最近做了等保扫描，发现旧版本的Openssh有漏洞，所以决定把Openssh升级到最新版本。 前后辛苦了两三个星期，中途填补了各种各样的漏洞。 最终版本为Openssh8.8p1、Openssl1.1.1l和zlib-1.2.11
1 .提前准备了三个安装包，大家可以下载到各大镜像源网站，如下
2、使用yum安装gcc lrzsz
[root@localhost ~]# mkdir upload
[root@localhost ~]# cd upload
使用[root@localhost upload]# rz //命令将软件包上载到upload文件夹
所有的工作都准备好了。 以下内容将立即开始安装。 大多数命令是复制&； 只需要糊一下就可以了。 请记住顺序
1、解开包
光盘
cd upload
tar -xvf openssl-1.1.1l.tar.gz
tar -xvf openssh-8.8p1.tar.gz
tar -xvf zlib-1.2.11.tar.gz
2、编译并安装zlib
cd zlib-1.2.11
./configure---prefix=/usr/local/zlib
生成安装
3、编译并安装openssl
光盘.
cd openssl-1.1.1l
./config-- prefix=/usr/local/SSL-dshared
生成安装
echo '/usr/local/SSL/lib '/etc/LD.so.conf
ldconfig -v
4、安装openssh
光盘.
cd openssh-8.8p1
./configure-- prefix=/usr/local/OpenSSH-- with-zlib=/usr/local/zlib-- with-SSL-dir=/usr/lopensh
生成安装
5 .修改sshd_config文件
echo ' permitrootloginyes '/usr/local/OpenSSH/etc/sshd _ config
echo ' pubkeyauthenticationyes '/usr/local/OpenSSH/etc/sshd _ config
echo ' passwordauthenticationyes '/usr/local/OpenSSH/etc/sshd _ config
6、替换/etc/ssh中的文件
mv/usr/sbin/sshd/usr/sbin/sshd.bak
CP/usr/local/OpenSSH/sbin/sshd/usr/sbin/sshd
mv /usr/bin/ssh /usr/bin/ssh.bak
CP/usr/local/OpenSSH/bin/ssh/usr/bin/ssh
mv/usr/bin/ssh-keygen/usr/bin/ssh-keygen.bak
CP/usr/local/OpenSSH/bin/ssh-keygen/usr/bin/ssh-keygen
mv/etc/ssh/ssh _ host _ ECD sa _ key.pub/etc/ssh/ssh _ host _ ECD sa _ key.pub.bak
CP/usr/local/OpenSSH/etc/ssh _ host _ ECD sa _ key.pub/etc/ssh _ host _ ECD sa _ key.pub
mv/etc/ssh/ssh _ host _ DSA _ key.pub/etc/ssh/ssh _ host _ DSA _ key.pub.bak
CP/usr/local/OpenSSH/etc/ssh _ host _ DSA _ key.pub/etc/ssh _ host _ DSA _ key.pub
7、交换openssl文件这一步骤完成后，输入openssl version即可发现openssl的版本已经更改
mv/usr/bin/OpenSSL/usr/bin/OpenSSL _ bak
CP/usr/local/SSL/bin/OpenSSL/usr/bin/OpenSSL
mv/usr/include/OpenSSL/usr/include/OpenSSL _ bak
ln-s/usr/local/SSL/include/OpenSSL/usr/include /
opensslecho "/usr/local/ssl/lib" >> /etc/ld.so.conf
/sbin/ldconfig
8、替换启动文件
cd
cd upload/openssh-8.8p1/
cp -a contrib/redhat/sshd.init /etc/init.d/sshd
cp -a contrib/redhat/sshd.pam /etc/pam.d/sshd.pam
chmod +x /etc/init.d/sshd
chkconfig --add sshd
systemctl enable sshd
9.sshd.service 会跟etc/init.d/sshd 文件形成冲突，而sshd.socket重启之后会发生报错所以进行移除
mv /usr/lib/systemd/system/sshd.service /usr/lib/systemd/system/sshd.service_bak
mv /usr/lib/systemd/system/sshd.socket /usr/lib/systemd/system/sshd.socket_bak
10.添加ssh开机启动
chkconfig sshd on
/etc/init.d/sshd restart
11.重新生成rsa dsa key （这一步是因为怕本地证书不符，所以加上的，可以不进行操作，请自测）
ssh-keygen -t dsa -f /etc/ssh/ssh_host_dsa_key
ssh-keygen -t rsa -f /etc/ssh/ssh_host_rsa_key
12. ssh -V 进行测试
[root@localhost ~]# ssh -V
OpenSSH_8.8p1, OpenSSL 1.1.1l 24 Aug 2021
[root@localhost ~]# openssl version
OpenSSL 1.1.1l 24 Aug 2021
遇到的问题：（真是坑死我了）
1、KexAlgorithms 加密算法不支持报错， 先看一下报错信息
cat /var/log/message
Nov 4 16:03:20 localhost sshd[15961]: Unable to negotiate with 192.100.0.112 port 50581: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1 [preauth]
解释一下报错原因在openssh升级之后，默认不支持这四种加密算法，需要在本地sshd_config添加这四种算法，如果是按照我这种方法安装的只需下面这一条命令即可：
echo 'KexAlgorithms diffie-hellman-group1-sha1,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1' >>/usr/local/openssh/etc/sshd_config
因为现在sshd 调用的配置文件在/usr/local/openssh/etc/sshd_config 而不是在/etc/ssh/sshd_config 最后再用sshd -T | grep kex验证一下，完美解决。
[root@localhost ~]# sshd -T | grep kex
kexalgorithms diffie-hellman-group1-sha1,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1
2、没有匹配的host key found 先看一下报错信息
Nov 4 16:26:11 localhost sshd[16438]: Unable to negotiate with 192.100.0.112 port 50725: no matching host key type found. Their offer: ssh-rsa,ssh-dss [preauth]
这个很简，单确认好sshd调用的配置文件后
echo 'HostKeyAlgorithms +ssh-rsa,ssh-dss' >>/usr/local/openssh/etc/sshd_config
只需一条命令可以完全解决
3、出现create slice 死循环问题 先看日志
Jul 24 08:50:01 example.com systemd: Created slice user-0.slice.Jul 24 08:50:01 example.com systemd: Starting Session 150 of user root.Jul 24 08:50:01 example.com systemd: Started Session 150 of user root.Jul 24 09:00:01 example.com systemd: Created slice user-0.slice.Jul 24 09:00:02 example.com systemd: Starting Session 151 of user root.Jul 24 09:00:02 example.com systemd: Started Session 151 of user root.
解决方法过滤掉相关的日志报警
echo 'if $programname == "systemd" and ($msg contains "Starting Session" or $msg contains "Started Session"
or $msg contains "Created slice" or $msg contains "Starting user-" or $msg contains "Starting User Slice
of" or $msg contains "Removed session" or $msg contains "Removed slice User Slice of" or $msg contains
"Stopping User Slice of") then stop' >/etc/rsyslog.d/ignore-systemd-session-slice.conf
以上就是Openssh升级的所有过程，以及遇到的所有的坑，欢迎留言指导