my-vault/01_Projects/Work/Government-Projects/Document-Exchange/Upgradeopenssh.md

login jump server: 10.160.20.112

ssh -V
OpenSSH_8.2p1, OpenSSL 1.1.1f  31 Mar 2020

uname -a
Linux v10-200g-clone-10 4.19.90-20.1stable.ky10.aarch64 #1 SMP Sun Aug 23 11:31:17 CST 2020 aarch64 aarch64 aarch64 GNU/Linux

uname -m
aarch64
getenforce
Disabled

备份配置

cp -a /etc/ssh /etc/ssh.bak-$(date +%F)

依赖安装

dnf groupinstall "Development Tools" -y

dnf install -y openssl-devel zlib-devel pam-devel libedit-devel krb5-devel audit-libs-devel libselinux-devel libcap-ng-devel systemd-devel

编译

wget https://codeload.github.com/openssh/openssh-portable/zip/refs/heads/V_10_2

unzip openssh-portable-V_10_2.zip
cd openssh-portable-V_10_2

./configure  --prefix=/usr --sysconfdir=/etc/ssh --sbindir=/usr/sbin  --with-pam  --with-privsep-path=/var/lib/sshd 

make -j"$(nproc)"

make install

chmod 600 /etc/ssh/ssh_host_rsa_key /etc/ssh/ssh_host_ecdsa_key /etc/ssh/ssh_host_ed25519_key

• 找到对应行，前面加 #，或直接删除。例如：

vi /etc/ssh/sshd_config

- # GSSAPIAuthentication no
    
- # GSSAPICleanupCredentials yes
    
- # RSAAuthentication no
    
- # RhostsRSAAuthentication no

/usr/sbin/sshd -t -f /etc/ssh/sshd_config

chmod 600 /etc/ssh/ssh_host_rsa_key /etc/ssh/ssh_host_ecdsa_key /etc/ssh/ssh_host_ed25519_key

systemctl daemon-reload

systemctl enable --now sshd

systemctl status sshd

journalctl -u sshd -b

vi /etc/crypto-policies/back-ends/opensshserver.config

dnf install -y rpm-build rpmlint

制作安装包

dnf install -y ruby ruby-devel gcc make rpm-build 

mkdir -p ~/buildroot

install -D /usr/sbin/sshd ~/buildroot/usr/sbin/sshd 
install -D /usr/bin/ssh ~/buildroot/usr/bin/ssh 
install -D /usr/bin/scp ~/buildroot/usr/bin/scp 
install -D /usr/bin/sftp ~/buildroot/usr/bin/sftp 
install -D /usr/bin/ssh-keygen ~/buildroot/usr/bin/ssh-keygen 
install -D /usr/bin/ssh-agent ~/buildroot/usr/bin/ssh-agent 
install -D /usr/bin/ssh-add ~/buildroot/usr/bin/ssh-add 
install -D /usr/bin/ssh-keyscan ~/buildroot/usr/bin/ssh-keyscan 
rsync -aR /usr/libexec/ssh/ ~/buildroot/ 2>/dev/null || true rsync -aR /usr/lib/ssh/ ~/buildroot/ 2>/dev/null || true 
install -D /etc/ssh/sshd_config ~/buildroot/etc/ssh/sshd_config 
install -D /etc/ssh/ssh_config ~/buildroot/etc/ssh/ssh_config

test -f /usr/lib/systemd/system/sshd.service && install -D /usr/lib/systemd/system/sshd.service ~/buildroot/usr/lib/systemd/system/sshd.service || true

~/rpmbuild/SPECS/openssh-custom.spec

Name:           openssh
Version:        10.2
Release:        1%{?dist}
Summary:        An open source implementation of SSH protocol version 2

License:        BSD
URL:            https://www.openssh.com/
Source0:        https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz

BuildRequires:  gcc
BuildRequires:  make
BuildRequires:  openssl-devel >= 1.1.1
BuildRequires:  zlib-devel
BuildRequires:  pam-devel
BuildRequires:  systemd
BuildRequires:  libselinux-devel

%description
SSH (Secure SHell) is a program for logging into and executing
commands on a remote machine. SSH is intended to replace rlogin and
rsh, and to provide secure encrypted communications between two
untrusted hosts over an insecure network. This package includes the
core files necessary for both the OpenSSH client and server.

%package clients
Summary:        SSH client applications
Requires:       %{name} = %{version}-%{release}

%description clients
OpenSSH clients, including ssh, scp, and sftp.

%package server
Summary:        SSH server daemon
Requires:       %{name} = %{version}-%{release}
Requires(post): systemd
Requires(preun): systemd
Requires(postun): systemd

%description server
OpenSSH server daemon (sshd) with support for the new sshd-session
and sshd-auth architecture introduced in OpenSSH 9.8+.

%prep
%setup -q -n openssh-portable-V_10_2

%build
%configure \
    --sysconfdir=%{_sysconfdir}/ssh \
    --libexecdir=%{_libexecdir}/openssh \
    --datadir=%{_datadir}/openssh \
    --with-pam \
    --with-selinux \
    --with-privsep-path=/var/empty/sshd \
    --with-pid-dir=/run \
    --with-ssl-engine \
    --disable-strip

make %{?_smp_mflags}

%install
rm -rf %{buildroot}
make install DESTDIR=%{buildroot}

# Install systemd unit files
install -d %{buildroot}%{_unitdir}

# Create sshd.service file
cat > %{buildroot}%{_unitdir}/sshd.service << 'SVCEOF'
[Unit]
Description=OpenSSH server daemon
Documentation=man:sshd(8) man:sshd_config(5)
After=network.target sshd-keygen.target
Wants=sshd-keygen.target

[Service]
Type=notify
EnvironmentFile=-/etc/sysconfig/sshd
ExecStart=/usr/sbin/sshd -D $OPTIONS
ExecReload=/bin/kill -HUP $MAINPID
KillMode=process
Restart=on-failure
RestartSec=42s

[Install]
WantedBy=multi-user.target
SVCEOF

# Create sshd-keygen service
cat > %{buildroot}%{_unitdir}/sshd-keygen@.service << 'KEYGENEOF'
[Unit]
Description=OpenSSH Server Key Generation
ConditionFileNotEmpty=|!/etc/ssh/ssh_host_rsa_key
ConditionFileNotEmpty=|!/etc/ssh/ssh_host_ecdsa_key
ConditionFileNotEmpty=|!/etc/ssh/ssh_host_ed25519_key

[Service]
Type=oneshot
ExecStart=/usr/bin/ssh-keygen -A
RemainAfterExit=yes
KEYGENEOF

# Create sshd-keygen target
cat > %{buildroot}%{_unitdir}/sshd-keygen.target << 'KEYTAREOF'
[Unit]
Description=OpenSSH Server Key Generation
Documentation=man:sshd(8) man:ssh-keygen(1)
ConditionFileNotEmpty=|!/etc/ssh/ssh_host_rsa_key
ConditionFileNotEmpty=|!/etc/ssh/ssh_host_ecdsa_key
ConditionFileNotEmpty=|!/etc/ssh/ssh_host_ed25519_key
KEYTAREOF

# Create empty sshd privsep directory
install -d -m 0711 %{buildroot}/var/empty/sshd

# Install PAM configuration
install -d %{buildroot}%{_sysconfdir}/pam.d
cat > %{buildroot}%{_sysconfdir}/pam.d/sshd << 'PAMEOF'
#%PAM-1.0
auth       substack     password-auth
auth       include      postlogin
account    required     pam_sepermit.so
account    required     pam_nologin.so
account    include      password-auth
password   include      password-auth
session    required     pam_selinux.so close
session    required     pam_loginuid.so
session    required     pam_selinux.so open env_params
session    required     pam_namespace.so
session    optional     pam_keyinit.so force revoke
session    optional     pam_motd.so
session    include      password-auth
session    include      postlogin
PAMEOF

# Modify sshd_config to enable root login
sed -i 's/#PermitRootLogin prohibit-password/PermitRootLogin yes/' \
    %{buildroot}%{_sysconfdir}/ssh/sshd_config

# Ensure PermitRootLogin is set
if ! grep -q "^PermitRootLogin" %{buildroot}%{_sysconfdir}/ssh/sshd_config; then
    echo "PermitRootLogin yes" >> %{buildroot}%{_sysconfdir}/ssh/sshd_config
fi

# Create sysconfig directory
install -d %{buildroot}%{_sysconfdir}/sysconfig
cat > %{buildroot}%{_sysconfdir}/sysconfig/sshd << 'SYSCONFIGEOF'
# Configuration file for the sshd service.

# Options for sshd
OPTIONS=""
SYSCONFIGEOF

%files
%license LICENCE
%doc ChangeLog CREDITS OVERVIEW PROTOCOL* README*
%dir %{_sysconfdir}/ssh
%config(noreplace) %{_sysconfdir}/ssh/moduli
%config(noreplace) %{_sysconfdir}/ssh/ssh_config
%{_mandir}/man5/moduli.5*
%{_mandir}/man5/ssh_config.5*
%{_mandir}/man5/sshd_config.5*

%files clients
%{_bindir}/ssh
%{_bindir}/scp
%{_bindir}/sftp
%{_bindir}/ssh-add
%{_bindir}/ssh-agent
%{_bindir}/ssh-keygen
%{_bindir}/ssh-keyscan
%dir %{_libexecdir}/openssh
%{_libexecdir}/openssh/ssh-keysign
%{_libexecdir}/openssh/ssh-pkcs11-helper
%{_libexecdir}/openssh/ssh-sk-helper
%{_mandir}/man1/scp.1*
%{_mandir}/man1/sftp.1*
%{_mandir}/man1/ssh.1*
%{_mandir}/man1/ssh-add.1*
%{_mandir}/man1/ssh-agent.1*
%{_mandir}/man1/ssh-keygen.1*
%{_mandir}/man1/ssh-keyscan.1*
%{_mandir}/man8/ssh-keysign.8*
%{_mandir}/man8/ssh-pkcs11-helper.8*
%{_mandir}/man8/ssh-sk-helper.8*

%files server
%{_sbindir}/sshd
%dir %{_libexecdir}/openssh
%{_libexecdir}/openssh/sftp-server
%{_libexecdir}/openssh/sshd-session
%{_libexecdir}/openssh/sshd-auth
%{_unitdir}/sshd.service
%{_unitdir}/sshd-keygen@.service
%{_unitdir}/sshd-keygen.target
%dir %attr(0711,root,root) /var/empty/sshd
%config(noreplace) %{_sysconfdir}/ssh/sshd_config
%config(noreplace) %{_sysconfdir}/pam.d/sshd
%config(noreplace) %{_sysconfdir}/sysconfig/sshd
%{_mandir}/man8/sshd.8*
%{_mandir}/man8/sftp-server.8*

%pre server
# Create sshd user if it doesn't exist
getent group sshd >/dev/null || groupadd -r sshd
getent passwd sshd >/dev/null || \
    useradd -r -g sshd -d /var/empty/sshd -s /sbin/nologin \
    -c "Privilege-separated SSH" sshd
exit 0

%post server
%systemd_post sshd.service
# Generate host keys if they don't exist
/usr/bin/ssh-keygen -A >/dev/null 2>&1 || :

%preun server
%systemd_preun sshd.service

%postun server
%systemd_postun_with_restart sshd.service

%changelog
* Wed Oct 22 2025 System Administrator <admin@example.com> - 10.2-1
- Update to OpenSSH 10.2
- Enable PermitRootLogin by default
- Add support for sshd-session and sshd-auth
- Include systemd service files
- Add PAM configuration
- Create privilege separation user and directory

find ~/rpmbuild/BUILD/openssh-10.2-1.ky10.*/usr/libexec/openssh/ -type f

处理完：
117
177

不能ssh
102

处理102:

1. 下载新编译的openssh

-rw-r--r-- 1 root root 209096 Oct 22 14:45 openssh-10.2-1.ky10.ky10.aarch64.rpm
-rw-r--r-- 1 root root 872348 Oct 22 14:45 openssh-clients-10.2-1.ky10.ky10.aarch64.rpm
-rw-r--r-- 1 root root 576228 Oct 22 14:45 openssh-server-10.2-1.ky10.ky10.aarch64.rpm

2. 修改 /etc/ssh/sshd_config 注释选项

GSSAPIAuthentication

GSSAPICleanupCredentials

RSAAuthentication

RhostsRSAAuthentication

注释

/etc/crypto-policies/back-ends/opensshserver.config

3. 修改

chmod 600 /etc/ssh/ssh_*

3. 安装

dnf install ./openssh-*

4. 测试

/usr/sbin/sshd -t 

/usr/sbin/sshd -D -d 

systemctl daemon-reload 
systemctl enable --now sshd
systemctl start sshd
systemctl status sshd

112: 安装 openssh 10 with openssl 3

生成key

/usr/local/openssh-10/bin/ssh-keygen -t rsa -b 4096 -f /usr/local/openssh-10/etc/ssh_host_rsa_key -N "" -q
/usr/local/openssh-10/bin/ssh-keygen -t ecdsa -b 521 -f /usr/local/openssh-10/etc/ssh_host_ecdsa_key -N "" -q
/usr/local/openssh-10/bin/ssh-keygen -t ed25519 -f /usr/local/openssh-10/etc/ssh_host_ed25519_key -N "" -q

测试语法

/usr/local/openssh-10/sbin/sshd -t -f /usr/local/openssh-10/etc/sshd_config

mkdir -p /var/empty
chown root:root /var/empty
chmod 755 /var/empty

测试启动

/usr/local/openssh-10/sbin/sshd -p 2222 -f /usr/local/openssh-10/etc/sshd_config -D

备份

mkdir -p /usr/local/openssh-backup
cp /usr/sbin/sshd /usr/local/openssh-backup/
cp /usr/bin/ssh* /usr/local/openssh-backup/
cp -r /etc/ssh /usr/local/openssh-backup/etc_ssh_$(date +%F)

替换

 ln -sf /usr/local/openssh-10/sbin/sshd /usr/sbin/sshd
 ln -sf /usr/local/openssh-10/bin/ssh /usr/bin/ssh
 ln -sf /usr/local/openssh-10/bin/scp /usr/bin/scp
 ln -sf /usr/local/openssh-10/bin/sftp /usr/bin/sftp
 ln -sf /usr/local/openssh-10/bin/ssh-keygen /usr/bin/ssh-keygen
 ln -sf /usr/local/openssh-10/bin/ssh-keyscan /usr/bin/ssh-keyscan
 ln -sf /usr/local/openssh-10/bin/ssh-agent /usr/bin/ssh-agent
 ln -sf /usr/local/openssh-10/bin/ssh-add /usr/bin/ssh-add

cp /usr/lib/systemd/system/sshd.service /etc/systemd/system/sshd.service

sed -i 's|ExecStart=.*|ExecStart=/usr/local/openssh-10/sbin/sshd -D -f /usr/local/openssh-10/etc/sshd_config|' /etc/systemd/system/sshd.service

sed -i '/^\[Service\]/a Environment="LD_LIBRARY_PATH=/usr/local/openssl-3/lib"' /etc/systemd/system/sshd.service

sudo systemctl daemon-reexec
sudo systemctl daemon-reload

sudo systemctl restart sshd
sudo systemctl status sshd

10.160.20.112, 10.160.20.113,10.160.20.114,10.160.20.115,10.160.20.116,10.160.20.118,10.160.20.119,10.160.20.107

export LD_LIBRARY_PATH=/usr/local/openssl-3/lib:/usr/local/openssl-3/lib64

/usr/local/openssl-3/bin/openssl version -a
/usr/local/openssh-10/bin/ssh -V

生成key

/usr/local/openssh-10/bin/ssh-keygen -t rsa -b 4096 -f /usr/local/openssh-10/etc/ssh_host_rsa_key -N "" -q
/usr/local/openssh-10/bin/ssh-keygen -t ecdsa -b 521 -f /usr/local/openssh-10/etc/ssh_host_ecdsa_key -N "" -q
/usr/local/openssh-10/bin/ssh-keygen -t ed25519 -f /usr/local/openssh-10/etc/ssh_host_ed25519_key -N "" -q

测试语法

/usr/local/openssh-10/sbin/sshd -t -f /usr/local/openssh-10/etc/sshd_config

mkdir -p /var/empty
chown root:root /var/empty
chmod 755 /var/empty

测试启动

/usr/local/openssh-10/sbin/sshd -p 2222 -f /usr/local/openssh-10/etc/sshd_config -D

备份

mkdir -p /usr/local/openssh-backup
cp /usr/sbin/sshd /usr/local/openssh-backup/
cp /usr/bin/ssh* /usr/local/openssh-backup/
cp -r /etc/ssh /usr/local/openssh-backup/etc_ssh_$(date +%F)

替换

 ln -sf /usr/local/openssh-10/sbin/sshd /usr/sbin/sshd
 ln -sf /usr/local/openssh-10/bin/ssh /usr/bin/ssh
 ln -sf /usr/local/openssh-10/bin/scp /usr/bin/scp
 ln -sf /usr/local/openssh-10/bin/sftp /usr/bin/sftp
 ln -sf /usr/local/openssh-10/bin/ssh-keygen /usr/bin/ssh-keygen
 ln -sf /usr/local/openssh-10/bin/ssh-keyscan /usr/bin/ssh-keyscan
 ln -sf /usr/local/openssh-10/bin/ssh-agent /usr/bin/ssh-agent
 ln -sf /usr/local/openssh-10/bin/ssh-add /usr/bin/ssh-add

cp /usr/lib/systemd/system/sshd.service /etc/systemd/system/sshd.service

sed -i 's|ExecStart=.*|ExecStart=/usr/local/openssh-10/sbin/sshd -D -f /usr/local/openssh-10/etc/sshd_config|' /etc/systemd/system/sshd.service

sed -i '/^\[Service\]/a Environment="LD_LIBRARY_PATH=/usr/local/openssl-3/lib"' /etc/systemd/system/sshd.service

sudo systemctl daemon-reexec
sudo systemctl daemon-reload

sudo systemctl restart sshd
sudo systemctl status sshd