OpenSSH upgrade reinforcement examples
(A) the upgrade ready
² turn off the firewall
# ufw disable
² installation and enable telnet
Open telnet server, remote connection to prevent an abnormal cause upgrade OpenSSH, particularly on command and Telnet service is installed as follows.
# apt-get install -y openbsd-inetd
# apt-get install -y telnetd
# service openbsd-inetd start
² download the upgrade package
# wget https://cloudflare.cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-7.4p1.tar.gz --no-check-certificate
# wget http://www.zlib.net/zlib-1.2.11.tar.gz
# wget https://www.openssl.org/source/openssl-1.0.2k.tar.gz
² install zlib library dependencies
# tar zxvf zlib-1.2.11.tar.gz
# cd zlib-1.2.11
# ./configure
# make && make install
# echo "/usr/local/lib" >> /etc/ld.so.conf
# ldconfig
² Adding ordinary account
# useradd iflytek
# passwd XXX
(B) OpenSSL upgrade
# tar zxvf openssl-1.0.2k.tar.gz
# cd openssl-1.0.2k
# ./config shared -fPIC
# make && make install
# echo "/usr/local/ssl/lib " >> /etc/ld.so.conf
# ldconfig
# rm -rf /usr/bin/openssl
# ln -s /usr/local/ssl/bin/openssl /usr/bin/openssl
# openssl version
(C) OpenSSH upgrade
Use the command "telnet IP" remote connection server, SSH service shut down for upgrades.
# Stop sshd service
# service sshd stop
# Apt install libpam0g-dev
# Apt-get install libpam0g-dev # will complain the lack of libpam0g-dev
# Delete the original ssh relevant configuration file
# rm -rf /etc/ssh /usr/bin/scp /usr/bin/sftp /usr/bin/ssh* /usr/sbin/sshd
# rm -rf /lib/x86_64-linux-gnu/libssl.so.1.0.0
# rm -rf /lib/x86_64-linux-gnu/libcrypto.so.1.0.0
# cp /usr/local/ssl/lib/libssl.so.1.0.0 /lib/x86_64-linux-gnu/
# cp /usr/local/ssl/lib/libcrypto.so.1.0.0 /lib/x86_64-linux-gnu/
# Unpack and compile and install the new version of openssh
# tar zxvf openssh-7.4p1.tar.gz
# cd openssh-7.4p1
# ./configure --prefix=/usr/local/ssh --sysconfdir=/etc/ssh --with-md5-passwords --with-pam --with-ssl-dir=/usr/local/ssl --mandir=/usr/share/man --with-zlib=/usr/local/lib --with-privsep-path=/var/empty --with-privsep-user=sshd --with-ssl-engine
# make && make install
If you encounter this error, indicating pam not installed, you need to hold: apt-get install pam
# Create a new version of ssh services related soft link
# ln -s /usr/local/ssh/bin/ssh /usr/bin/ssh
# ln -s /usr/local/ssh/bin/scp /usr/bin/scp
# ln -s /usr/local/ssh/bin/sftp /usr/bin/sftp
# ln -s /usr/local/ssh/bin/ssh-add /usr/bin/ssh-add
# ln -s /usr/local/ssh/bin/ssh-agent /usr/bin/ssh-agent
# ln -s /usr/local/ssh/bin/ssh-keygen /usr/bin/ssh-keygen
# ln -s /usr/local/ssh/bin/ssh-keyscan /usr/bin/ssh-keyscan
# ln -s /usr/local/ssh/sbin/sshd /usr/sbin/sshd
# Configuration allows remote root login using ssh ( recommended for general use login account as ROMS, do not open the root remote login )
# vi /etc/ssh/sshd_config
Remove "#PermitRootLogin prohibit-password" comments, and modify the "prohibit-password" is "yes", the last save and exit;
# service sshd start
If an error occurs follow the prompts
# ssh -V