum一键升级。（这里的rpm包只需要在openssh升级成功后的系统制作rpm包就可以了，篇幅有限，就不介绍这块了）

rpm包升级（手动）

1、查看当前openssh版本

2、备份

[root@localhost ~]# cp /etc/pam.d/sshd /etc/pam.d/sshd_bak181225[root@localhost ~]# cp /etc/ssh/sshd_config /etc/ssh/sshd_config_bak181225[root@localhost ~]# cp /etc/init.d/sshd /etc/init.d/sshd_bak1812

3、执行rpm包

根据rpm -qa|grep openssh找对应的rpm包

# rpm -Uvh openssh-askpass-7.9p1-1.el6.x86_64.rpm openssh-clients-7.9p1-1.el6.x86_64.rpm openssh-7.9p1-1.el6.x86_64.rpm openssh-server-7.9p1-1.el6.x86_64.rpm

4、配置允许root登录

sed -i 's/#PermitRootLogin yes/PermitRootLogin yes/g' /etc/ssh/sshd_config

5、改权限

# chmod 600 /etc/ssh/ssh_host_ed25519_key

6、恢复 pam sshd config

cp /etc/pam.d/sshd_bak181225 /etc/pam.d/sshd

7、安装 ssh-copy-id

（ssh-copy-id 将本机的公钥复制到远程机器的authorized_keys文件中，ssh-copy-id也能让你有到远程机器的home, ~./ssh , 和 ~/.ssh/authorized_keys的权利）

install -v -m755 ssh-copy-id /usr/bin

install -v -m644 ssh-copy-id.1 /usr/share/man/man1

8、重启ssh服务

/etc/init.d/sshd restart

9、测试是否升级成功

ssh -V

rpm包脚本一键升级

根据前面的步骤简单整理如下：

PS：这里测试的时候漏了一步，应该先断开连接再重连测试下的，懒得恢复快照测试了，有空的朋友可以帮忙测试下，这里查看版本已经升级成功了。

#!/bin/bash# update openssh to 7.9 on centos6.x or rhel 6.x# 前提条件：需要跟rpm包同个目录 # 1、backup pam sshd configcp -fp /etc/pam.d/sshd /tmp/sshd_bak# 2、rpm installrpm -Uvh openssh-askpass-7.9p1-1.el6.x86_64.rpm openssh-clients-7.9p1-1.el6.x86_64.rpm openssh-7.9p1-1.el6.x86_64.rpm openssh-server-7.9p1-1.el6.x86_64.rpm# 2、config root ssh to server# vi /etc/ssh/sshd_config# PermitRootLogin yessed -i 's/#PermitRootLogin yes/PermitRootLogin yes/g' /etc/ssh/sshd_config# 3、change permitchmod 600 /etc/ssh/ssh_host_ed25519_key# 4、restore pam sshd configcp -fp /tmp/sshd_bak /etc/pam.d/sshd# 5、install ssh-copy-idinstall -v -m755 ssh-copy-id /usr/bininstall -v -m644 ssh-copy-id.1 /usr/share/man/man1# 6、restart sshd service/etc/init.d/sshd restart#7、test ssh versionssh -V

前提条件：配置好yum源，openssh-7.9p1.tar.gz安装包跟脚本同一层目录就可以了

#!/bin/bash#前提条件：配置好yum源if [ $UID -ne 0 ];then echo "please run this script as root !" exit 1fi#安装依赖包yum -y install gcc gcc-c++ pam-devel zlib-devel xinetd openssl-develsleep 2#备份原sshtoday=$(date +%Y%m%d)mkdir /tmp/$todaycp -a /etc/ssh /tmp/$todaycp -a /etc/rc.d/init.d/sshd /tmp/$today/sshd_initcp -a /etc/pam.d/ssh-keycat /tmp/$todaycp -a /etc/pam.d/sshd /tmp/$today/sshd_pamcp -a /etc/sysconfig/sshd /tmp/$today/sshd_configure#配置telnet登陆start_telnet (){cat >>/etc/securetty<<EOFpts/0pts/1pts/2EOF#sed -i 's/yes/no/g' /etc/xinetd.d/telnetyum install -y telnet-serversed -i '/disable/s/yes/no/g' /etc/xinetd.d/telnet/etc/init.d/xinetd restart}#卸载旧版本openssh/etc/init.d/sshd stoprpm -e --nodeps openssh openssh-server openssh-clients#rpm -e --nodeps openssh-askpass#rpm -qa |grep openssh|xargs -i rpm -e --nodeps {}#安装openssh7.9echo "start update openssh . . . "sleep 2tar xf openssh-7.9p1.tar.gzcd openssh-7.9p1./configure --prefix=/usr \ --sysconfdir=/etc/ssh \ --with-md5-passwords \ --with-pam \ --with-zlib \ --with-openssl-includes=/usr \ --with-privsep-path=/var/empty/sshdmake && make installsleep 2install -v -m755 contrib/ssh-copy-id /usr/bininstall -v -m644 contrib/ssh-copy-id.1 /usr/share/man/man1install -v -m755 -d /usr/share/doc/openssh-7.9p1install -v -m644 INSTALL LICENCE OVERVIEW README* /usr/share/doc/openssh-7.9p1#配置sshcp -p contrib/redhat/sshd.init /etc/rc.d/init.d/sshdcp -p /tmp/$today/sshd_pam /etc/pam.d/sshdcp -p /tmp/$today/ssh-keycat /etc/pam.dchkconfig --add sshdsed -i '33 aPermitRootLogin yes' /etc/ssh/sshd_configsed -i '83 aUsePAM yes' /etc/ssh/sshd_configclear/etc/init.d/sshd startsleep 1if [ $(pgrep sshd |wc -l) -eq 0 ];then start_telnet echo -e "\033[31m failed to start ssh,please use telnet to connetion . . . \033[0m"else# sed -i '/pts/d' /etc/securetty echo "openssh success update to 7.9p1 ! "fi

以上是小编花了几个小时测试后整理的，觉得还行的帮忙点个赞哩~

后面会分享更多devops和DBA方面的内容，感兴趣的朋友可以关注下！！