CentOS7下制作OpenSSH 9.4p1 RPM包,并验证升级

news2024/11/28 10:57:15

1、准备条件

1）openssh-8.4p1.tar.gz源码包

https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-9.4p1.tar.gz
wget https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-9.4p1.tar.gz --no-check-certificate

2）x11-ssh-askpass-1.2.4.1.tar.gz 源码包

wget https://src.fedoraproject.org/repo/pkgs/openssh/x11-ssh-askpass-1.2.4.1.tar.gz/8f2e41f3f7eaa8543a2440454637f3c3/x11-ssh-

2、rpm-build以及编译打包环境搭建

yum install rpm-build zlib-devel openssl-devel gcc perl-devel pam-devel

mkdir -p /root/rpmbuild/SOURCES
mkdir -p /root/rpmbuild/SPECS
cp /root/openssh-9.4p1.tar.gz /root/rpmbuild/SOURCES/
cp /root/x11-ssh-askpass-1.2.4.1.tar.gz /root/rpmbuild/SOURCES/
tar -zxf openssh-9.4p1.tar.gz -C /opt
cp /opt/openssh-9.4p1/contrib/redhat/openssh.spec /root/rpmbuild/SPECS/
chown sshd:sshd /root/rpmbuild/SPECS/openssh.spec

3、修改openssh.spec 并进行打包

 vi openssh.spec 

将原先openssh.spec中的

%global no_x11_askpass 0

%global no_gnome_askpass 0 

修改为

%global no_x11_askpass 1 

%global no_gnome_askpass 1

并注释掉#BuildRequires: openssl-devel < 1.1

这时就可以rpmbuild打包了

rpmbuild -ba openssh.spec

4、压缩并下载生成的rpm包

cd /root/rpmbuild/RPMS/x86_64
ll
tar -zcvf openssh-9.4p1_rpm_package.tar.gz *.rpm
sz openssh-9.4p1_rpm_package.tar.gz

5、升级openssh 8.4p1进行验证

在另外一台CentOS7.6机器上升级openssh版本

1)上传解压openssh-8.4p1_rpm_package.tar.gz

cd /opt
tar -zxvf openssh-9.4p1_rpm_package.tar.gz

复制

解压出来的如下4个rpm

2)备份配置后rpm -Uvh升级到openssh9.4p1

mkdir /etc/sshconfig_backup
cp /etc/ssh/sshd_config /etc/sshconfig_backup/
cp /etc/pam.d/sshd /etc/sshconfig_backup/pam.d_sshd

pm -Uvh openssh*.rpm进行手动升级

rpm -Uvh openssh*.rpm
或
yum localinstall  openssh*.rpm

3)还原配置文件

cp /etc/sshconfig_backup/sshd_config /etc/ssh/sshd_config 
cp /etc/sshconfig_backup/pam.d_sshd /etc/pam.d/sshd
并加上PermitRootLogin yes允许root用户登录
sed -i "s/#PermitRootLogin yes/PermitRootLogin yes/g" /etc/ssh/sshd_config
cat /etc/ssh/sshd_config | grep PermitRootLogin
删除/etc/ssh/目录下相关key文件，否则重启sshd服务会报错
rm -rf /etc/ssh/ssh_host_*
service sshd restart