操作系统版本redhat6、redhat7、CentOS6、CentOS7OpenSSH RPM包制作与升级指南版本兼容性说明OpenSSH 9.3及之前版本需搭配OpenSSL 1.0.1以上OpenSSH 9.4~9.5需搭配OpenSSL 1.1.1以上OpenSSH 9.6需搭配OpenSSL 3.0.0以上Linux 6系统需先升级OpenSSL至1.0.1以上并强制升级glibc至对应版本注意升级之前一定要在测试环境测试有条件要先做快照RPM包制作流程安装依赖包执行以下命令安装基础依赖yum install rpm-build zlib-devel openssl-devel gcc perl-devel pam-devel unzip libXt-devel imake gtk2-devel perl -yLinux 6需额外安装yum -y install krb5-devel创建编译目录建立RPM构建目录结构mkdir -p /root/rpmbuild/{SOURCES,SPECS} cd /root/rpmbuild/SOURCES下载源码包获取OpenSSH源码及辅助组件wget http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-9.3p2.tar.gz wget https://src.fedoraproject.org/repo/pkgs/openssh/x11-ssh-askpass-1.2.4.1.tar.gz --no-check-certificate tar -xvzf openssh-9.3p2.tar.gz修改spec文件配置编译参数cp openssh-9.3p2/contrib/redhat/openssh.spec /root/rpmbuild/SPECS/ cd /root/rpmbuild/SPECS/ sed -i -e s/%define no_x11_askpass 0/%define no_x11_askpass 1/g openssh.spec sed -i -e s/%define no_gnome_askpass 0/%define no_gnome_askpass 1/g openssh.spec sed -i s/BuildRequires: openssl-devel 1.1/#/ openssh.specLinux 6额外配置sed -i s/PreReq: initscripts 5.00/#/ openssh.spec sed -i s/sshd.pam.old/sshd.pam/ openssh.spec执行编译生成RPM包rpmbuild -ba openssh.spec成功后会输出各组件RPM路径包括/root/rpmbuild/RPMS/x86_64/openssh-9.3p2-1.el7.x86_64.rpm /root/rpmbuild/RPMS/x86_64/openssh-server-9.3p2-1.el7.x86_64.rpm升级实施步骤备份关键文件常规系统备份cp /etc/pam.d/{sshd,sshd.bck} cp /etc/ssh/{sshd_config,sshd_config.bck}Linux 6额外备份cp /etc/init.d/{sshd,sshd.bck} cp /usr/sbin/{sshd,sshd.bck}安装新版本使用本地YUM安装cd /root/rpmbuild/RPMS/x86_64/ yum localupdate openssh* -y恢复配置基础配置恢复\mv /etc/ssh/sshd_config.bck /etc/ssh/sshd_config \mv /etc/pam.d/sshd.bck /etc/pam.d/sshd sed -i /.PermitRootLogin./d /etc/ssh/sshd_config echo -e \nPermitRootLogin yes /etc/ssh/sshd_config chmod 600 /etc/ssh/* systemctl restart sshdLinux 6特殊处理\mv /etc/init.d/sshd.bck /etc/init.d/sshd \mv /usr/sbin/sshd.bck /usr/sbin/sshd service sshd restart常见问题处理依赖错误若出现openssl-devel 1.1报错sed -i s/BuildRequires: openssl-devel 1.1/#/ openssh.specX11头文件缺失解决Xlib.h缺失问题yum install libXt-devel imake gtk2-devel openssl-libs -y验证方法通过以下命令确认版本ssh -V
OpenSSH RPM包制作与升级指南
操作系统版本redhat6、redhat7、CentOS6、CentOS7OpenSSH RPM包制作与升级指南版本兼容性说明OpenSSH 9.3及之前版本需搭配OpenSSL 1.0.1以上OpenSSH 9.4~9.5需搭配OpenSSL 1.1.1以上OpenSSH 9.6需搭配OpenSSL 3.0.0以上Linux 6系统需先升级OpenSSL至1.0.1以上并强制升级glibc至对应版本注意升级之前一定要在测试环境测试有条件要先做快照RPM包制作流程安装依赖包执行以下命令安装基础依赖yum install rpm-build zlib-devel openssl-devel gcc perl-devel pam-devel unzip libXt-devel imake gtk2-devel perl -yLinux 6需额外安装yum -y install krb5-devel创建编译目录建立RPM构建目录结构mkdir -p /root/rpmbuild/{SOURCES,SPECS} cd /root/rpmbuild/SOURCES下载源码包获取OpenSSH源码及辅助组件wget http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-9.3p2.tar.gz wget https://src.fedoraproject.org/repo/pkgs/openssh/x11-ssh-askpass-1.2.4.1.tar.gz --no-check-certificate tar -xvzf openssh-9.3p2.tar.gz修改spec文件配置编译参数cp openssh-9.3p2/contrib/redhat/openssh.spec /root/rpmbuild/SPECS/ cd /root/rpmbuild/SPECS/ sed -i -e s/%define no_x11_askpass 0/%define no_x11_askpass 1/g openssh.spec sed -i -e s/%define no_gnome_askpass 0/%define no_gnome_askpass 1/g openssh.spec sed -i s/BuildRequires: openssl-devel 1.1/#/ openssh.specLinux 6额外配置sed -i s/PreReq: initscripts 5.00/#/ openssh.spec sed -i s/sshd.pam.old/sshd.pam/ openssh.spec执行编译生成RPM包rpmbuild -ba openssh.spec成功后会输出各组件RPM路径包括/root/rpmbuild/RPMS/x86_64/openssh-9.3p2-1.el7.x86_64.rpm /root/rpmbuild/RPMS/x86_64/openssh-server-9.3p2-1.el7.x86_64.rpm升级实施步骤备份关键文件常规系统备份cp /etc/pam.d/{sshd,sshd.bck} cp /etc/ssh/{sshd_config,sshd_config.bck}Linux 6额外备份cp /etc/init.d/{sshd,sshd.bck} cp /usr/sbin/{sshd,sshd.bck}安装新版本使用本地YUM安装cd /root/rpmbuild/RPMS/x86_64/ yum localupdate openssh* -y恢复配置基础配置恢复\mv /etc/ssh/sshd_config.bck /etc/ssh/sshd_config \mv /etc/pam.d/sshd.bck /etc/pam.d/sshd sed -i /.PermitRootLogin./d /etc/ssh/sshd_config echo -e \nPermitRootLogin yes /etc/ssh/sshd_config chmod 600 /etc/ssh/* systemctl restart sshdLinux 6特殊处理\mv /etc/init.d/sshd.bck /etc/init.d/sshd \mv /usr/sbin/sshd.bck /usr/sbin/sshd service sshd restart常见问题处理依赖错误若出现openssl-devel 1.1报错sed -i s/BuildRequires: openssl-devel 1.1/#/ openssh.specX11头文件缺失解决Xlib.h缺失问题yum install libXt-devel imake gtk2-devel openssl-libs -y验证方法通过以下命令确认版本ssh -V
