Linux系统升级openssh版本到9.3sp2

admin · 发表于 2023-8-22 11:17:44

Linux系统升级openssh版本到9.3sp2

OpenSSH ssh-agent 远程代码执行漏洞
cve-2023-38408 收到安全漏洞问题，需要解决。
   受影响的版本<1.9.3p2-1
安全漏洞给出的解决方案：
首先升级到OpenSSH 9.3p2或更高版本：升级到最新版本的OpenSSH至关重要，因为它包含缓解漏洞的关键补丁。确保所有相关系统和服务器及时更新至推荐版本或更高版本。
另外采取预防措施来避免被利用：
建议在仅仅OpenSSH用于远程主机管理的机器，通过Openssh配置（sshd_config）、防火墙，安全组ACL等限制来源访问IP为白名单仅可信IP地址，同时，非必要，关闭SSH代理转发功能，禁止在有关主机启用ssh隧道等。
关闭SSH代理转发功能方法为：
配置/etc/ssh/sshd_config
AllowTcpForwarding NO

接下来我们开始准升级的工作：
确定设备的openssh 服务
# ssh -V
OpenSSH_7.4p1, OpenSSL 1.0.2k-fips  26 Jan 2017
备份原有pam.d下的sshd文件

# cp /etc/pam.d/sshd /etc/pam.d/sshd-bak
# ls /etc/pam.d/sshd*
/etc/pam.d/sshd  /etc/pam.d/sshd-bak
# cp -r /etc/ssh/ /etc/ssh-bak

备份好文件之后，检查下telnet是否安装，
# rpm -q telnet
telnet-0.17-66.el7.x86_64

# rpm -q telnet-server
package telnet-server is not installed
下载openssh包进行升级
https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-9.3p2.tar.gz
wget https://cdn.openbsd.org/pub/Open ... penssh-9.3p2.tar.gz 到指定的目录。我们这里采用/tmp目录

https://mirrors.aliyun.com/pub/OpenBSD/OpenSSH/portable/openssh-9.3p2.tar.gz?spm=a2c6h.25603864.0.0.686840adPbA5X7
https://mirror.edgecast.com/pub/OpenBSD/OpenSSH/portable/openssh-9.3p2.tar.gz

多个地址下载：
我们选择一个即可：
# wget  https://mirror.edgecast.com/pub/ ... penssh-9.3p2.tar.gz
--2023-08-22 14:12:08--  https://mirror.edgecast.com/pub/ ... penssh-9.3p2.tar.gz
Resolving mirror.edgecast.com (mirror.edgecast.com)... 152.195.62.22, 2606:2800:10c:1116:239f:3fd5:4bab:a23f
Connecting to mirror.edgecast.com (mirror.edgecast.com)|152.195.62.22|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 1835850 (1.8M) [application/octet-stream]
Saving to: ‘openssh-9.3p2.tar.gz’

100%[=======================================================================================================================================================================================================>] 1,835,850 1.49MB/s in 1.2s

2023-08-22 14:12:11 (1.49 MB/s) - ‘openssh-9.3p2.tar.gz’ saved [1835850/1835850]

# ls
openssh-9.3p2.tar.gz
下载后，解压：

# tar -zxvf openssh-9.3p2.tar.gz
openssh-9.3p2
openssh-9.3p2/.git_allowed_signers
openssh-9.3p2/.git_allowed_signers.asc
openssh-9.3p2/.github
openssh-9.3p2/.github/ci-status.md
openssh-9.3p2/.github/configs
openssh-9.3p2/.github/configure.sh
openssh-9.3p2/.github/run_test.sh
openssh-9.3p2/.github/setup_ci.sh
openssh-9.3p2/.github/workflows
openssh-9.3p2/.github/workflows/c-cpp.yml
openssh-9.3p2/.github/workflows/cifuzz.yml
openssh-9.3p2/.github/workflows/selfhosted.yml
openssh-9.3p2/.github/workflows/upstream.yml
openssh-9.3p2/.gitignore
openssh-9.3p2/.skipped-commit-ids
openssh-9.3p2/CREDITS
openssh-9.3p2/INSTALL
.........
openssh-9.3p2/aclocal.m4
openssh-9.3p2/.depend
openssh-9.3p2/config.h.in
openssh-9.3p2/configure

# ls
openssh-9.3p2  openssh-9.3p2.tar.gz

安装所需的包
yum install -y gcc zlib-devel pam-devel libselinux-devel zlib-devel
完整路劲编译：
/tmp/openssh-9.3p2/configure --prefix=/usr --sysconfdir=/etc/ssh --with-pam --with-zlib --with-md5-passwords --with-ssl-dir=/usr/ssl

绝对路径编译：
# ./configure --prefix=/usr --sysconfdir=/etc/ssh --with-pam --with-zlib --with-md5-passwords --with-ssl-dir=/usr/ssl
configure: WARNING: unrecognized options: --with-md5-passwords
checking for cc... cc
checking whether the C compiler works... yes
checking for C compiler default output file name... a.out
checking for suffix of executables...
checking whether we are cross compiling... no
checking for suffix of object files... o
checking whether the compiler supports GNU C... yes
checking whether cc accepts -g... yes
checking for cc option to enable C11 features... -std=gnu11
checking if cc -std=gnu11 supports C99-style variadic macros... yes
checking build system type... x86_64-pc-linux-gnu
checking host system type... x86_64-pc-linux-gnu
checking for stdio.h... yes
checking for stdlib.h... yes
checking for string.h... yes
checking for inttypes.h... yes
checking for stdint.h... yes
checking for strings.h... yes
checking for sys/stat.h... yes
checking for sys/types.h... yes
checking for unistd.h... yes
checking whether byte ordering is bigendian... no
checking for gawk... gawk
checking how to run the C preprocessor... cc -std=gnu11 -E
checking for ranlib... ranlib
checking for a BSD-compatible install... /bin/install -c
checking for grep that handles long lines and -e... /bin/grep
checking for egrep... /bin/grep -E
checking for a race-free mkdir -p... /bin/mkdir -p

PAM is enabled. You may need to install a PAM control file
for sshd, otherwise password authentication may fail.
Example PAM control files can be found in the contrib/
subdirectory

编译：
[root@localhost openssh-9.3p2]# make........
otector-strong -fPIE -I. -I. -I/usr/ssl  -D_XOPEN_SOURCE=600 -D_BSD_SOURCE -D_DEFAULT_SOURCE -D_GNU_SOURCE -DSSHDIR=\"/etc/ssh\" -D_PATH_SSH_PROGRAM=\"/usr/bin/ssh\" -D_PATH_SSH_ASKPASS_DEFAULT=\"/usr/libexec/ssh-askpass\" -D_PATH_SFTP_SERVER=\"/usr/libexec/sftp-server\" -D_PATH_SSH_KEY_SIGN=\"/usr/libexec/ssh-keysign\" -D_PATH_SSH_PKCS11_HELPER=\"/usr/libexec/ssh-pkcs11-helper\" -D_PATH_SSH_SK_HELPER=\"/usr/libexec/ssh-sk-helper\" -D_PATH_SSH_PIDDIR=\"/var/run\" -D_PATH_PRIVSEP_CHROOT_DIR=\"/var/empty\" -DHAVE_CONFIG_H -c ssh-sk.c -o ssh-sk.o
cc -std=gnu11 -g -O2 -pipe -Wall -Wpointer-arith -Wuninitialized -Wsign-compare -Wformat-security -Wsizeof-pointer-memaccess -Wno-pointer-sign -Wno-unused-result -fno-strict-aliasing -D_FORTIFY_SOURCE=2 -ftrapv -fno-builtin-memset -fstack-protector-strong -fPIE -I. -I. -I/usr/ssl  -D_XOPEN_SOURCE=600 -D_BSD_SOURCE -D_DEFAULT_SOURCE -D_GNU_SOURCE -DSSHDIR=\"/etc/ssh\" -D_PATH_SSH_PROGRAM=\"/usr/bin/ssh\" -D_PATH_SSH_ASKPASS_DEFAULT=\"/usr/libexec/ssh-askpass\" -D_PATH_SFTP_SERVER=\"/usr/libexec/sftp-server\" -D_PATH_SSH_KEY_SIGN=\"/usr/libexec/ssh-keysign\" -D_PATH_SSH_PKCS11_HELPER=\"/usr/libexec/ssh-pkcs11-helper\" -D_PATH_SSH_SK_HELPER=\"/usr/libexec/ssh-sk-helper\" -D_PATH_SSH_PIDDIR=\"/var/run\" -D_PATH_PRIVSEP_CHROOT_DIR=\"/var/empty\" -DHAVE_CONFIG_H -c sk-usbhid.c -o sk-usbhid.o
cc -std=gnu11 -o ssh-sk-helper ssh-sk-helper.o ssh-sk.o sk-usbhid.o -L. -Lopenbsd-compat/ -L/usr/ssl  -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -fstack-protector-strong -pie  -lssh -lopenbsd-compat -lssh -lopenbsd-compat -ldl -lutil  -lresolv  -lcrypto  -lz

安装install
[root@jms_server_01 openssh-9.3p2]# make install
(cd openbsd-compat && make)
make[1]: Entering directory `/tmp/openssh-9.3p2/openbsd-compat'
make[1]: Nothing to be done for `all'.
make[1]: Leaving directory `/tmp/openssh-9.3p2/openbsd-compat'
/bin/mkdir -p /usr/bin
/bin/mkdir -p /usr/sbin
/bin/mkdir -p /usr/share/man/man1
/bin/mkdir -p /usr/share/man/man5
/bin/mkdir -p /usr/share/man/man8
/bin/mkdir -p /usr/libexec
/bin/mkdir -p -m 0755 /var/empty
/bin/install -c -m 0755 -s ssh /usr/bin/ssh
/bin/install -c -m 0755 -s scp /usr/bin/scp
/bin/install -c -m 0755 -s ssh-add /usr/bin/ssh-add
/bin/install -c -m 0755 -s ssh-agent /usr/bin/ssh-agent
/bin/install -c -m 0755 -s ssh-keygen /usr/bin/ssh-keygen
/bin/install -c -m 0755 -s ssh-keyscan /usr/bin/ssh-keyscan
/bin/install -c -m 0755 -s sshd /usr/sbin/sshd
/bin/install -c -m 4711 -s ssh-keysign /usr/libexec/ssh-keysign
/bin/install -c -m 0755 -s ssh-pkcs11-helper /usr/libexec/ssh-pkcs11-helper
/bin/install -c -m 0755 -s ssh-sk-helper /usr/libexec/ssh-sk-helper
/bin/install -c -m 0755 -s sftp /usr/bin/sftp
/bin/install -c -m 0755 -s sftp-server /usr/libexec/sftp-server
/bin/install -c -m 644 ssh.1.out /usr/share/man/man1/ssh.1
/bin/install -c -m 644 scp.1.out /usr/share/man/man1/scp.1
/bin/install -c -m 644 ssh-add.1.out /usr/share/man/man1/ssh-add.1
/bin/install -c -m 644 ssh-agent.1.out /usr/share/man/man1/ssh-agent.1
/bin/install -c -m 644 ssh-keygen.1.out /usr/share/man/man1/ssh-keygen.1
/bin/install -c -m 644 ssh-keyscan.1.out /usr/share/man/man1/ssh-keyscan.1
/bin/install -c -m 644 moduli.5.out /usr/share/man/man5/moduli.5
/bin/install -c -m 644 sshd_config.5.out /usr/share/man/man5/sshd_config.5
/bin/install -c -m 644 ssh_config.5.out /usr/share/man/man5/ssh_config.5
/bin/install -c -m 644 sshd.8.out /usr/share/man/man8/sshd.8
/bin/install -c -m 644 sftp.1.out /usr/share/man/man1/sftp.1
/bin/install -c -m 644 sftp-server.8.out /usr/share/man/man8/sftp-server.8
/bin/install -c -m 644 ssh-keysign.8.out /usr/share/man/man8/ssh-keysign.8
/bin/install -c -m 644 ssh-pkcs11-helper.8.out /usr/share/man/man8/ssh-pkcs11-helper.8
/bin/install -c -m 644 ssh-sk-helper.8.out /usr/share/man/man8/ssh-sk-helper.8
/bin/mkdir -p /etc/ssh
/etc/ssh/ssh_config already exists, install will not overwrite
/etc/ssh/sshd_config already exists, install will not overwrite
/etc/ssh/moduli already exists, install will not overwrite
/usr/sbin/sshd -t -f /etc/ssh/sshd_config
/etc/ssh/sshd_config line 79: Unsupported option GSSAPIAuthentication
/etc/ssh/sshd_config line 80: Unsupported option GSSAPICleanupCredentials
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@       WARNING: UNPROTECTED PRIVATE KEY FILE!       @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0640 for '/etc/ssh/ssh_host_rsa_key' are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.
Unable to load host key "/etc/ssh/ssh_host_rsa_key": bad permissions
Unable to load host key: /etc/ssh/ssh_host_rsa_key
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@       WARNING: UNPROTECTED PRIVATE KEY FILE!       @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0640 for '/etc/ssh/ssh_host_ecdsa_key' are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.
Unable to load host key "/etc/ssh/ssh_host_ecdsa_key": bad permissions
Unable to load host key: /etc/ssh/ssh_host_ecdsa_key
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@       WARNING: UNPROTECTED PRIVATE KEY FILE!       @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0640 for '/etc/ssh/ssh_host_ed25519_key' are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.
Unable to load host key "/etc/ssh/ssh_host_ed25519_key": bad permissions
Unable to load host key: /etc/ssh/ssh_host_ed25519_key
sshd: no hostkeys available -- exiting.
make: [check-config] Error 1 (ignored)

卸载旧版本

rpm -e --nodeps `rpm -qa | grep openssh`

删除ssh文件夹：
rm -rf /etc/ssh

##安装依赖包：
yum install -y gcc zlib-devel pam-devel libselinux-devel zlib-devel

make && make install

复制启动文件到init.d服务启停：
\cp -rp /tmp/openssh-9.3p2/contrib/redhat/sshd.init /etc/init.d/sshd

添加sshd服务开机启动：
#chkconfig sshd on
systemctl enable sshd

复制之前的备份文件复原：

cp -pf  /etc/ssh-bak/sshd_config /etc/ssh/sshd_config

\cp -pf /etc/pam.d/sshd-bak /etc/pam.d/sshd

#check file
/usr/sbin/sshd -t -f /etc/ssh/sshd_config

#start sshd service

systemctl start sshd.service

admin · 发表于 2023-8-22 14:02:12

其他文章中提到要安装这个，我们这里没有安装。因为我可以通过console或者其他方式登录上去。

执行命令进行安装telnet

yum install telnet-server -y
yum install telnet -y
设置开机启动并启动telnet

systemctl enable telnet.socket
systemctl start telnet.socket
防火墙开启23端口，使用 telnet ip 进行连接登录。默认系统中是不允许root用户使用telnet登录的，因此我们需要授权一下

echo 'pts/0' >>/etc/securetty
echo 'pts/1' >>/etc/securetty
当我们在进行登录时无法正常登录时，主机端执行

tail /var/log/secure
假如我们看到的是：access denied: tty 'pts/3' is not secure !

此时我们如果看到的是pts几就将几添加一下

echo 'pts/3' >>/etc/securetty
添加后一定要重启telnet

admin · 发表于 2023-8-22 16:22:56

当端口号修改/etc/ssh/sshd_config 文件不生效时，可以修改下面文件：

生效的配置文件是/usr/local/openssh/etc/sshd_config 如果不改变/etc/ssh目录，就修改这个文件也可以
/usr/local/openssh/etc/sshd_config

		自动登录	找回密码
密码			注册

Linux系统升级openssh版本到9.3sp2

浏览过的版块