SuSe11以编译安装的方式升级OpenSSH、OpenSSL及依赖问题解决
OpenSSH
在鹿邑等地区,都构建了全面的区域性战略布局,加强发展的系统性、市场前瞻性、产品创新能力,以专注、极致的服务理念,为客户提供网站制作、成都网站制作 网站设计制作按需网站设计,公司网站建设,企业网站建设,成都品牌网站建设,全网营销推广,外贸网站建设,鹿邑网站建设费用合理。
OpenSSH是实现远程控制、远程加密传输数据的安全的网络连接工具,也就是为我们提供ssh服务的程序。SSH由服务端和客户端组成,服务端是一个守护进程(sshd),在后台运行并响应客户端的连接请求;客户端包含ssh(openssh-clients)、scp、slogin、sftp等应用程序。
SSH服务本身提供了一种安全加密的数据传输方式。在一些比较旧的Linux系统版本中,多数是openssh 5版本。而目前OpenSSH已更新到OpenSSH 7.X版本,修复许多存在的安全漏洞,也是较为安全的版本。OpenSSH官网:http://www.openssh.com
本文主要记录OpenSSH 7在SLES(SuSe 11)上的升级过程。
安装软件包前提准备:
openssh-7.1p1.tar.gz openssl-1.0.2h.tar.gz libopenssl-devel-1.0.2h-1.3.x86_64.rpm pam-devel-1.1.8-6.1.x86_64.rpm zlib-devel-1.2.7-2.1.2.x86_64.rpm |
系统版本:
SUSE Linux Enterprise Server 11 (x86_64)
一、安装依赖软件
1、安装必要的gcc、gcc-c++编译工具及libopenssl-devel、pam-devel、zlib-devel
hm:~ # zypper in -y gcc gcc-c++ hm:/usr/local/src # rpm -ivh libopenssl-devel-1.0.2h-1.3.x86_64.rpm --nodeps --force hm:/usr/local/src # rpm -ivh pam-devel-1.1.8-6.1.x86_64.rpm --nodeps --force hm:/usr/local/src # rpm -ivh zlib-devel-1.2.7-2.1.2.x86_64.rpm
二、安装OpenSSL
1、检查系统自带的openssl
hm:/usr/local/src # rpm -q openssl openssl-0.9.8j-0.50.1 # 由于openssl依赖的软件太多,所以在升级openssl时,不用卸载旧的版本。如果强制卸载可能导致系统不能正常运行 hm:/usr/local/src # openssl version OpenSSL 0.9.8j-fips 07 Jan 2009 # 检查openssl的目录 hm:/usr/local/src # which openssl /usr/bin/openssl # 在升级过程中将旧版的相关文件进行备份,在升级新版本后重新链接替换为新版本对应的文件目录 hm:/usr/local/src # whereis openssl openssl: /usr/bin/openssl /usr/bin/X11/openssl /usr/include/openssl /usr/share/man/man1/openssl.1ssl.gz hm:/usr/local/src # ls /etc/ssl/ certs openssl.cnf private servercerts # 备份上述文件,/usr/bin/X11/openssl为/usr/bin/openssl的软链接 hm:/usr/local/src # mkdir /home/ssl_bak hm:/usr/local/src # mv /usr/bin/openssl /home/ssl_bak/ hm:/usr/local/src # mv /etc/ssl /home/ssl_bak/etc_ssl hm:/usr/local/src # mv /usr/include/openssl /home/ssl_bak/include_openssl
2、升级openssl
# 1)安装openssl-1.0.2h.tar.gz hm:/usr/local/src # tar -zxf openssl-1.0.2h.tar.gz hm:/usr/local/src # cd openssl-1.0.2h/ hm:/usr/local/src/openssl-1.0.2h # ./config --prefix=/usr/local/openssl --openssldir=/etc/ssl shared zlib hm:/usr/local/src/openssl-1.0.2h # make hm:/usr/local/src/openssl-1.0.2h # make install # 查看安装好的/usr/local/openssl目录文件 hm:/usr/local/src/openssl-1.0.2h # ls /usr/local/openssl/{bin,include,lib} /usr/local/openssl/bin: c_rehash fips_standalone_sha1 fipsld openssl /usr/local/openssl/include: openssl /usr/local/openssl/lib: engines fips_premain.c.sha1 fipscanister.o.sha1 libcrypto.so libssl.a libssl.so.1.0.0 fips_premain.c fipscanister.o libcrypto.a libcrypto.so.1.0.0 libssl.so pkgconfig # 查看/etc/ssl目录 hm:/usr/local/src/openssl-1.0.2h # ls /etc/ssl/ certs man misc openssl.cnf private
3、配置升级后的openssl的相关目录(链接openssl程序)
hm:/usr/local/src # ln -s /usr/local/openssl/bin/openssl /usr/bin/openssl hm:/usr/local/src # ln -s /usr/local/openssl/include/openssl /usr/include/openssl hm:/usr/local/src # echo "/usr/local/openssl/lib" >> /etc/ld.so.conf hm:/usr/local/src # ldconfig # 查看升级的openssl版本 hm:/usr/local/src # openssl version OpenSSL 1.0.2h 3 May 2016
三、卸载系统原有的OpenSSH
# 停止sshd服务 hm:~ # service sshd stop Shutting down the listening SSH daemon done # 卸载openssh hm:~ # zypper rm openssh hm:~ # rpm -qa | grep openssh hm:~ # mv /etc/ssh /home/ssl_bak/
四、升级OpenSSH
hm:/usr/local/src # gzip -d openssh-7.1p1.tar.gz hm:/usr/local/src # tar xf openssh-7.1p1.tar hm:/usr/local/src # cd openssh-7.1p1/ # 编译参数 hm:/usr/local/src/openssh-7.1p1 # ./configure --prefix=/usr --sysconfdir=/etc/ssh --with-pam --with-openssl --with-md5-passwords --mandir=/usr/share/man --with-zlib --with-ssl-engine --with-ssl-dir=/usr/local/openssl hm:/usr/local/src/openssh-7.1p1 # make hm:/usr/local/src/openssh-7.1p1 # make install # 查看升级后的版本 hm:~ # ssh -V OpenSSH_7.1p1, OpenSSL 1.0.2h 3 May 2016 # 拷贝sshd启动脚本,contrib/目录下对应系统的启动脚本 hm:/usr/local/src/openssh-7.1p1 # cd contrib/ hm:/usr/local/src/openssh-7.1p1/contrib # ls Makefile aix findssl.sh gnome-ssh-askpass2.c redhat ssh-copy-id sshd.pam.freebsd suse README cygwin gnome-ssh-askpass1.c hpux solaris ssh-copy-id.1 sshd.pam.generic hm:/usr/local/src/openssh-7.1p1/contrib # cp suse/rc.sshd /etc/init.d/sshd hm:/usr/local/src/openssh-7.1p1/contrib # chmod 755 /etc/init.d/sshd # 启动并设置开机启动 hm:/usr/local/src/openssh-7.1p1/contrib # chkconfig --add sshd sshd 0:off 1:off 2:off 3:on 4:off 5:on 6:off hm:/usr/local/src/openssh-7.1p1/contrib # chkconfig sshd on hm:/usr/local/src/openssh-7.1p1/contrib # service sshd start Starting SSH daemon done
五、重新登陆服务器
注意几点:
1、OpenSSH 7版本默认不允许root登陆,需要修改PermitRootLogin、PasswordAuthentication为允许
2、编译openssh过程出现错误configure: error: *** Can't find recent OpenSSL libcrypto (see config.log for details) ***,这个是OpenSSL没有安装配置好所引起的错误
六、检验ssh密钥配置
1、通过客户端远程登陆本机(从客户端使用密钥验证方式登陆升级OpenSSH后的SuSe服务器)
# 创建密钥 [root@node4 ~]# ssh-keygen # 发送公钥到SuSe服务器 [root@node4 ~]# ssh-copy-id -i ~/.ssh/id_rsa.pub 10.0.0.130 # 登陆验证 [root@node4 ~]# ssh 10.0.0.130 Last login: Sat Jul 23 07:18:09 2016 from 10.0.0.14 hm:~ # ssh -V OpenSSH_7.1p1, OpenSSL 1.0.2h 3 May 2016 hm:~ # exit
2、配置本机密钥远程登陆其他服务器
hm:~ # ssh-keygen hm:~ # ssh-copy-id -i ~/.ssh/id_rsa.pub 10.0.0.14 /usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_rsa.pub" The authenticity of host '10.0.0.14 (10.0.0.14)' can't be established. RSA key fingerprint is SHA256:ov9sIuzLGQyS2FaJa4hY/SKSZ4YenjXBULFLYauDUz8. Are you sure you want to continue connecting (yes/no)? yes /usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed /usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys root@10.0.0.14's password: Number of key(s) added: 1 Now try logging into the machine, with: "ssh '10.0.0.14'" and check to make sure that only the key(s) you wanted were added. hm:~ # ssh 10.0.0.14 Last login: Thu Aug 11 23:30:24 2016 from 10.0.0.130 [root@node4 ~]# exit
当前题目:SuSe11以编译安装的方式升级OpenSSH、OpenSSL及依赖问题解决
转载来源:http://pwwzsj.com/article/psehee.html