vault backup: 2026-01-05 14:26:17
This commit is contained in:
windyboy
@@ -0,0 +1,75 @@
|
||||
|
||||
问题 5：
|
||||
```
|
||||
（1）缺乏对通信设备可信验证方面的安全设计要求；
|
||||
（2）现有的通信设备存在未能实现操作系统到上层应用的信任链的情况，系统运行过程中的可信检验不全面；
|
||||
■系统引导
|
||||
■重要系统程序或文件
|
||||
■重要配置参数
|
||||
■通信应用连接过程
|
||||
（3）未采用第三方工具实现相关系统的可信验证。
|
||||
```
|
||||
建议：
|
||||
```
|
||||
（1）建议在管理规范文档内对通信设备可信验证方面的安全设计提出要求；
|
||||
（2）建议系统实现对所有可执行环节进行可信验证，包括：
|
||||
运行过程中的可信检验：
|
||||
■系统引导
|
||||
■重要系统程序或文件
|
||||
■重要配置参数
|
||||
■通信应用连接过程；
|
||||
（3）本身设备不支持的情况下，可采用第三方工具实现可信的验证功能；
|
||||
（4）对整体的可信验证措施做到：
|
||||
■对可信性破坏报警
|
||||
■将可信性验证结果形成审计记录
|
||||
■对可信性审计的动态关联感知。
|
||||
```
|
||||
|
||||
|
||||
|
||||
(31 条)问题 7,12,16,28,34,45,51：
|
||||
```
|
||||
（1）系统未采取完整性保护措施保证重要业务数据在存储过程中的完整性。
|
||||
```
|
||||
建议：
|
||||
```
|
||||
（1）系统配置使用加密算法对重要数据在存储过程中采取完整性保护措施。
|
||||
```
|
||||
|
||||
|
||||
|
||||
问题 9,13,17:
|
||||
```
|
||||
（1）系统未采取加密措施对重要业务数据的存储实现加密保障。
|
||||
```
|
||||
建议：
|
||||
```
|
||||
（1）系统使用加密算法对重要数据在存储过程中采取保密性保护措施；
|
||||
（2）在存储过程中需要加密保护的数据类型包括（不限于）鉴别数据、配置数据、重要业务数据、重要个人信息数据。
|
||||
```
|
||||
|
||||
|
||||
(32条)问题 25,33,42,50,59,71,79,88,97,102,107,112,118,125,133...:
|
||||
```
|
||||
（1）未采取措施对所有主体和客体设置敏感标记。
|
||||
```
|
||||
建议:
|
||||
```
|
||||
（1）建议对数据库系统应对重要信息资源设置敏感标记，数据库不支持敏感标记的，应在系统级生成敏感标记，使系统整体支持强制访问控制机制；
|
||||
（2）依据安全策略严格控制用户对有敏感标记重要信息资源的操作。
|
||||
```
|
||||
|
||||
|
||||
问题 26:
|
||||
```
|
||||
（1）数据库系统未设定有效的终端接入方式及范围限制措施；
|
||||
■数据库系统未对账号进行IP限制，host = %
|
||||
（2）数据库系统未对登录用户数量进行限制。
|
||||
```
|
||||
建议:
|
||||
```
|
||||
（1）数据库系统针设定有效的终端接入策略，对通过网络进行管理的终端进行限制。 ■数据库系统对账号进行IP限制，host ≠ %，限制固定IP段登录
|
||||
数据库系统对登录用户数量进行限制，如配置max_connections为50（具体数值需根据实际业务需求调整）。
|
||||
```
|
||||
|
||||
|
||||
@@ -0,0 +1,636 @@
|
||||
|
||||
|
||||
login jump server: 10.160.20.112
|
||||
|
||||
|
||||
|
||||
```bash
|
||||
ssh -V
|
||||
OpenSSH_8.2p1, OpenSSL 1.1.1f 31 Mar 2020
|
||||
|
||||
```
|
||||
|
||||
```bash
|
||||
uname -a
|
||||
Linux v10-200g-clone-10 4.19.90-20.1stable.ky10.aarch64 #1 SMP Sun Aug 23 11:31:17 CST 2020 aarch64 aarch64 aarch64 GNU/Linux
|
||||
```
|
||||
|
||||
|
||||
```bash
|
||||
uname -m
|
||||
aarch64
|
||||
getenforce
|
||||
Disabled
|
||||
```
|
||||
|
||||
|
||||
|
||||
备份配置
|
||||
|
||||
```bash
|
||||
cp -a /etc/ssh /etc/ssh.bak-$(date +%F)
|
||||
```
|
||||
|
||||
|
||||
依赖安装
|
||||
|
||||
```bash
|
||||
dnf groupinstall "Development Tools" -y
|
||||
```
|
||||
```bash
|
||||
dnf install -y openssl-devel zlib-devel pam-devel libedit-devel krb5-devel audit-libs-devel libselinux-devel libcap-ng-devel systemd-devel
|
||||
```
|
||||
|
||||
|
||||
编译
|
||||
|
||||
```bash
|
||||
wget https://codeload.github.com/openssh/openssh-portable/zip/refs/heads/V_10_2
|
||||
```
|
||||
|
||||
```bash
|
||||
unzip openssh-portable-V_10_2.zip
|
||||
cd openssh-portable-V_10_2
|
||||
```
|
||||
|
||||
```bash
|
||||
./configure --prefix=/usr --sysconfdir=/etc/ssh --sbindir=/usr/sbin --with-pam --with-privsep-path=/var/lib/sshd
|
||||
```
|
||||
|
||||
```bash
|
||||
make -j"$(nproc)"
|
||||
```
|
||||
|
||||
```bash
|
||||
make install
|
||||
```
|
||||
|
||||
|
||||
```bash
|
||||
chmod 600 /etc/ssh/ssh_host_rsa_key /etc/ssh/ssh_host_ecdsa_key /etc/ssh/ssh_host_ed25519_key
|
||||
```
|
||||
|
||||
- 找到对应行，前面加 #，或直接删除。例如：
|
||||
```bash
|
||||
vi /etc/ssh/sshd_config
|
||||
```
|
||||
|
||||
|
||||
- # GSSAPIAuthentication no
|
||||
|
||||
- # GSSAPICleanupCredentials yes
|
||||
|
||||
- # RSAAuthentication no
|
||||
|
||||
- # RhostsRSAAuthentication no
|
||||
|
||||
```bash
|
||||
/usr/sbin/sshd -t -f /etc/ssh/sshd_config
|
||||
```
|
||||
|
||||
|
||||
|
||||
```
|
||||
chmod 600 /etc/ssh/ssh_host_rsa_key /etc/ssh/ssh_host_ecdsa_key /etc/ssh/ssh_host_ed25519_key
|
||||
```
|
||||
|
||||
|
||||
```bash
|
||||
systemctl daemon-reload
|
||||
```
|
||||
|
||||
```
|
||||
systemctl enable --now sshd
|
||||
```
|
||||
|
||||
```
|
||||
systemctl status sshd
|
||||
```
|
||||
|
||||
```
|
||||
journalctl -u sshd -b
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
vi /etc/crypto-policies/back-ends/opensshserver.config
|
||||
```
|
||||
|
||||
```
|
||||
dnf install -y rpm-build rpmlint
|
||||
```
|
||||
|
||||
制作安装包
|
||||
|
||||
```
|
||||
dnf install -y ruby ruby-devel gcc make rpm-build
|
||||
```
|
||||
|
||||
```
|
||||
mkdir -p ~/buildroot
|
||||
```
|
||||
|
||||
```
|
||||
install -D /usr/sbin/sshd ~/buildroot/usr/sbin/sshd
|
||||
install -D /usr/bin/ssh ~/buildroot/usr/bin/ssh
|
||||
install -D /usr/bin/scp ~/buildroot/usr/bin/scp
|
||||
install -D /usr/bin/sftp ~/buildroot/usr/bin/sftp
|
||||
install -D /usr/bin/ssh-keygen ~/buildroot/usr/bin/ssh-keygen
|
||||
install -D /usr/bin/ssh-agent ~/buildroot/usr/bin/ssh-agent
|
||||
install -D /usr/bin/ssh-add ~/buildroot/usr/bin/ssh-add
|
||||
install -D /usr/bin/ssh-keyscan ~/buildroot/usr/bin/ssh-keyscan
|
||||
rsync -aR /usr/libexec/ssh/ ~/buildroot/ 2>/dev/null || true rsync -aR /usr/lib/ssh/ ~/buildroot/ 2>/dev/null || true
|
||||
install -D /etc/ssh/sshd_config ~/buildroot/etc/ssh/sshd_config
|
||||
install -D /etc/ssh/ssh_config ~/buildroot/etc/ssh/ssh_config
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
test -f /usr/lib/systemd/system/sshd.service && install -D /usr/lib/systemd/system/sshd.service ~/buildroot/usr/lib/systemd/system/sshd.service || true
|
||||
```
|
||||
|
||||
~/rpmbuild/SPECS/openssh-custom.spec
|
||||
|
||||
```
|
||||
Name: openssh
|
||||
Version: 10.2
|
||||
Release: 1%{?dist}
|
||||
Summary: An open source implementation of SSH protocol version 2
|
||||
|
||||
License: BSD
|
||||
URL: https://www.openssh.com/
|
||||
Source0: https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz
|
||||
|
||||
BuildRequires: gcc
|
||||
BuildRequires: make
|
||||
BuildRequires: openssl-devel >= 1.1.1
|
||||
BuildRequires: zlib-devel
|
||||
BuildRequires: pam-devel
|
||||
BuildRequires: systemd
|
||||
BuildRequires: libselinux-devel
|
||||
|
||||
%description
|
||||
SSH (Secure SHell) is a program for logging into and executing
|
||||
commands on a remote machine. SSH is intended to replace rlogin and
|
||||
rsh, and to provide secure encrypted communications between two
|
||||
untrusted hosts over an insecure network. This package includes the
|
||||
core files necessary for both the OpenSSH client and server.
|
||||
|
||||
%package clients
|
||||
Summary: SSH client applications
|
||||
Requires: %{name} = %{version}-%{release}
|
||||
|
||||
%description clients
|
||||
OpenSSH clients, including ssh, scp, and sftp.
|
||||
|
||||
%package server
|
||||
Summary: SSH server daemon
|
||||
Requires: %{name} = %{version}-%{release}
|
||||
Requires(post): systemd
|
||||
Requires(preun): systemd
|
||||
Requires(postun): systemd
|
||||
|
||||
%description server
|
||||
OpenSSH server daemon (sshd) with support for the new sshd-session
|
||||
and sshd-auth architecture introduced in OpenSSH 9.8+.
|
||||
|
||||
%prep
|
||||
%setup -q -n openssh-portable-V_10_2
|
||||
|
||||
%build
|
||||
%configure \
|
||||
--sysconfdir=%{_sysconfdir}/ssh \
|
||||
--libexecdir=%{_libexecdir}/openssh \
|
||||
--datadir=%{_datadir}/openssh \
|
||||
--with-pam \
|
||||
--with-selinux \
|
||||
--with-privsep-path=/var/empty/sshd \
|
||||
--with-pid-dir=/run \
|
||||
--with-ssl-engine \
|
||||
--disable-strip
|
||||
|
||||
make %{?_smp_mflags}
|
||||
|
||||
%install
|
||||
rm -rf %{buildroot}
|
||||
make install DESTDIR=%{buildroot}
|
||||
|
||||
# Install systemd unit files
|
||||
install -d %{buildroot}%{_unitdir}
|
||||
|
||||
# Create sshd.service file
|
||||
cat > %{buildroot}%{_unitdir}/sshd.service << 'SVCEOF'
|
||||
[Unit]
|
||||
Description=OpenSSH server daemon
|
||||
Documentation=man:sshd(8) man:sshd_config(5)
|
||||
After=network.target sshd-keygen.target
|
||||
Wants=sshd-keygen.target
|
||||
|
||||
[Service]
|
||||
Type=notify
|
||||
EnvironmentFile=-/etc/sysconfig/sshd
|
||||
ExecStart=/usr/sbin/sshd -D $OPTIONS
|
||||
ExecReload=/bin/kill -HUP $MAINPID
|
||||
KillMode=process
|
||||
Restart=on-failure
|
||||
RestartSec=42s
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
SVCEOF
|
||||
|
||||
# Create sshd-keygen service
|
||||
cat > %{buildroot}%{_unitdir}/sshd-keygen@.service << 'KEYGENEOF'
|
||||
[Unit]
|
||||
Description=OpenSSH Server Key Generation
|
||||
ConditionFileNotEmpty=|!/etc/ssh/ssh_host_rsa_key
|
||||
ConditionFileNotEmpty=|!/etc/ssh/ssh_host_ecdsa_key
|
||||
ConditionFileNotEmpty=|!/etc/ssh/ssh_host_ed25519_key
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
ExecStart=/usr/bin/ssh-keygen -A
|
||||
RemainAfterExit=yes
|
||||
KEYGENEOF
|
||||
|
||||
# Create sshd-keygen target
|
||||
cat > %{buildroot}%{_unitdir}/sshd-keygen.target << 'KEYTAREOF'
|
||||
[Unit]
|
||||
Description=OpenSSH Server Key Generation
|
||||
Documentation=man:sshd(8) man:ssh-keygen(1)
|
||||
ConditionFileNotEmpty=|!/etc/ssh/ssh_host_rsa_key
|
||||
ConditionFileNotEmpty=|!/etc/ssh/ssh_host_ecdsa_key
|
||||
ConditionFileNotEmpty=|!/etc/ssh/ssh_host_ed25519_key
|
||||
KEYTAREOF
|
||||
|
||||
# Create empty sshd privsep directory
|
||||
install -d -m 0711 %{buildroot}/var/empty/sshd
|
||||
|
||||
# Install PAM configuration
|
||||
install -d %{buildroot}%{_sysconfdir}/pam.d
|
||||
cat > %{buildroot}%{_sysconfdir}/pam.d/sshd << 'PAMEOF'
|
||||
#%PAM-1.0
|
||||
auth substack password-auth
|
||||
auth include postlogin
|
||||
account required pam_sepermit.so
|
||||
account required pam_nologin.so
|
||||
account include password-auth
|
||||
password include password-auth
|
||||
session required pam_selinux.so close
|
||||
session required pam_loginuid.so
|
||||
session required pam_selinux.so open env_params
|
||||
session required pam_namespace.so
|
||||
session optional pam_keyinit.so force revoke
|
||||
session optional pam_motd.so
|
||||
session include password-auth
|
||||
session include postlogin
|
||||
PAMEOF
|
||||
|
||||
# Modify sshd_config to enable root login
|
||||
sed -i 's/#PermitRootLogin prohibit-password/PermitRootLogin yes/' \
|
||||
%{buildroot}%{_sysconfdir}/ssh/sshd_config
|
||||
|
||||
# Ensure PermitRootLogin is set
|
||||
if ! grep -q "^PermitRootLogin" %{buildroot}%{_sysconfdir}/ssh/sshd_config; then
|
||||
echo "PermitRootLogin yes" >> %{buildroot}%{_sysconfdir}/ssh/sshd_config
|
||||
fi
|
||||
|
||||
# Create sysconfig directory
|
||||
install -d %{buildroot}%{_sysconfdir}/sysconfig
|
||||
cat > %{buildroot}%{_sysconfdir}/sysconfig/sshd << 'SYSCONFIGEOF'
|
||||
# Configuration file for the sshd service.
|
||||
|
||||
# Options for sshd
|
||||
OPTIONS=""
|
||||
SYSCONFIGEOF
|
||||
|
||||
%files
|
||||
%license LICENCE
|
||||
%doc ChangeLog CREDITS OVERVIEW PROTOCOL* README*
|
||||
%dir %{_sysconfdir}/ssh
|
||||
%config(noreplace) %{_sysconfdir}/ssh/moduli
|
||||
%config(noreplace) %{_sysconfdir}/ssh/ssh_config
|
||||
%{_mandir}/man5/moduli.5*
|
||||
%{_mandir}/man5/ssh_config.5*
|
||||
%{_mandir}/man5/sshd_config.5*
|
||||
|
||||
%files clients
|
||||
%{_bindir}/ssh
|
||||
%{_bindir}/scp
|
||||
%{_bindir}/sftp
|
||||
%{_bindir}/ssh-add
|
||||
%{_bindir}/ssh-agent
|
||||
%{_bindir}/ssh-keygen
|
||||
%{_bindir}/ssh-keyscan
|
||||
%dir %{_libexecdir}/openssh
|
||||
%{_libexecdir}/openssh/ssh-keysign
|
||||
%{_libexecdir}/openssh/ssh-pkcs11-helper
|
||||
%{_libexecdir}/openssh/ssh-sk-helper
|
||||
%{_mandir}/man1/scp.1*
|
||||
%{_mandir}/man1/sftp.1*
|
||||
%{_mandir}/man1/ssh.1*
|
||||
%{_mandir}/man1/ssh-add.1*
|
||||
%{_mandir}/man1/ssh-agent.1*
|
||||
%{_mandir}/man1/ssh-keygen.1*
|
||||
%{_mandir}/man1/ssh-keyscan.1*
|
||||
%{_mandir}/man8/ssh-keysign.8*
|
||||
%{_mandir}/man8/ssh-pkcs11-helper.8*
|
||||
%{_mandir}/man8/ssh-sk-helper.8*
|
||||
|
||||
%files server
|
||||
%{_sbindir}/sshd
|
||||
%dir %{_libexecdir}/openssh
|
||||
%{_libexecdir}/openssh/sftp-server
|
||||
%{_libexecdir}/openssh/sshd-session
|
||||
%{_libexecdir}/openssh/sshd-auth
|
||||
%{_unitdir}/sshd.service
|
||||
%{_unitdir}/sshd-keygen@.service
|
||||
%{_unitdir}/sshd-keygen.target
|
||||
%dir %attr(0711,root,root) /var/empty/sshd
|
||||
%config(noreplace) %{_sysconfdir}/ssh/sshd_config
|
||||
%config(noreplace) %{_sysconfdir}/pam.d/sshd
|
||||
%config(noreplace) %{_sysconfdir}/sysconfig/sshd
|
||||
%{_mandir}/man8/sshd.8*
|
||||
%{_mandir}/man8/sftp-server.8*
|
||||
|
||||
%pre server
|
||||
# Create sshd user if it doesn't exist
|
||||
getent group sshd >/dev/null || groupadd -r sshd
|
||||
getent passwd sshd >/dev/null || \
|
||||
useradd -r -g sshd -d /var/empty/sshd -s /sbin/nologin \
|
||||
-c "Privilege-separated SSH" sshd
|
||||
exit 0
|
||||
|
||||
%post server
|
||||
%systemd_post sshd.service
|
||||
# Generate host keys if they don't exist
|
||||
/usr/bin/ssh-keygen -A >/dev/null 2>&1 || :
|
||||
|
||||
%preun server
|
||||
%systemd_preun sshd.service
|
||||
|
||||
%postun server
|
||||
%systemd_postun_with_restart sshd.service
|
||||
|
||||
%changelog
|
||||
* Wed Oct 22 2025 System Administrator <admin@example.com> - 10.2-1
|
||||
- Update to OpenSSH 10.2
|
||||
- Enable PermitRootLogin by default
|
||||
- Add support for sshd-session and sshd-auth
|
||||
- Include systemd service files
|
||||
- Add PAM configuration
|
||||
- Create privilege separation user and directory
|
||||
|
||||
```
|
||||
|
||||
|
||||
|
||||
```
|
||||
find ~/rpmbuild/BUILD/openssh-10.2-1.ky10.*/usr/libexec/openssh/ -type f
|
||||
```
|
||||
|
||||
|
||||
|
||||
```
|
||||
处理完：
|
||||
117
|
||||
177
|
||||
|
||||
不能ssh
|
||||
102
|
||||
|
||||
```
|
||||
|
||||
|
||||
|
||||
处理102:
|
||||
|
||||
1. 下载新编译的openssh
|
||||
```
|
||||
-rw-r--r-- 1 root root 209096 Oct 22 14:45 openssh-10.2-1.ky10.ky10.aarch64.rpm
|
||||
-rw-r--r-- 1 root root 872348 Oct 22 14:45 openssh-clients-10.2-1.ky10.ky10.aarch64.rpm
|
||||
-rw-r--r-- 1 root root 576228 Oct 22 14:45 openssh-server-10.2-1.ky10.ky10.aarch64.rpm
|
||||
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
2. 修改 /etc/ssh/sshd_config
|
||||
注释选项
|
||||
|
||||
```
|
||||
GSSAPIAuthentication
|
||||
```
|
||||
|
||||
```
|
||||
GSSAPICleanupCredentials
|
||||
```
|
||||
|
||||
```
|
||||
RSAAuthentication
|
||||
```
|
||||
|
||||
```
|
||||
RhostsRSAAuthentication
|
||||
```
|
||||
|
||||
注释
|
||||
|
||||
```
|
||||
/etc/crypto-policies/back-ends/opensshserver.config
|
||||
```
|
||||
|
||||
|
||||
3. 修改
|
||||
```
|
||||
chmod 600 /etc/ssh/ssh_*
|
||||
```
|
||||
|
||||
|
||||
|
||||
3. 安装
|
||||
```
|
||||
dnf install ./openssh-*
|
||||
```
|
||||
|
||||
4. 测试
|
||||
|
||||
```
|
||||
/usr/sbin/sshd -t
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
/usr/sbin/sshd -D -d
|
||||
```
|
||||
|
||||
```
|
||||
systemctl daemon-reload
|
||||
systemctl enable --now sshd
|
||||
systemctl start sshd
|
||||
systemctl status sshd
|
||||
```
|
||||
|
||||
|
||||
112:
|
||||
安装 openssh 10 with openssl 3
|
||||
|
||||
生成key
|
||||
```
|
||||
/usr/local/openssh-10/bin/ssh-keygen -t rsa -b 4096 -f /usr/local/openssh-10/etc/ssh_host_rsa_key -N "" -q
|
||||
/usr/local/openssh-10/bin/ssh-keygen -t ecdsa -b 521 -f /usr/local/openssh-10/etc/ssh_host_ecdsa_key -N "" -q
|
||||
/usr/local/openssh-10/bin/ssh-keygen -t ed25519 -f /usr/local/openssh-10/etc/ssh_host_ed25519_key -N "" -q
|
||||
```
|
||||
|
||||
测试语法
|
||||
|
||||
```
|
||||
/usr/local/openssh-10/sbin/sshd -t -f /usr/local/openssh-10/etc/sshd_config
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
mkdir -p /var/empty
|
||||
chown root:root /var/empty
|
||||
chmod 755 /var/empty
|
||||
```
|
||||
|
||||
|
||||
测试启动
|
||||
```
|
||||
/usr/local/openssh-10/sbin/sshd -p 2222 -f /usr/local/openssh-10/etc/sshd_config -D
|
||||
```
|
||||
|
||||
|
||||
备份
|
||||
```
|
||||
mkdir -p /usr/local/openssh-backup
|
||||
cp /usr/sbin/sshd /usr/local/openssh-backup/
|
||||
cp /usr/bin/ssh* /usr/local/openssh-backup/
|
||||
cp -r /etc/ssh /usr/local/openssh-backup/etc_ssh_$(date +%F)
|
||||
```
|
||||
|
||||
替换
|
||||
```
|
||||
ln -sf /usr/local/openssh-10/sbin/sshd /usr/sbin/sshd
|
||||
ln -sf /usr/local/openssh-10/bin/ssh /usr/bin/ssh
|
||||
ln -sf /usr/local/openssh-10/bin/scp /usr/bin/scp
|
||||
ln -sf /usr/local/openssh-10/bin/sftp /usr/bin/sftp
|
||||
ln -sf /usr/local/openssh-10/bin/ssh-keygen /usr/bin/ssh-keygen
|
||||
ln -sf /usr/local/openssh-10/bin/ssh-keyscan /usr/bin/ssh-keyscan
|
||||
ln -sf /usr/local/openssh-10/bin/ssh-agent /usr/bin/ssh-agent
|
||||
ln -sf /usr/local/openssh-10/bin/ssh-add /usr/bin/ssh-add
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
cp /usr/lib/systemd/system/sshd.service /etc/systemd/system/sshd.service
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
sed -i 's|ExecStart=.*|ExecStart=/usr/local/openssh-10/sbin/sshd -D -f /usr/local/openssh-10/etc/sshd_config|' /etc/systemd/system/sshd.service
|
||||
|
||||
sed -i '/^\[Service\]/a Environment="LD_LIBRARY_PATH=/usr/local/openssl-3/lib"' /etc/systemd/system/sshd.service
|
||||
|
||||
```
|
||||
|
||||
```
|
||||
sudo systemctl daemon-reexec
|
||||
sudo systemctl daemon-reload
|
||||
```
|
||||
|
||||
```
|
||||
sudo systemctl restart sshd
|
||||
sudo systemctl status sshd
|
||||
```
|
||||
|
||||
|
||||
10.160.20.112, 10.160.20.113,10.160.20.114,10.160.20.115,10.160.20.116,10.160.20.118,10.160.20.119,10.160.20.107
|
||||
|
||||
|
||||
|
||||
```
|
||||
export LD_LIBRARY_PATH=/usr/local/openssl-3/lib:/usr/local/openssl-3/lib64
|
||||
```
|
||||
|
||||
```
|
||||
/usr/local/openssl-3/bin/openssl version -a
|
||||
/usr/local/openssh-10/bin/ssh -V
|
||||
```
|
||||
|
||||
|
||||
|
||||
生成key
|
||||
```
|
||||
/usr/local/openssh-10/bin/ssh-keygen -t rsa -b 4096 -f /usr/local/openssh-10/etc/ssh_host_rsa_key -N "" -q
|
||||
/usr/local/openssh-10/bin/ssh-keygen -t ecdsa -b 521 -f /usr/local/openssh-10/etc/ssh_host_ecdsa_key -N "" -q
|
||||
/usr/local/openssh-10/bin/ssh-keygen -t ed25519 -f /usr/local/openssh-10/etc/ssh_host_ed25519_key -N "" -q
|
||||
```
|
||||
|
||||
测试语法
|
||||
|
||||
```
|
||||
/usr/local/openssh-10/sbin/sshd -t -f /usr/local/openssh-10/etc/sshd_config
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
mkdir -p /var/empty
|
||||
chown root:root /var/empty
|
||||
chmod 755 /var/empty
|
||||
```
|
||||
|
||||
|
||||
测试启动
|
||||
```
|
||||
/usr/local/openssh-10/sbin/sshd -p 2222 -f /usr/local/openssh-10/etc/sshd_config -D
|
||||
```
|
||||
|
||||
|
||||
备份
|
||||
```
|
||||
mkdir -p /usr/local/openssh-backup
|
||||
cp /usr/sbin/sshd /usr/local/openssh-backup/
|
||||
cp /usr/bin/ssh* /usr/local/openssh-backup/
|
||||
cp -r /etc/ssh /usr/local/openssh-backup/etc_ssh_$(date +%F)
|
||||
```
|
||||
|
||||
|
||||
替换
|
||||
```
|
||||
ln -sf /usr/local/openssh-10/sbin/sshd /usr/sbin/sshd
|
||||
ln -sf /usr/local/openssh-10/bin/ssh /usr/bin/ssh
|
||||
ln -sf /usr/local/openssh-10/bin/scp /usr/bin/scp
|
||||
ln -sf /usr/local/openssh-10/bin/sftp /usr/bin/sftp
|
||||
ln -sf /usr/local/openssh-10/bin/ssh-keygen /usr/bin/ssh-keygen
|
||||
ln -sf /usr/local/openssh-10/bin/ssh-keyscan /usr/bin/ssh-keyscan
|
||||
ln -sf /usr/local/openssh-10/bin/ssh-agent /usr/bin/ssh-agent
|
||||
ln -sf /usr/local/openssh-10/bin/ssh-add /usr/bin/ssh-add
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
cp /usr/lib/systemd/system/sshd.service /etc/systemd/system/sshd.service
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
sed -i 's|ExecStart=.*|ExecStart=/usr/local/openssh-10/sbin/sshd -D -f /usr/local/openssh-10/etc/sshd_config|' /etc/systemd/system/sshd.service
|
||||
|
||||
sed -i '/^\[Service\]/a Environment="LD_LIBRARY_PATH=/usr/local/openssl-3/lib"' /etc/systemd/system/sshd.service
|
||||
|
||||
```
|
||||
|
||||
```
|
||||
sudo systemctl daemon-reexec
|
||||
sudo systemctl daemon-reload
|
||||
```
|
||||
|
||||
```
|
||||
sudo systemctl restart sshd
|
||||
sudo systemctl status sshd
|
||||
```
|
||||
|
||||
|
||||
@@ -0,0 +1,405 @@
|
||||
|
||||
|
||||
|
||||
---
|
||||
|
||||
# 🧭 GCC 13.3.0 从源码构建指南（适用于 Kylin Linux Advanced Server V10 / RHEL 系）
|
||||
|
||||
目标：在 `/opt/gcc-13` 构建一套完全独立的新 GCC，不覆盖系统自带版本。
|
||||
附带可选 `/opt/binutils-2.40`，用于提升链接器兼容性。
|
||||
|
||||
---
|
||||
|
||||
## 一、系统准备
|
||||
|
||||
### 1️⃣ 更新系统并安装构建依赖
|
||||
|
||||
```bash
|
||||
sudo dnf groupinstall "Development Tools" -y
|
||||
sudo dnf install -y \
|
||||
gcc gcc-c++ make bison flex texinfo git wget curl xz gawk perl python3 \
|
||||
glibc-devel glibc-headers libstdc++-devel zlib-devel \
|
||||
gmp-devel mpfr-devel libmpc-devel isl-devel
|
||||
```
|
||||
|
||||
> 若系统仓库的 `gmp/mpfr/mpc/isl` 太旧，也没关系，下面会采用 **内联构建**。
|
||||
|
||||
---
|
||||
|
||||
## 二、可选但推荐：升级 binutils (2.40)
|
||||
|
||||
### 2️⃣ 构建并安装
|
||||
|
||||
```bash
|
||||
cd soft
|
||||
wget https://mirrors.aliyun.com/gnu/binutils/binutils-2.40.tar.gz
|
||||
tar -xzf binutils-2.40.tar.gz
|
||||
mkdir build-binutils-2.40 && cd build-binutils-2.40
|
||||
|
||||
../binutils-2.40/configure \
|
||||
--prefix=/usr/local/binutils-2.40 \
|
||||
--disable-multilib \
|
||||
--enable-gold \
|
||||
--enable-ld=default \
|
||||
--enable-plugins
|
||||
|
||||
make -j"$(nproc)"
|
||||
make install
|
||||
```
|
||||
|
||||
### 3️⃣ 激活新版 binutils
|
||||
|
||||
```bash
|
||||
export PATH=/usr/local/binutils-2.40/bin:$PATH
|
||||
```
|
||||
|
||||
验证：
|
||||
|
||||
```bash
|
||||
ld --version | head -1
|
||||
as --version | head -1
|
||||
```
|
||||
|
||||
输出应含 “2.40”。
|
||||
|
||||
> ✅ 若系统已有较新 binutils，可跳过本节。
|
||||
|
||||
---
|
||||
|
||||
## 三、下载并准备 GCC 13.3.0 源码
|
||||
|
||||
### 4️⃣ 获取源码
|
||||
|
||||
```bash
|
||||
cd soft
|
||||
wget https://mirrors.aliyun.com/gnu/gcc/gcc-13.3.0/gcc-13.3.0.tar.xz
|
||||
tar -xf gcc-13.3.0.tar.xz
|
||||
cd gcc-13.3.0
|
||||
```
|
||||
|
||||
### 5️⃣ 下载依赖库（推荐）
|
||||
|
||||
```bash
|
||||
./contrib/download_prerequisites
|
||||
```
|
||||
|
||||
该脚本会自动下载合适的：
|
||||
|
||||
- GMP
|
||||
|
||||
- MPFR
|
||||
|
||||
- MPC
|
||||
|
||||
- ISL
|
||||
|
||||
|
||||
> 若离线环境，可在其他机器下载后放到以下目录：
|
||||
>
|
||||
> ```
|
||||
> gcc-13.3.0/gmp/
|
||||
> gcc-13.3.0/mpfr/
|
||||
> gcc-13.3.0/mpc/
|
||||
> gcc-13.3.0/isl/
|
||||
> ```
|
||||
|
||||
---
|
||||
|
||||
```
|
||||
cat > contrib/download_prerequisites <<'EOF'
|
||||
#!/bin/sh
|
||||
# Modified for Aliyun GNU mirror + official ISL source (SourceForge)
|
||||
# Author: windyboy setup helper
|
||||
|
||||
set -e
|
||||
|
||||
gmp='gmp-6.2.1.tar.bz2'
|
||||
mpfr='mpfr-4.1.0.tar.bz2'
|
||||
mpc='mpc-1.2.1.tar.gz'
|
||||
isl='isl-0.24.tar.bz2'
|
||||
|
||||
fetch='wget -c --no-check-certificate'
|
||||
|
||||
# 阿里云 GNU 镜像基础路径
|
||||
base="https://mirrors.aliyun.com/gnu"
|
||||
|
||||
download() {
|
||||
pkg=$1
|
||||
url=$2
|
||||
echo "==> Downloading $pkg"
|
||||
${fetch} "$url" -O "$pkg" || {
|
||||
echo "❌ Failed: $pkg"
|
||||
exit 1
|
||||
}
|
||||
}
|
||||
|
||||
download "$gmp" "$base/gmp/$gmp"
|
||||
download "$mpfr" "$base/mpfr/$mpfr"
|
||||
download "$mpc" "$base/mpc/$mpc"
|
||||
download "$isl" "https://libisl.sourceforge.io/$isl"
|
||||
|
||||
echo "==> Extracting..."
|
||||
for ar in $gmp $mpfr $mpc $isl; do
|
||||
tar -xf "$ar"
|
||||
ln -sf "${ar%.tar*}" "${ar%-*}"
|
||||
done
|
||||
|
||||
echo "✅ All prerequisites downloaded and extracted successfully (Aliyun + SourceForge)."
|
||||
EOF
|
||||
|
||||
chmod +x contrib/download_prerequisites
|
||||
```
|
||||
|
||||
|
||||
## 四、构建并安装 GCC 13.3.0
|
||||
|
||||
### 6️⃣ 创建构建目录（out-of-tree）
|
||||
|
||||
```bash
|
||||
cd soft
|
||||
mkdir build-gcc-13 && cd build-gcc-13
|
||||
```
|
||||
|
||||
### 7️⃣ 配置参数
|
||||
|
||||
```bash
|
||||
../gcc-13.3.0/configure \
|
||||
--prefix=/usr/local/gcc-13 \
|
||||
--enable-languages=c,c++ \
|
||||
--disable-multilib \
|
||||
--enable-checking=release \
|
||||
--enable-lto \
|
||||
--enable-threads=posix \
|
||||
--with-system-zlib
|
||||
```
|
||||
|
||||
|
||||
说明：
|
||||
|
||||
- `--disable-multilib`：仅构建 64 位版，节省空间、避免冲突
|
||||
|
||||
- `--enable-lto`：启用 Link Time Optimization
|
||||
|
||||
- `--enable-threads=posix`：标准线程支持
|
||||
|
||||
- `--with-system-zlib`：若安装了 zlib-devel
|
||||
|
||||
|
||||
---
|
||||
|
||||
### 8️⃣ 编译与安装
|
||||
|
||||
```bash
|
||||
make -j"$(nproc)"
|
||||
make install
|
||||
```
|
||||
|
||||
💡 **提示：**
|
||||
|
||||
- 首次编译耗时较久（15–60 分钟）。
|
||||
|
||||
- 若出现 OOM，可降并行度：
|
||||
|
||||
```bash
|
||||
sudo make -j4
|
||||
```
|
||||
|
||||
|
||||
---
|
||||
|
||||
## 五、启用与测试新 GCC
|
||||
|
||||
### 9️⃣ 临时启用
|
||||
|
||||
```bash
|
||||
export PATH=/usr/local/gcc-13/bin:$PATH
|
||||
export LD_LIBRARY_PATH=/usr/local/gcc-13/lib64:$LD_LIBRARY_PATH
|
||||
```
|
||||
|
||||
### 🔟 验证版本
|
||||
|
||||
```bash
|
||||
gcc -v
|
||||
g++ -v
|
||||
```
|
||||
|
||||
应显示：
|
||||
|
||||
```
|
||||
gcc version 13.3.0 (GCC)
|
||||
```
|
||||
|
||||
测试代码：
|
||||
|
||||
```bash
|
||||
cat > hello.cpp <<'EOF'
|
||||
#include <iostream>
|
||||
int main() { std::cout << "Hello GCC " << __VERSION__ << std::endl; }
|
||||
EOF
|
||||
g++ -std=c++20 hello.cpp -O2 -o hello
|
||||
./hello
|
||||
```
|
||||
|
||||
输出应为：
|
||||
|
||||
```
|
||||
Hello GCC 13.3.0
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 六、长期使用与并存管理
|
||||
|
||||
### 11️⃣ 持久化环境变量
|
||||
|
||||
**用户级：**
|
||||
|
||||
```bash
|
||||
echo 'export PATH=/opt/gcc-13/bin:$PATH' >> ~/.bashrc
|
||||
echo 'export LD_LIBRARY_PATH=/opt/gcc-13/lib64:$LD_LIBRARY_PATH' >> ~/.bashrc
|
||||
source ~/.bashrc
|
||||
```
|
||||
|
||||
**系统级（所有用户生效）：**
|
||||
|
||||
```bash
|
||||
sudo tee /etc/profile.d/gcc13.sh <<'EOF'
|
||||
export PATH=/opt/gcc-13/bin:$PATH
|
||||
export LD_LIBRARY_PATH=/opt/gcc-13/lib64:$LD_LIBRARY_PATH
|
||||
EOF
|
||||
sudo chmod +x /etc/profile.d/gcc13.sh
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### 12️⃣ 运行时库兼容性（关键）
|
||||
|
||||
若运行你的程序时报：
|
||||
|
||||
```
|
||||
GLIBCXX_3.x.y not found
|
||||
```
|
||||
|
||||
说明运行期加载了系统旧版 libstdc++。
|
||||
解决办法：
|
||||
|
||||
1. 临时解决：
|
||||
|
||||
```bash
|
||||
export LD_LIBRARY_PATH=/opt/gcc-13/lib64:$LD_LIBRARY_PATH
|
||||
```
|
||||
|
||||
2. 编译期内嵌 rpath：
|
||||
|
||||
```bash
|
||||
g++ main.cpp -Wl,-rpath=/opt/gcc-13/lib64 -O2 -o app
|
||||
```
|
||||
|
||||
|
||||
---
|
||||
|
||||
## 七、常见问题与修复要点
|
||||
|
||||
|问题|原因|解决方案|
|
||||
|---|---|---|
|
||||
|`configure: error: GMP/MPFR/MPC not found`|系统库过旧或缺失|使用 `contrib/download_prerequisites`|
|
||||
|`collect2: error: ld returned 1 exit status`|binutils 太旧|启用 `/opt/binutils-2.40` 并确认 PATH|
|
||||
|`checking for sufficient default stack space... no`|栈空间不足|执行 `ulimit -s unlimited`|
|
||||
|`cc1plus: out of memory`|并行过高或 swap 不足|降低并行度、添加 swap|
|
||||
|
||||
---
|
||||
|
||||
## 八、验证构建质量（可选）
|
||||
|
||||
自检：
|
||||
|
||||
```bash
|
||||
cd /usr/local/src/build-gcc-13
|
||||
sudo make -k check > test.log 2>&1
|
||||
grep -A2 "Summary" test.log
|
||||
```
|
||||
|
||||
成功率通常 > 99%，剩余测试多为非致命的浮点容差差异。
|
||||
|
||||
---
|
||||
|
||||
## ✅ 总结：完整流程一览
|
||||
|
||||
```bash
|
||||
# 一次性复现构建流程 (示例版)
|
||||
sudo dnf groupinstall "Development Tools" -y
|
||||
sudo dnf install -y gcc gcc-c++ make bison flex texinfo git wget curl xz gawk perl python3 \
|
||||
glibc-devel glibc-headers libstdc++-devel zlib-devel gmp-devel mpfr-devel libmpc-devel isl-devel
|
||||
|
||||
cd /usr/local/src
|
||||
sudo wget https://ftp.gnu.org/gnu/binutils/binutils-2.40.tar.xz
|
||||
sudo tar -xf binutils-2.40.tar.xz
|
||||
sudo mkdir build-binutils-2.40 && cd build-binutils-2.40
|
||||
sudo ../binutils-2.40/configure --prefix=/opt/binutils-2.40 --disable-multilib --enable-gold --enable-ld=default --enable-plugins
|
||||
sudo make -j"$(nproc)" && sudo make install
|
||||
export PATH=/opt/binutils-2.40/bin:$PATH
|
||||
|
||||
cd /usr/local/src
|
||||
sudo wget https://ftp.gnu.org/gnu/gcc/gcc-13.3.0/gcc-13.3.0.tar.xz
|
||||
sudo tar -xf gcc-13.3.0.tar.xz
|
||||
cd gcc-13.3.0 && ./contrib/download_prerequisites
|
||||
|
||||
cd /usr/local/src && sudo mkdir build-gcc-13 && cd build-gcc-13
|
||||
sudo ../gcc-13.3.0/configure --prefix=/opt/gcc-13 --enable-languages=c,c++ --disable-multilib \
|
||||
--enable-checking=release --enable-lto --enable-threads=posix --with-system-zlib
|
||||
sudo make -j"$(nproc)" && sudo make install
|
||||
|
||||
echo 'export PATH=/opt/gcc-13/bin:$PATH' | sudo tee /etc/profile.d/gcc13.sh
|
||||
echo 'export LD_LIBRARY_PATH=/opt/gcc-13/lib64:$LD_LIBRARY_PATH' | sudo tee -a /etc/profile.d/gcc13.sh
|
||||
sudo chmod +x /etc/profile.d/gcc13.sh
|
||||
source /etc/profile.d/gcc13.sh
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
是否希望我把上述完整命令整理成 **一键可执行的 build-gcc13.sh 脚本**（带错误检查、日志输出、并自动检测是否已安装 binutils）？
|
||||
这样你只需运行一行命令即可完成全部流程。
|
||||
|
||||
|
||||
openssl
|
||||
|
||||
```
|
||||
./Configure --prefix=/usr/local/openssl-3 \
|
||||
--openssldir=/usr/local/openssl-3/ssl \
|
||||
shared zlib \
|
||||
enable-ec_nistp_64_gcc_128 \
|
||||
enable-tls1_3
|
||||
```
|
||||
|
||||
```
|
||||
make -j$(nproc)
|
||||
make install
|
||||
```
|
||||
|
||||
```
|
||||
export CC=/usr/local/gcc-13/bin/gcc
|
||||
export CXX=/usr/local/gcc-13/bin/g++
|
||||
export CPPFLAGS="-I/usr/local/openssl-3/include"
|
||||
export LDFLAGS="-L/usr/local/openssl-3/lib64"
|
||||
```
|
||||
|
||||
```
|
||||
echo "/usr/local/openssl-3/lib64" | sudo tee /etc/ld.so.conf.d/openssl-3.conf
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
export CPPFLAGS="-I/usr/local/openssl-3/include"
|
||||
export LDFLAGS="-L/usr/local/openssl-3/lib -Wl,-rpath=/usr/local/openssl-3/lib"
|
||||
export PKG_CONFIG_PATH="/usr/local/openssl-3/lib/pkgconfig"
|
||||
export LD_LIBRARY_PATH="/usr/local/openssl-3/lib:$LD_LIBRARY_PATH"
|
||||
export PATH="/usr/local/openssl-3/bin:$PATH"
|
||||
|
||||
./configure \
|
||||
--prefix=/usr/local/openssh-10 \
|
||||
--sysconfdir=/usr/local/openssh-10/etc \
|
||||
--with-ssl-dir=/usr/local/openssl-3 \
|
||||
--with-pam \
|
||||
--with-md5-passwords
|
||||
|
||||
```
|
||||
@@ -0,0 +1,16 @@
|
||||
|
||||
|
||||
服务器IP 应用服务
|
||||
10.160.20.112 zookeeper
|
||||
10.160.20.113 Prometheus grafana
|
||||
10.160.20.114 minio
|
||||
10.160.20.115 minio
|
||||
10.160.20.116 minio
|
||||
10.160.20.117 docker swarm
|
||||
10.160.20.118 docker swarm
|
||||
10.160.20.119 docker swarm
|
||||
10.160.20.102 达梦数据库
|
||||
10.160.20.107 达梦数据库
|
||||
10.160.20.176（VIP：10.160.20.110） nginx、keepalived
|
||||
10.160.20.177（VIP：10.160.20.110） nginx、keepalived
|
||||
|
||||
Reference in New Issue
Block a user