면책 조항 :이 문서는 블로거 원본입니다은 허용 블로거없이 복제 할 수 없다. https://blog.csdn.net/baidu_39459954/article/details/89447343
기사 디렉토리
이 문서의 설치 환경 CentOS7
1, 설치 텔넷
서버를 일으키는 업그레이드 문제가 연결할 수 있도록하려면, 우발 사태에 대비하기 위해 텔넷을 설치합니다.
[root@DZFP-DMZ-Server2 ~]# rpm -ivh telnet-0.17-64.el7.x86_64.rpm
警告：telnet-0.17-64.el7.x86_64.rpm: 头V3 RSA/SHA256 Signature, 密钥 ID f4a80eb5: NOKEY
准备中... ################################# [100%]
正在升级/安装...
1:telnet-1:0.17-64.el7 ################################# [100%]
[root@DZFP-DMZ-Server2 ~]# rpm -ivh telnet-server-0.17-64.el7.x86_64.rpm
警告：telnet-server-0.17-64.el7.x86_64.rpm: 头V3 RSA/SHA256 Signature, 密钥 ID f4a80eb5: NOKEY
准备中... ################################# [100%]
正在升级/安装...
1:telnet-server-1:0.17-64.el7 ################################# [100%]
[root@DZFP-DMZ-Server2 ~]#
[root@DZFP-DMZ-Server2 ~]# rpm -ivh xinetd-2.3.15-13.el7.x86_64.rpm
警告：xinetd-2.3.15-13.el7.x86_64.rpm: 头V3 RSA/SHA256 Signature, 密钥 ID f4a80eb5: NOKEY
准备中... ################################# [100%]
正在升级/安装...
1:xinetd-2:2.3.15-13.el7 ################################# [100%]
[root@DZFP-DMZ-Server2 ~]#
[root@DZFP-DMZ-Server2 ~]# systemctl start telnet.socket
[root@DZFP-DMZ-Server2 ~]# systemctl start xinetd
[root@DZFP-DMZ-Server2 ~]# systemctl status xinetd
[root@DZFP-DMZ-Server2 ~]# systemctl status telnet.socket
기본적으로 시스템 루트 사용자는 원격 로그인을 텔넷 수 없습니다. 루트 사용자로 직접 로그인하려면 다음을 설정합니다 :
echo 'pts/0' >>/etc/securetty
echo 'pts/1' >>/etc/securetty
설치 후 완료 확인 텔넷을 사용할 수 있습니다
2, 체크 종속성
2.1, PAM 및 ZLIB 버전을 확인
[root@DZFP-DMZ-Server2 ~]# rpm -qa|grep pam
gnome-keyring-pam-3.8.2-10.el7.x86_64
fprintd-pam-0.5.0-4.0.el7_0.x86_64
pam_krb5-2.4.8-4.el7.x86_64
pam-devel-1.1.8-12.el7.x86_64
pam-1.1.8-12.el7.x86_64
[root@DZFP-DMZ-Server2 ~]# rpm -qa|grep zlib
zlib-1.2.7-13.el7.x86_64
zlib-devel-1.2.7-13.el7.x86_64
2.2 펄의 버전을 확인
[root@DZFP-DMZ-Server2 ~]$perl -v
This is perl 5, version 16, subversion 3 (v5.16.3) built for x86_64-linux-thread-multi
(with 28 registered patches, see perl -V for more detail)
Copyright 1987-2012, Larry Wall
Perl may be copied only under the terms of either the Artistic License or the
GNU General Public License, which may be found in the Perl 5 source kit.
Complete documentation for Perl, including FAQ lists, should be found on
this system using "man perl" or "perldoc perl". If you have access to the
Internet, point your browser at http://www.perl.org/, the Perl Home Page.
[root@DZFP-DMZ-Server2 ~]$
2.3 ZLIB의 새 버전이 설치 [선택 사항]
yum install gcc pam-devel zlib-devel -y #提前安装好依赖
tar -zxvf zlib-1.2.11.tar.gz #先安装zlib，解压zlib
cd zlib-1.2.11
cat README #养成好习惯，在安装软件前查看README
./configure --prefix=/usr #检查依赖关系
make #编译32 rpm -e --nodeps zlib #卸载zlib
rpm -qa|grep zlib #是否卸载完全
make install #开始安装
echo '/usr/lib' >> /etc/ld.so.conf
ldconfig #使生效
rpm -qa|grep zlib #查看zlib版本是否升级正常，遗憾的是我的还是旧版本，但是对于openssh的升级没有太大影响
2.4 [선택] 펄 설치
wget https://www.cpan.org/src/5.0/perl-5.28.0.tar.gz
tar -zxvf perl-5.28.0.tar.gz #在安装openssl前，还需要先安装好perl5
cd perl-5.28.0
echo $HOME
./Configure -des -Dprefix=$HOME/localperl
make
make test #这里可能提示失败
export LD_LIBRARY_PATH=`pwd` #这个命令貌似没事么用处，不执行问题应该也不大
make test
echo $LD_LIBRARY_PATH
cd t
../cpan/File-Path/t/Path_root.t
./perl -I../lib harness op/filetest.t #如果这里提示全部成功了，应该就没什么问题
cd ..
make install
perl -v #检测perl5是否安装成功92 cd ..
3, 백업 구성 파일
,하려면 openssl을 설치 / -name하려면 openssl # 준비 찾을 파일 검색의 백업을
[root@DZFP-DMZ-Server2 ~]# find / -name openssl
/etc/pki/ca-trust/extracted/openssl
/usr/share/ruby/openssl
/usr/include/openssl
/opt/nginx/nginx-1.6.2/auto/lib/openssl
cp -r /etc/pki/ca-trust/extracted/openssl /etc/pki/ca-trust/extracted/openssl.old
cp /usr/bin/openssl /usr/bin/openssl.old
cp -r /usr/lib64/openssl /usr/lib64/openssl.old
cp -r /usr/share/ruby/openssl /usr/share/ruby/openssl.old
cp -r /usr/include/openssl /usr/include/openssl.old
cp /usr/lib64/libcrypto.so.10 /usr/lib64/libcrypto.so.10.old
cp /usr/lib64/libssl.so.10 /usr/lib64/libssl.so.10.old
4, OpenSSL을 업그레이드
4.1 이전 버전을 제거
전망
[root@DZFP-DMZ-Server2 ~]# rpm -qa|grep openssl
openssl-devel-1.0.1e-42.el7.x86_64
openssl098e-0.9.8e-29.el7.centos.2.x86_64
openssl-libs-1.0.1e-42.el7.x86_64
openssl-1.0.1e-42.el7.x86_64
#이 두 문서는 백업해야
cp /usr/lib64/libcrypto.so.10 /usr/lib64/libcrypto.so.10.old
cp /usr/lib64/libssl.so.10 /usr/lib64/libssl.so.10.old
제거
rpm -e --nodeps openssl-libs-1.0.1e-42.el7.x86_64
rpm -e --nodeps openssl-1.0.1e-42.el7.x86_64
4.2 OpenSSL을 설치
순서에서 다음 명령을 실행
[root@DZFP-DMZ-Server2 ~]# tar -zxvf openssl-1.0.2o.tar.gz
cd openssl-1.0.2o
./config --prefix=/usr --openssldir=/etc/ssl --shared zlib #在执行这里的时候，如果提示没有安装perl5，参考2.4安装perl
make
make test
make install
openssl version
cd
새로 설치하려면 openssl 라이브러리 파일이 두 가지를 포함하지 않았기 때문에 #, 원래의 라이브러리 파일을 복원
mv /usr/lib64/libcrypto.so.10.old /usr/lib64/libcrypto.so.10
mv /usr/lib64/libssl.so.10.old /usr/lib64/libssl.so.10
설치가 성공하면 4.3를 확인합니다
[root@DZFP-DMZ-Server2 openssl-1.0.2o]# openssl version
OpenSSL 1.0.2o 27 Mar 2018
5, OpenSSH의 설치를 준비하기 시작했다
5.1 이전 OpenSSH를 제거
cp -r /etc/ssh /etc/ssh.old
[root@DZFP-DMZ-Server2 openssl-1.0.2o]# rpm -qa|grep openssh
openssh-6.6.1p1-11.el7.x86_64
openssh-server-6.6.1p1-11.el7.x86_64
openssh-clients-6.6.1p1-11.el7.x86_64
rpm -e --nodeps openssh-6.6.1p1-11.el7.x86_64
rpm -e --nodeps openssh-server-6.6.1p1-11.el7.x86_64
rpm -e --nodeps openssh-clients-6.6.1p1-11.el7.x86_64
rpm -qa|grep openssh
5.2 설치
install -v -m700 -d /var/lib/sshd
chown -v root:sys /var/lib/sshd
groupadd -g 50 sshd
useradd -c 'sshd PrivSep' -d /var/lib/sshd -g sshd -s /bin/false -u 50 sshd
tar -zxvof openssh-7.6p1.tar.gz
cd openssh-7.6p1
./configure --prefix=/usr --sysconfdir=/etc/ssh --with-md5-passwords --with-pam --with-zlib --with-openssl-includes=/usr --with-privsep-path=/var/lib/sshd
make
make install #执行好可能会提示WARNING: UNPROTECTED PRIVATE KEY FILE!原因是下面几个文件的权限问题
ll /etc/ssh/ssh_host_rsa_key
chmod 600 /etc/ssh/ssh_host_rsa_key
chmod 600 /etc/ssh/ssh_host_ecdsa_key
chmod 600 /etc/ssh/ssh_host_ed25519_key
make install
ssh -V
5.3, 구성
install -v -m755 contrib/ssh-copy-id /usr/bin
install -v -m644 contrib/ssh-copy-id.1 /usr/share/man/man1
install -v -m755 -d /usr/share/doc/openssh-7.6p1
install -v -m644 INSTALL LICENCE OVERVIEW README*
install -v -m644 INSTALL LICENCE OVERVIEW README* /usr/share/doc/openssh-7.6p1
echo 'X11Forwarding yes' >> /etc/ssh/sshd_config
echo "PermitRootLogin yes" >> /etc/ssh/sshd_config
echo "UsePAM yes" >> /etc/ssh/sshd_config
cp -p contrib/redhat/sshd.init /etc/init.d/sshd
PAM 모듈 구성
vi /etc/pam.d/sshd
添加
auth required pam_unix.so
account required pam_unix.so
session required pam_chroot.so
5.4은 처음부터 부팅을 설정
chmod +x /etc/init.d/sshd
chkconfig --add sshd
chkconfig sshd on
chkconfig --list sshd
systemctl restart sshd
5.5 SSH 버전을 참조
SSH -V 최신 버전의 설치를위한 # ssh를 프롬프트, 성공을 업그레이드