openeuler2203升级openssh9.4p1解决漏洞问题
1,使用rpmbuild将tar包打成rpm包,不喜欢编译升级的,使用RPM升级就方便多了。
想使用openssh的源码包编译安装的,参考这里:
OpenSSH-9.4p1 (linuxfromscratch.org)
2,准备编译环境
[root@centos7-31 ~]# yum install rpm-build zlib-devel openssl-devel gcc perl-devel pam-devel libXt-devel gtk2-devel make perl -y
[root@centos7-31 ~]# dnf install imake -y
[root@centos7-31 ~]# mkdir -p /root/rpmbuild/
[root@centos7-31 ~]# cd /root/rpmbuild
[root@centos7-31 ~]# mkdir BUILD BUILDROOT RPMS SOURCES SPECS SRPMS
3,下载软件包
[root@centos7-31 ~]# cd SOURCES/
[root@centos7-31 ~]# wget https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-9.4p1.tar.gz
[root@centos7-31 ~]# wget https://mirrors.slackware.com/slackware/slackware-14.2/source/xap/x11-ssh-askpass/x11-ssh-askpass-1.2.4.1.tar.gz
4,解压软件包,修改相关配置文件,再重新打包
[root@centos7-31 ~]# tar zxvf openssh-9.4p1.tar.gz
[root@centos7-31 ~]# cd openssh-9.4p1/
[root@centos7-31 ~]# cp /etc/pam.d/sshd contrib/redhat/sshd.pam.old
注意这里还需要修改/root/rpmbuild/SOURCES/openssh-9.4p1/sshd_config文件内容,这样升级后就不修改系统的sshd_config的配置内容。
根据自己情况修改。
[root@centos7-31 ~]# cd /root/rpmbuild/SOURCES/
[root@centos7-31 ~]# tar -zcpf openssh-9.4p1.tar.gz openssh-9.4p1
5,修改打包配置文件。
#将openssh.spec配置文件拷贝到,编译目录下
cp cd /root/rpmbuild/SOURCES/openssh-9.4p1/contrib/redhat/openssh.spec /root/rpmbuild/SPECS/
cd /root/rpmbuild/SPECS
#修改openssh.spec配置
#1.不生成askpass包
cat /root/rpmbuild/SPECS/openssh.spec | grep no_gnome_askpass
cat /root/rpmbuild/SPECS/openssh.spec | grep no_x11_askpass
sed -i -e "s/%global no_gnome_askpass 0/%global no_gnome_askpass 1/g" openssh.spec
sed -i -e "s/%global no_x11_askpass 0/%global no_x11_askpass 1/g" openssh.spec
#2.解决openssl-devel < 1.1报错
cat /root/rpmbuild/SPECS/openssh.spec | grep openssl-devel
sed -i '/openssl-devel < 1.1/s/^/#/' openssh.spec
#3.解决PreReq报错
cat /root/rpmbuild/SPECS/openssh.spec | grep PreReq
sed -i '/PreReq/s/^/#/' openssh.spec
#4.解决Obsoletes报错
cat /root/rpmbuild/SPECS/openssh.spec | grep Obsoletes
sed -i '/Obsoletes:/s/^/#/' openssh.spec
6,打包软件
[root@centos7-31 ~]# rpmbuild -ba openssh.spec
7,删除旧版软件,并安装openssh9.4p1
[root@centos7-31 ~]# cd /root/rpmbuild/RPMS/x86_64/
[root@centos7-31 ~]# rpm -Uvh openssh-*.rpm
或是使用以下命令删除旧软件包,再安装。
[root@centos7-31 ~]# rpm -e $(rpm -qa |grep openssh) --nodeps
[root@centos7-31 ~]# rpm -ivh openssh-*.rpm
8,检查配置文件内容是否有误,启用sshd服务
[root@centos7-31 ~]# sshd -t
[root@centos7-31 ~]# systemctl disable sshd
[root@centos7-31 ~]# systemctl enable sshd
[root@centos7-31 ~]# systemctl restart sshd
以下是openssh9.4p1的rpm包下载地址
以下是打包配置文件,使用此文件可解决没有ssh-copy-id命令的问题
转载请标明出处【openeuler2203升级openssh9.4p1解决漏洞问题】。
《www.micoder.cc》 虚拟化云计算,系统运维,安全技术服务.
标签:p1,openeuler2203,openssh,31,centos7,rpmbuild,openssh9.4,root,spec From: https://www.cnblogs.com/cheyunhua/p/17975735