Linux系统升级openssh版本到9.3sp2

admin

Linux系统升级openssh版本到9.3sp2
4 O: r6 N) C+ w. z! r
. b$ e$ F- N  P& M3 m0 B# Z1 d
4 f% r# H5 S: Z; z1 t- i0 N9 `OpenSSH ssh-agent 远程代码执行漏洞
. C( c& U7 l9 E4 _cve-2023-38408   收到安全漏洞问题，需要解决。
       受影响的版本<1.9.3p2-1
6 y; y( V' X6 H! N& A" k安全漏洞给出的解决方案：
首先升级到OpenSSH 9.3p2或更高版本：升级到最新版本的OpenSSH至关重要，因为它包含缓解漏洞的关键补丁。确保所有相关系统和服务器及时更新至推荐版本或更高版本。
另外采取预防措施来避免被利用：
建议在仅仅OpenSSH用于远程主机管理的机器，通过Openssh配置（sshd_config）、防火墙，安全组ACL等限制来源访问IP为白名单仅可信IP地址，同时，非必要，关闭SSH代理转发功能，禁止在有关主机启用ssh隧道等。
关闭SSH代理转发功能方法为：
配置/etc/ssh/sshd_config
- s( j, n; s- z7 ^3 y+ |# M2 {AllowTcpForwarding NO

2 P2 K  K3 Z8 {$ V6 s; U% C
接下来我们开始准升级的工作：
确定设备的openssh 服务
/ D+ r' y1 }# b# ssh -V
OpenSSH_7.4p1, OpenSSL 1.0.2k-fips  26 Jan 2017
   备份原有pam.d下的sshd文件

- s& H' P8 ^' m) Z: W. G# cp /etc/pam.d/sshd /etc/pam.d/sshd-bak  
4 a6 s& |1 q9 I+ t, `# ls /etc/pam.d/sshd*
/etc/pam.d/sshd  /etc/pam.d/sshd-bak
# cp -r /etc/ssh/ /etc/ssh-bak
. ]. b7 o6 ]- e0 w/ Q5 \9 e
# v! ~) f3 T$ ]' ~
2 q- J) d. |& v4 ]2 `3 L6 Z备份好文件之后，检查下telnet是否安装，
1 ^6 w3 B8 B# l1 H4 ?+ r( [# rpm -q telnet
. D5 _+ m0 T" `6 Qtelnet-0.17-66.el7.x86_64

. A4 x) m' [. j' m0 Z2 w" `# rpm -q telnet-server
package telnet-server is not installed
/ d& _3 N- v/ g$ B5 `  l下载openssh包进行升级
https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-9.3p2.tar.gz     
8 a* ]; P5 J% Vwget    https://cdn.openbsd.org/pub/Open ... penssh-9.3p2.tar.gz   到指定的目录。我们这里采用/tmp目录

/ {: ^& W! f5 x
https://mirrors.aliyun.com/pub/OpenBSD/OpenSSH/portable/openssh-9.3p2.tar.gz?spm=a2c6h.25603864.0.0.686840adPbA5X7
https://mirror.edgecast.com/pub/OpenBSD/OpenSSH/portable/openssh-9.3p2.tar.gz   

; s4 p2 v& H  U* c多个地址下载：
我们选择一个即可：
' O! h. h* z" N  I1 Y- w# wget  https://mirror.edgecast.com/pub/ ... penssh-9.3p2.tar.gz
. X. e3 |! s6 w' J$ u. |$ c4 N6 ]; x--2023-08-22 14:12:08--  https://mirror.edgecast.com/pub/ ... penssh-9.3p2.tar.gz
' a5 J( P2 ^& ^1 q) z4 gResolving mirror.edgecast.com (mirror.edgecast.com)... 152.195.62.22, 2606:2800:10c:1116:239f:3fd5:4bab:a23f
Connecting to mirror.edgecast.com (mirror.edgecast.com)|152.195.62.22|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 1835850 (1.8M) [application/octet-stream]
Saving to: ‘openssh-9.3p2.tar.gz’

$ B+ H6 X( g; ?100%[=======================================================================================================================================================================================================>] 1,835,850   1.49MB/s   in 1.2s   
* P8 u* S8 w: b9 }! ~1 @' z# U
2023-08-22 14:12:11 (1.49 MB/s) - ‘openssh-9.3p2.tar.gz’ saved [1835850/1835850]
. _0 y- N  e- M* P

; n3 [1 G- j7 Q  j# ls
( p* |1 a2 `0 ]0 D$ s7 R1 jopenssh-9.3p2.tar.gz
& ^- S3 P. O% ~( _  ]) Y1 u下载后，解压：
# K$ l) W3 a5 y$ e2 C5 J5 I
, X' Z, V7 A: p, X# tar -zxvf openssh-9.3p2.tar.gz
openssh-9.3p2
openssh-9.3p2/.git_allowed_signers
9 I$ w1 F" z4 ^: n2 }openssh-9.3p2/.git_allowed_signers.asc
% e/ L4 K1 i- iopenssh-9.3p2/.github
# p5 V, j/ R; g5 g3 ]- ropenssh-9.3p2/.github/ci-status.md
openssh-9.3p2/.github/configs
) ?/ d  u- Q3 w* fopenssh-9.3p2/.github/configure.sh
9 A9 \0 a" M( H: ]& Eopenssh-9.3p2/.github/run_test.sh
openssh-9.3p2/.github/setup_ci.sh
! E. u. u  E* i, g; ]openssh-9.3p2/.github/workflows
' e4 d" ^8 ~$ F  P* n% q- z4 S3 dopenssh-9.3p2/.github/workflows/c-cpp.yml
& Q9 M3 U+ l% m* |7 m3 t/ zopenssh-9.3p2/.github/workflows/cifuzz.yml
openssh-9.3p2/.github/workflows/selfhosted.yml
openssh-9.3p2/.github/workflows/upstream.yml
3 F- }# m& h% ]; c# Nopenssh-9.3p2/.gitignore
9 M( L0 i8 W/ Q  mopenssh-9.3p2/.skipped-commit-ids
* }. \! _) D& K# Y7 z7 i+ A  x) _( \openssh-9.3p2/CREDITS
$ l) ~! W1 B1 `0 V: q2 R* @) z4 P4 |openssh-9.3p2/INSTALL
  R$ H* F, t3 O; i.........
3 U: j" B7 x. n9 ?7 Bopenssh-9.3p2/aclocal.m4
' c# E5 S  M* ^  j8 Bopenssh-9.3p2/.depend
' m7 D4 b6 Z) J' I/ g: x/ t; B; bopenssh-9.3p2/config.h.in
, b' k! M& E) g: ?6 v- I. q4 o# Y9 eopenssh-9.3p2/configure


# ls
openssh-9.3p2  openssh-9.3p2.tar.gz

! y4 w3 e* B. G& R安装所需的包
1 Q) |* _( z8 p: h5 i6 _3 v# v( l yum install -y gcc zlib-devel pam-devel libselinux-devel zlib-devel  
完整路劲编译：
  z/ m# b' @2 P# t- a1 v3 l5 w /tmp/openssh-9.3p2/configure --prefix=/usr --sysconfdir=/etc/ssh --with-pam --with-zlib --with-md5-passwords --with-ssl-dir=/usr/ssl
7 B( ~1 c4 ^: o, Q3 F& w
绝对路径编译：
9 _) ]) v& c6 E, R$ e; P! u/ U$ d& [# ./configure --prefix=/usr --sysconfdir=/etc/ssh --with-pam --with-zlib --with-md5-passwords --with-ssl-dir=/usr/ssl
configure: WARNING: unrecognized options: --with-md5-passwords
4 y0 _4 E( d/ o  j! K! b3 |" h" O7 Pchecking for cc... cc
checking whether the C compiler works... yes
+ p6 y+ [7 H- O" vchecking for C compiler default output file name... a.out
! \' r7 {: r4 zchecking for suffix of executables...
checking whether we are cross compiling... no
checking for suffix of object files... o
) K, i& r& k5 ^8 h8 G3 ochecking whether the compiler supports GNU C... yes
9 r0 C+ O, V2 `+ e2 ~: h8 ]checking whether cc accepts -g... yes
checking for cc option to enable C11 features... -std=gnu11
  V$ E. a+ ^% I6 fchecking if cc -std=gnu11 supports C99-style variadic macros... yes
# h3 b- }1 I+ y3 G5 _1 D, W5 K; m5 I# |checking build system type... x86_64-pc-linux-gnu
' ~8 v; Y/ d4 B; `$ kchecking host system type... x86_64-pc-linux-gnu
' e2 I) V1 ?1 p- l- Gchecking for stdio.h... yes
/ o8 @2 r7 u8 R7 C1 ?checking for stdlib.h... yes
checking for string.h... yes
/ u( x2 x' y* h) y% q. X; Y! |+ g$ Pchecking for inttypes.h... yes
checking for stdint.h... yes
checking for strings.h... yes
checking for sys/stat.h... yes
checking for sys/types.h... yes
checking for unistd.h... yes
3 K1 A( _! J6 nchecking whether byte ordering is bigendian... no
checking for gawk... gawk
$ T6 x0 j' D5 ?' H- ?- o0 Gchecking how to run the C preprocessor... cc -std=gnu11 -E
checking for ranlib... ranlib
$ J+ m$ ~0 H4 u) Bchecking for a BSD-compatible install... /bin/install -c
) ^4 r7 p" v' ~% [checking for grep that handles long lines and -e... /bin/grep
3 C" h$ i3 q7 I+ ^8 h, O4 c( Echecking for egrep... /bin/grep -E
checking for a race-free mkdir -p... /bin/mkdir -p
" V" ^( J; C7 A9 E- P* t3 Y


, D% s; o3 y) N- I7 z4 X# MPAM is enabled. You may need to install a PAM control file
for sshd, otherwise password authentication may fail.
Example PAM control files can be found in the contrib/
! ?6 q) Y. O: Z  Z6 _5 `8 Jsubdirectory
, e: e" Y; O' w+ X# T
$ M: \& d6 a  Z  F编译：
, ^" U) g$ Z" U' c! c[root@localhost openssh-9.3p2]# make........
otector-strong -fPIE   -I. -I. -I/usr/ssl  -D_XOPEN_SOURCE=600 -D_BSD_SOURCE -D_DEFAULT_SOURCE -D_GNU_SOURCE -DSSHDIR=\"/etc/ssh\" -D_PATH_SSH_PROGRAM=\"/usr/bin/ssh\" -D_PATH_SSH_ASKPASS_DEFAULT=\"/usr/libexec/ssh-askpass\" -D_PATH_SFTP_SERVER=\"/usr/libexec/sftp-server\" -D_PATH_SSH_KEY_SIGN=\"/usr/libexec/ssh-keysign\" -D_PATH_SSH_PKCS11_HELPER=\"/usr/libexec/ssh-pkcs11-helper\" -D_PATH_SSH_SK_HELPER=\"/usr/libexec/ssh-sk-helper\" -D_PATH_SSH_PIDDIR=\"/var/run\" -D_PATH_PRIVSEP_CHROOT_DIR=\"/var/empty\" -DHAVE_CONFIG_H -c ssh-sk.c -o ssh-sk.o
- s2 _# g8 f) [5 Y' b, \4 Kcc -std=gnu11 -g -O2 -pipe -Wall -Wpointer-arith -Wuninitialized -Wsign-compare -Wformat-security -Wsizeof-pointer-memaccess -Wno-pointer-sign -Wno-unused-result -fno-strict-aliasing -D_FORTIFY_SOURCE=2 -ftrapv -fno-builtin-memset -fstack-protector-strong -fPIE   -I. -I. -I/usr/ssl  -D_XOPEN_SOURCE=600 -D_BSD_SOURCE -D_DEFAULT_SOURCE -D_GNU_SOURCE -DSSHDIR=\"/etc/ssh\" -D_PATH_SSH_PROGRAM=\"/usr/bin/ssh\" -D_PATH_SSH_ASKPASS_DEFAULT=\"/usr/libexec/ssh-askpass\" -D_PATH_SFTP_SERVER=\"/usr/libexec/sftp-server\" -D_PATH_SSH_KEY_SIGN=\"/usr/libexec/ssh-keysign\" -D_PATH_SSH_PKCS11_HELPER=\"/usr/libexec/ssh-pkcs11-helper\" -D_PATH_SSH_SK_HELPER=\"/usr/libexec/ssh-sk-helper\" -D_PATH_SSH_PIDDIR=\"/var/run\" -D_PATH_PRIVSEP_CHROOT_DIR=\"/var/empty\" -DHAVE_CONFIG_H -c sk-usbhid.c -o sk-usbhid.o
5 ^6 A3 @/ S& a3 s: u. m1 Ncc -std=gnu11 -o ssh-sk-helper ssh-sk-helper.o ssh-sk.o sk-usbhid.o -L. -Lopenbsd-compat/ -L/usr/ssl  -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -fstack-protector-strong -pie  -lssh -lopenbsd-compat -lssh -lopenbsd-compat -ldl -lutil  -lresolv  -lcrypto  -lz

# X. ?- l; W6 Z/ r6 _  a. X" B4 j
) U" n; v3 A7 Q; n安装install
7 ~; Z& N8 {& E[root@jms_server_01 openssh-9.3p2]# make install
& E8 q# z" ^  _2 Y; k(cd openbsd-compat && make)
make[1]: Entering directory `/tmp/openssh-9.3p2/openbsd-compat'
make[1]: Nothing to be done for `all'.
make[1]: Leaving directory `/tmp/openssh-9.3p2/openbsd-compat'
  a" }: x( m! |( H& `8 l4 K) k) g/bin/mkdir -p /usr/bin
/bin/mkdir -p /usr/sbin
% _0 ~0 t, q3 o% D6 v/bin/mkdir -p /usr/share/man/man1
/ }' x9 {% d3 @4 {/bin/mkdir -p /usr/share/man/man5
) l, z0 P. u7 J. o5 t* w/bin/mkdir -p /usr/share/man/man8
- a" j5 N! H9 v; N2 s. d9 P/bin/mkdir -p /usr/libexec
/bin/mkdir -p -m 0755 /var/empty
2 M# p1 t, \! R* c9 A$ ?3 X' W/bin/install -c -m 0755 -s ssh /usr/bin/ssh
/bin/install -c -m 0755 -s scp /usr/bin/scp
/bin/install -c -m 0755 -s ssh-add /usr/bin/ssh-add
/bin/install -c -m 0755 -s ssh-agent /usr/bin/ssh-agent
/bin/install -c -m 0755 -s ssh-keygen /usr/bin/ssh-keygen
0 U* y3 h0 Q' i5 g# a3 _0 y* }/bin/install -c -m 0755 -s ssh-keyscan /usr/bin/ssh-keyscan
5 s6 H" u* K" f' o, O/bin/install -c -m 0755 -s sshd /usr/sbin/sshd
" y4 z5 m; I, R9 j* ~9 I1 m/bin/install -c -m 4711 -s ssh-keysign /usr/libexec/ssh-keysign
9 t  T7 C/ |. R/bin/install -c -m 0755 -s ssh-pkcs11-helper /usr/libexec/ssh-pkcs11-helper
/bin/install -c -m 0755 -s ssh-sk-helper /usr/libexec/ssh-sk-helper
/bin/install -c -m 0755 -s sftp /usr/bin/sftp
/bin/install -c -m 0755 -s sftp-server /usr/libexec/sftp-server
2 s2 Y( ]! I) U+ N' ]- a  g/bin/install -c -m 644 ssh.1.out /usr/share/man/man1/ssh.1
/ W( B/ v- |/ E4 k' o4 R9 K" m/bin/install -c -m 644 scp.1.out /usr/share/man/man1/scp.1
/bin/install -c -m 644 ssh-add.1.out /usr/share/man/man1/ssh-add.1
. P  P1 ~- Z/ i! N7 Y/bin/install -c -m 644 ssh-agent.1.out /usr/share/man/man1/ssh-agent.1
- K7 O* t3 Y4 F- ]& [/bin/install -c -m 644 ssh-keygen.1.out /usr/share/man/man1/ssh-keygen.1
/bin/install -c -m 644 ssh-keyscan.1.out /usr/share/man/man1/ssh-keyscan.1
+ s( z3 w2 K0 r/bin/install -c -m 644 moduli.5.out /usr/share/man/man5/moduli.5
/bin/install -c -m 644 sshd_config.5.out /usr/share/man/man5/sshd_config.5
/bin/install -c -m 644 ssh_config.5.out /usr/share/man/man5/ssh_config.5
$ _8 `+ h+ S# Z1 K2 _  V9 V; ]/bin/install -c -m 644 sshd.8.out /usr/share/man/man8/sshd.8
/bin/install -c -m 644 sftp.1.out /usr/share/man/man1/sftp.1
! T- }3 L8 b: _1 b  c2 B% A/bin/install -c -m 644 sftp-server.8.out /usr/share/man/man8/sftp-server.8
/bin/install -c -m 644 ssh-keysign.8.out /usr/share/man/man8/ssh-keysign.8
/bin/install -c -m 644 ssh-pkcs11-helper.8.out /usr/share/man/man8/ssh-pkcs11-helper.8
/bin/install -c -m 644 ssh-sk-helper.8.out /usr/share/man/man8/ssh-sk-helper.8
4 z1 _9 q* [: s& H' r6 ^9 E& l/bin/mkdir -p /etc/ssh
. h! \. W' K! \: E/etc/ssh/ssh_config already exists, install will not overwrite
; [" X9 y7 O+ _9 B9 e6 Z/etc/ssh/sshd_config already exists, install will not overwrite
/etc/ssh/moduli already exists, install will not overwrite
/usr/sbin/sshd -t -f /etc/ssh/sshd_config
$ X/ e4 j& H6 x* D/etc/ssh/sshd_config line 79: Unsupported option GSSAPIAuthentication
/etc/ssh/sshd_config line 80: Unsupported option GSSAPICleanupCredentials
2 P$ |# z1 B9 W4 g" g# P7 K@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
5 M2 b0 A2 d8 K7 d. |+ n4 O@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
; l0 u" f; O! V- v1 P4 F  g0 @* \, UPermissions 0640 for '/etc/ssh/ssh_host_rsa_key' are too open.
; \& @  n. l: E0 OIt is required that your private key files are NOT accessible by others.
1 t* D! e* Y- ?# `1 t* K5 HThis private key will be ignored.
Unable to load host key "/etc/ssh/ssh_host_rsa_key": bad permissions
Unable to load host key: /etc/ssh/ssh_host_rsa_key
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
, U  u$ Y7 @- g4 u@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
1 a0 `! ^2 `7 OPermissions 0640 for '/etc/ssh/ssh_host_ecdsa_key' are too open.
It is required that your private key files are NOT accessible by others.
5 m" Y+ ?% R1 i' [) hThis private key will be ignored.
8 {* |- Y! Y& A* a* g7 \* VUnable to load host key "/etc/ssh/ssh_host_ecdsa_key": bad permissions
Unable to load host key: /etc/ssh/ssh_host_ecdsa_key
7 z+ S# Y( y0 a- g6 ]0 c7 ~) ?5 U@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
& [5 f* @; H; o# d@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
1 z0 {4 \5 z, [$ ePermissions 0640 for '/etc/ssh/ssh_host_ed25519_key' are too open.
  u/ L; g# H& b' Z% RIt is required that your private key files are NOT accessible by others.
' A* r7 C8 `9 c  ]. hThis private key will be ignored.
" [# {& J. |0 f! w  v7 xUnable to load host key "/etc/ssh/ssh_host_ed25519_key": bad permissions
" y% e" w: M* O6 n; ^Unable to load host key: /etc/ssh/ssh_host_ed25519_key
sshd: no hostkeys available -- exiting.
make: [check-config] Error 1 (ignored)

卸载旧版本
3 N1 H' B2 N0 O0 p
rpm -e --nodeps `rpm -qa | grep openssh`
- g7 [& X/ B3 v! @% E* }- r
删除ssh文件夹：
8 |* u6 S. V: T4 n+ \! Wrm -rf /etc/ssh

1 Q2 o- Y0 S# [* {  U* c, G) \1 V##安装依赖包：
yum install -y gcc zlib-devel pam-devel libselinux-devel zlib-devel
0 M8 ^+ C9 U# J1 J
5 f5 M+ ^; ]- d% ~1 Y
- }% m) ~$ g9 J0 q5 D+ Amake && make install

复制启动文件到init.d服务启停：
: n( e/ U6 J) h# }% A. k. b\cp -rp /tmp/openssh-9.3p2/contrib/redhat/sshd.init /etc/init.d/sshd
6 R6 d3 G3 g) y5 E% J% p
添加sshd服务开机启动：
0 {" I$ W8 K4 T% g; }7 k# }#chkconfig sshd on
systemctl enable sshd
( D- x$ w9 k+ K0 w' f% v5 k
复制之前的备份文件复原：

! i9 c6 X) e# {) u5 k' G5 Acp -pf  /etc/ssh-bak/sshd_config /etc/ssh/sshd_config
7 f( J# t5 }5 ]$ w$ p9 l- w1 e
- u9 S$ A$ g! }) V8 w
, G$ ^/ {3 e) \  z6 L6 P$ x" S\cp -pf /etc/pam.d/sshd-bak /etc/pam.d/sshd

" ?: p) H& Y$ y1 u: E( R2 z* {: a#check file
/usr/sbin/sshd -t -f /etc/ssh/sshd_config

" d! s+ B3 J, U& U3 \#start sshd service

systemctl start sshd.service
" _: c+ U& w9 E+ C( |) C
- @! w$ J$ i! u7 }: ?5 E) `: O1 H
1 d2 t; B6 _6 V6 ?
  
% b  a; K$ U$ U/ v* v* k3 K& }9 ~
% w1 M3 H* R# i$ j% c7 K

" q; V7 x$ v# }2 i0 u( [7 U% W0 p



# e$ J5 \, |- L5 A  y
5 i; x, `8 Q9 r' q* i. ?* t2 \
1 {2 H- ~% \$ X) B; U8 L

+ v6 G5 K0 o+ O/ ?. S4 @  Y
5 i: X9 q% o: V6 X7 y

9 V% k  S+ v0 z
$ Z/ |# _6 s4 i5 J1 v1 C







: j2 Q. R/ q5 S$ }: W. i
; B- F, O* K% r+ F4 B
# N8 U# \5 |6 S- u' ~% ^

admin

其他文章中提到要安装这个，我们这里没有安装。因为我可以通过console或者其他方式登录上去。

执行命令进行安装telnet

yum install telnet-server  -y
yum install telnet -y
设置开机启动并启动telnet

. q3 t& d" q) \% t3 G& dsystemctl enable telnet.socket
systemctl start telnet.socket
防火墙开启23端口，使用 telnet ip 进行连接登录。默认系统中是不允许root用户使用telnet登录的，因此我们需要授权一下

echo 'pts/0' >>/etc/securetty
echo 'pts/1' >>/etc/securetty
当我们在进行登录时无法正常登录时，主机端执行

tail /var/log/secure
假如我们看到的是：access denied: tty 'pts/3' is not secure !

1 t+ v: C  ?9 e# [3 a% N此时我们如果看到的是pts几就将几添加一下
% h+ v/ p9 [2 R) t  m
echo 'pts/3' >>/etc/securetty
& Y7 G" ]; k+ X/ [1 D添加后一定要重启telnet

admin

当端口号修改/etc/ssh/sshd_config 文件不生效时，可以修改下面文件：

生效的配置文件是/usr/local/openssh/etc/sshd_config   如果不改变/etc/ssh目录，就修改这个文件也可以
/usr/local/openssh/etc/sshd_config