1060 lines
24 KiB
Markdown
1060 lines
24 KiB
Markdown
一、任务一：等保测评，涉及项目9月份验收
|
||
【腾讯文档】2024_门户_虚拟数据中心等保问题处理跟进
|
||
https://docs.qq.com/sheet/DY1pUR0xSWXVxS2hJ?tab=rjqe69
|
||
1.政务数据门户（开发彭福临、张小青、运维苏海鹏）
|
||
2.虚拟数据中心（开发张成博、运维待定）
|
||
--消息总线部分请广剑协助
|
||
|
||
二、任务二：每月安全漏洞扫描
|
||
【腾讯文档】(内部)应用系统项目漏洞与渗透测试问题处理跟进（8月）
|
||
https://docs.qq.com/sheet/DY1JEaU10Q0xuSm5V?tab=x7uzon
|
||
1.数据开放（开发龙跃云、张小青、运维XXX）
|
||
2.政务数据门户（开发彭福临、张小青、运维苏海鹏）
|
||
3.虚拟数据中心（开发张成博、运维待定）
|
||
--消息总线部分请广剑协助
|
||
|
||
三、计划
|
||
1.整改评估（8月16号完成）
|
||
所有问题过一遍，评估需要的时间，在群内汇报。
|
||
在线文档的责任人栏标记上人员。对没有解决条件/需要协助/有争议的问题，在备注栏描述。
|
||
2.等保测评整改（8月23号完成）
|
||
整改开发、在线文档填报整改情况、上线、测试。
|
||
3.漏洞扫描整改（8月30号完成）
|
||
整改开发、在线文档填报整改情况、上线、测试。
|
||
如果各位时间有冲突，在8月16号前在本群@张迪@胡畅提出，我们协调
|
||
3.复测和验收支持（9月）
|
||
测评单位复测期间提供技术支持
|
||
|
||
|
||
1. mysql 配置修改
|
||
数据库系统针设定有效的终端接入策略，对通过网络进行管理的终端进行限制。
|
||
■数据库系统对账号进行IP限制，host ≠ %，限制固定IP段登录 <br>数据库系统对登录用户数量进行限制，如配置max_connections为50（具体数值需根据实际业务需求调整）
|
||
|
||
|
||
|
||
```
|
||
（1）建议对被测系统内应实施相应措施对重要信息资源设置敏感标记，如设备级别不支持敏感标记的，应在系统级生成敏感标记，使系统整体支持强制访问控制机制；
|
||
（2）依据安全策略严格控制用户对有敏感标记重要信息资源的操作；
|
||
（3）强制访问控制机制通过策略将访问控制规则“强加”给访问主体，即系统强制主体服从访问控制策略。对主体及其所操作的客体（如：进程、文件等）进行安全标记，这些标记是实施强制访问控制的依据。当用户进行访问时，系统通过比较主体和客体的安全标记来判断一个主体是否能够访问其要操作的客体。主体通常指用户，或由用户发起运行的进程或用户正在使用的设备，客体通常是指信息的载体或从其他主体或客体接收信息的实体。
|
||
```
|
||
|
||
根据您的描述以及参考《环境信息系统安全技术规范》，以下是具体的实施建议：
|
||
|
||
### 1. **敏感标记的设置**
|
||
- **设备级别支持**：如果设备支持敏感标记，如某些高级存储设备，直接在设备上进行标记。
|
||
- **系统级生成**：如果设备不支持，则在操作系统层面生成敏感标记，使用工具如SELinux进行标记管理。
|
||
|
||
### 2. **严格控制访问**
|
||
- **安全策略实施**：配置基于角色的访问控制（RBAC），限制用户对敏感资源的操作。
|
||
- **权限审核**：定期审核用户权限，确保只有授权用户能访问敏感资源。
|
||
|
||
### 3. **强制访问控制机制**
|
||
- **标记管理**：为所有主体（用户、进程）和客体（文件、数据）设置安全标记。
|
||
- **策略比较**：当用户请求访问某一资源时，系统通过比较主体和客体的安全标记，决定是否允许访问。
|
||
|
||
### 4. **系统配置与监控**
|
||
- **配置管理**：确保系统中的强制访问控制策略通过配置管理工具实施，并定期检查策略执行情况。
|
||
- **日志监控**：记录并监控所有与敏感标记相关的访问操作，确保违规行为能够被及时发现和处理。
|
||
|
||
### 5. **培训与测试**
|
||
- **用户培训**：对用户进行相关安全策略和标记使用的培训，确保理解和遵守规定。
|
||
- **定期测试**：通过模拟攻击和访问尝试测试系统的强制访问控制机制，确保其有效性。
|
||
|
||
这些措施可以确保在系统内正确实施敏感标记，并通过严格的策略控制访问，从而实现强制访问控制的目标。
|
||
|
||
|
||
```
|
||
（1）数据库系统根据安全策略要求对特权用户进行分离。如设置：系统管理员用户组、安全管理员用户组、安全审计员用户组、系统操作用户组等；
|
||
（2）按最小授权原则分配，不赋予一般用户管理员权限，不赋予用户不必要的操作权限。
|
||
```
|
||
|
||
|
||
|
||
```
|
||
（1）MySQL数据库系统启用“connection_control”；
|
||
|
||
（2）建议数据库系统配置合规的锁定策略，可参考：
|
||
|
||
Connection_control_failed_connections_threshold 30；Connection_control_min_connection_delay 600000；
|
||
|
||
（3）建议数据库系统配置合规的操作超时锁定，可参考：interactive_timeout 1800。
|
||
```
|
||
|
||
The Connection Control Plugin in MySQL allows you to manage and limit client connections more precisely by setting thresholds for connection attempts and intervals between them. This plugin helps in mitigating brute-force attacks or controlling resource usage.
|
||
|
||
### Steps to Configure the Connection Control Plugin
|
||
|
||
#### 1. **Install the Plugin**
|
||
The Connection Control Plugin might not be enabled by default, so you need to install it.
|
||
|
||
- **Install the plugin:**
|
||
|
||
```sql
|
||
INSTALL PLUGIN connection_control SONAME 'connection_control.so';
|
||
INSTALL PLUGIN connection_control_failed_login_attempts SONAME 'connection_control.so';
|
||
```
|
||
|
||
On Windows, the `.so` file extension may be `.dll`, so the commands would be:
|
||
|
||
```sql
|
||
INSTALL PLUGIN connection_control SONAME 'connection_control.dll';
|
||
INSTALL PLUGIN connection_control_failed_login_attempts SONAME 'connection_control.dll';
|
||
```
|
||
|
||
- **Verify the plugin installation:**
|
||
|
||
```sql
|
||
SHOW PLUGINS;
|
||
```
|
||
|
||
This command will list all installed plugins, and you should see `connection_control` and `connection_control_failed_login_attempts` listed.
|
||
|
||
#### 2. **Configure the Plugin**
|
||
Once installed, you can configure the plugin using various system variables.
|
||
|
||
- **Set the connection delay for failed login attempts:**
|
||
|
||
This parameter defines how long MySQL should wait before accepting a new connection after a failed login attempt.
|
||
|
||
```sql
|
||
SET GLOBAL connection_control_failed_connections_threshold = 5;
|
||
```
|
||
|
||
This example sets the threshold to 5 failed login attempts.
|
||
|
||
- **Set the delay time:**
|
||
|
||
This parameter defines the delay time (in milliseconds) between connections after the threshold is reached.
|
||
|
||
```sql
|
||
SET GLOBAL connection_control_min_connection_delay = 100;
|
||
SET GLOBAL connection_control_max_connection_delay = 10000;
|
||
```
|
||
|
||
Here, the minimum delay is set to 100 milliseconds, and the maximum delay is set to 10,000 milliseconds (10 seconds).
|
||
|
||
- **Make the settings persistent:**
|
||
|
||
To make these changes permanent, add them to your MySQL configuration file (`my.cnf` or `my.ini`):
|
||
|
||
```ini
|
||
[mysqld]
|
||
connection_control_failed_connections_threshold = 5
|
||
connection_control_min_connection_delay = 100
|
||
connection_control_max_connection_delay = 10000
|
||
```
|
||
|
||
Then, restart the MySQL server for the changes to take effect.
|
||
|
||
#### 3. **Monitor and Adjust Settings**
|
||
|
||
You can monitor the behavior of the plugin by querying relevant status variables:
|
||
|
||
- **Check the number of delayed connections:**
|
||
|
||
```sql
|
||
SHOW STATUS LIKE 'Connection_control_delay_connections';
|
||
```
|
||
|
||
- **Check the number of failed login attempts:**
|
||
|
||
```sql
|
||
SHOW STATUS LIKE 'Connection_control_failed_login_attempts_total';
|
||
```
|
||
|
||
Based on the results, you can fine-tune the settings to suit your environment's security and performance needs.
|
||
|
||
### Summary
|
||
|
||
- **Install the Connection Control Plugin** if it’s not already enabled.
|
||
- **Configure thresholds and delays** using system variables.
|
||
- **Persist settings** by adding them to the MySQL configuration file.
|
||
- **Monitor** and adjust the plugin’s settings based on real-time data.
|
||
|
||
This setup allows you to control and limit connections, enhancing security and resource management in your MySQL environment.
|
||
|
||
|
||
|
||
ubuntu 18 upgrade to 22
|
||
```
|
||
|
||
|
||
|
||
|
||
|
||
10.196.76.79
|
||
Apache HTTP/2 资源管理错误漏洞（CVE-2023-44487） 端口 8899
|
||
echo -e "GET / HTTP/1.1\r\nHost: localhost\r\n\r\n" | nc localhost 8899
|
||
HTTP/1.1 200 OK
|
||
Content-Length: 2
|
||
Content-Type: application/vnd.schemaregistry.v1+json
|
||
Server: Jetty(8.1.16.v20140903)
|
||
|
||
|
||
openssh
|
||
|
||
zlib
|
||
```
|
||
./configure --prefix=/usr/local/zlib
|
||
```
|
||
|
||
openssl
|
||
|
||
```
|
||
export CC="gcc -std=gnu99"
|
||
export CFLAGS="-O2 -fPIC"
|
||
export LDFLAGS="-L/usr/local/zlib/lib"
|
||
export CPPFLAGS="-I/usr/local/zlib/include"
|
||
```
|
||
|
||
|
||
|
||
```
|
||
./config \
|
||
--prefix=/usr/local/openssl \
|
||
--openssldir=/usr/local/openssl \
|
||
shared zlib-dynamic
|
||
```
|
||
|
||
|
||
|
||
```
|
||
make clean
|
||
make -j$(nproc)
|
||
sudo make install
|
||
sudo ldconfig
|
||
```
|
||
|
||
|
||
**OpenSSH 9.9p1**
|
||
|
||
```
|
||
cd /home/suops/soft/openssh-9.9p1
|
||
export CPPFLAGS="-I/usr/local/openssl/include -I/usr/local/zlib/include"
|
||
export LDFLAGS="-L/usr/local/openssl/lib -L/usr/local/zlib/lib"
|
||
export CC=/usr/local/gcc-10/bin/gcc
|
||
|
||
./configure \
|
||
--prefix=/usr/local/openssh \
|
||
--sysconfdir=/etc/ssh \
|
||
--with-ssl-dir=/usr/local/openssl \
|
||
--with-zlib=/usr/local/zlib \
|
||
--with-pam \
|
||
--with-privsep-path=/var/lib/sshd
|
||
|
||
make -j$(nproc)
|
||
sudo make install
|
||
|
||
```
|
||
|
||
|
||
```
|
||
sudo /usr/local/openssh/sbin/sshd -t -f /etc/ssh/sshd_config
|
||
|
||
```
|
||
|
||
```
|
||
/usr/local/openssh/sbin/sshd -D -f /etc/ssh/sshd_config -p 2222 -E /tmp/sshd-test.log
|
||
```
|
||
|
||
|
||
backup old ssh
|
||
```
|
||
mkdir -p /usr/local/openssh-backup
|
||
cp -a /usr/sbin/sshd /usr/local/openssh-backup/
|
||
cp -a /usr/bin/ssh /usr/bin/scp /usr/bin/sftp /usr/bin/ssh-keygen /usr/local/openssh-backup/
|
||
```
|
||
|
||
|
||
replace
|
||
```
|
||
mv /usr/sbin/sshd /usr/sbin/sshd.old
|
||
ln -s /usr/local/openssh/sbin/sshd /usr/sbin/sshd
|
||
|
||
for bin in ssh scp sftp ssh-keygen ssh-add ssh-agent; do
|
||
if [ -f /usr/local/openssh/bin/$bin ]; then
|
||
mv /usr/bin/$bin /usr/bin/$bin.old 2>/dev/null || true
|
||
ln -sf /usr/local/openssh/bin/$bin /usr/bin/$bin
|
||
fi
|
||
done
|
||
|
||
```
|
||
|
||
|
||
|
||
```
|
||
echo "/usr/local/openssl/lib" | sudo tee /etc/ld.so.conf.d/openssl.conf
|
||
sudo ldconfig
|
||
sudo systemctl restart sshd
|
||
|
||
```
|
||
|
||
|
||
10.196.76.89
|
||
|
||
默认编译器：
|
||
```
|
||
export PATH=/usr/local/gcc-10/bin:$PATH
|
||
export LD_LIBRARY_PATH=/usr/local/gcc-10/lib64:$LD_LIBRARY_PATH
|
||
|
||
```
|
||
|
||
zlib:
|
||
```
|
||
./configure --prefix=/usr/local/zlib
|
||
make -j$(nproc)
|
||
sudo make install
|
||
```
|
||
|
||
|
||
openssl 3.0.18
|
||
|
||
安装perl 模块
|
||
|
||
```
|
||
sudo yum install -y perl perl-core perl-IPC-Cmd perl-Text-Template
|
||
```
|
||
|
||
|
||
|
||
```
|
||
export CC=/usr/local/gcc-10/bin/gcc
|
||
export CFLAGS="-O2 -fPIC"
|
||
export CPPFLAGS="-I/usr/local/zlib/include"
|
||
export LDFLAGS="-L/usr/local/zlib/lib"
|
||
```
|
||
|
||
|
||
|
||
```
|
||
./Configure linux-x86_64 \
|
||
--prefix=/usr/local/openssl \
|
||
--openssldir=/usr/local/openssl \
|
||
shared zlib-dynamic
|
||
|
||
```
|
||
|
||
|
||
|
||
```
|
||
make -j$(nproc)
|
||
sudo make install_sw
|
||
```
|
||
|
||
|
||
```
|
||
sudo chmod 755 /usr/local/openssl
|
||
|
||
sudo chmod 755 /usr/local/openssl/lib64
|
||
|
||
sudo chmod -R a+X /usr/local/openssl
|
||
|
||
```
|
||
|
||
|
||
|
||
openssh-portable-V_10_2 :
|
||
|
||
安装 pam
|
||
|
||
```
|
||
sudo yum install -y pam-devel
|
||
```
|
||
|
||
|
||
```
|
||
export CC=/usr/local/gcc-10/bin/gcc
|
||
export CPPFLAGS="-I/usr/local/openssl/include -I/usr/local/zlib/include"
|
||
export LDFLAGS="-Wl,-rpath=/usr/local/openssl/lib64 -L/usr/local/openssl/lib64 -L/usr/local/zlib/lib"
|
||
export LD_LIBRARY_PATH=/usr/local/openssl/lib64:/usr/local/zlib/lib
|
||
```
|
||
|
||
|
||
|
||
注册openssl3
|
||
|
||
```
|
||
echo "/usr/local/openssl/lib64" | sudo tee /etc/ld.so.conf.d/openssl3.conf
|
||
echo "/usr/local/openssl/lib" | sudo tee -a /etc/ld.so.conf.d/openssl3.conf
|
||
export LD_LIBRARY_PATH=/usr/local/openssl/lib64:/usr/local/openssl/lib:$LD_LIBRARY_PATH
|
||
sudo ldconfig
|
||
|
||
```
|
||
|
||
|
||
```
|
||
./configure \
|
||
--prefix=/usr/local/openssh \
|
||
--sysconfdir=/etc/ssh \
|
||
--with-ssl-dir=/usr/local/openssl \
|
||
--with-zlib=/usr/local/zlib \
|
||
--with-ssl-engine \
|
||
--with-pam \
|
||
--with-privsep-path=/var/lib/sshd
|
||
```
|
||
|
||
```
|
||
make -j$(nproc)
|
||
sudo make install
|
||
```
|
||
|
||
|
||
|
||
```
|
||
/usr/local/openssh/bin/ssh -V
|
||
```
|
||
|
||
备份旧版
|
||
|
||
```
|
||
sudo mkdir -p /usr/local/openssh-backup/{bin,etc_ssh_$(date +%F),system}
|
||
```
|
||
|
||
```
|
||
sudo cp /usr/sbin/sshd /usr/local/openssh-backup/bin/ 2>/dev/null || true
|
||
sudo cp /usr/bin/ssh* /usr/local/openssh-backup/bin/ 2>/dev/null || true
|
||
sudo cp /usr/bin/scp /usr/local/openssh-backup/bin/ 2>/dev/null || true
|
||
sudo cp /usr/bin/sftp* /usr/local/openssh-backup/bin/ 2>/dev/null || true
|
||
```
|
||
|
||
```
|
||
sudo cp -a /etc/ssh /usr/local/openssh-backup/etc_ssh_$(date +%F)
|
||
```
|
||
|
||
```
|
||
sudo cp /etc/rc.d/init.d/sshd /usr/local/openssh-backup/system/ 2>/dev/null || true
|
||
sudo cp /lib/systemd/system/sshd.service /usr/local/openssh-backup/system/ 2>/dev/null || true
|
||
sudo cp /etc/pam.d/sshd /usr/local/openssh-backup/system/ 2>/dev/null || true
|
||
```
|
||
|
||
|
||
```
|
||
sudo ls -R /usr/local/openssh-backup
|
||
```
|
||
|
||
安装新版：
|
||
配置文件：
|
||
```
|
||
sudo sed -i 's/^[[:space:]]*GSSAPIAuthentication/#&/' /etc/ssh/sshd_config
|
||
sudo sed -i 's/^[[:space:]]*GSSAPICleanupCredentials/#&/' /etc/ssh/sshd_config
|
||
sudo sed -i 's/^[[:space:]]*UsePrivilegeSeparation/#&/' /etc/ssh/sshd_config
|
||
```
|
||
|
||
```
|
||
sudo /usr/local/openssh/sbin/sshd -t
|
||
```
|
||
测试启动：
|
||
```
|
||
sudo /usr/local/openssh/sbin/sshd -p 2222 -f /etc/ssh/sshd_config -D
|
||
```
|
||
|
||
|
||
替换文件：
|
||
```
|
||
sudo ln -sf /usr/local/openssh/sbin/sshd /usr/sbin/sshd
|
||
sudo ln -sf /usr/local/openssh/bin/ssh /usr/bin/ssh
|
||
sudo ln -sf /usr/local/openssh/bin/scp /usr/bin/scp
|
||
sudo ln -sf /usr/local/openssh/bin/sftp /usr/bin/sftp
|
||
sudo ln -sf /usr/local/openssh/bin/ssh-keygen /usr/bin/ssh-keygen
|
||
sudo ln -sf /usr/local/openssh/bin/ssh-keyscan /usr/bin/ssh-keyscan
|
||
sudo ln -sf /usr/local/openssh/bin/ssh-add /usr/bin/ssh-add
|
||
sudo ln -sf /usr/local/openssh/bin/ssh-agent /usr/bin/ssh-agent
|
||
|
||
```
|
||
|
||
|
||
```
|
||
sudo systemctl daemon-reexec
|
||
sudo systemctl daemon-reload
|
||
```
|
||
|
||
|
||
```
|
||
sudo systemctl restart sshd
|
||
sudo systemctl status sshd
|
||
|
||
```
|
||
|
||
```
|
||
/usr/sbin/sshd -V
|
||
```
|
||
|
||
|
||
|
||
```
|
||
cd /usr/local
|
||
sudo tar czf /home/suops/soft/openssh10p1_full.tar.gz openssh openssl zlib gcc-10
|
||
|
||
```
|
||
|
||
|
||
|
||
|
||
10.196.76.88
|
||
|
||
```
|
||
sudo tar xvzf openssh10p1_full.tar.gz -C /usr/local
|
||
```
|
||
|
||
权限：
|
||
```
|
||
sudo chmod -R a+X /usr/local/openssl /usr/local/zlib /usr/local/openssh
|
||
```
|
||
|
||
|
||
链接库
|
||
```
|
||
echo "/usr/local/openssl/lib64" | sudo tee /etc/ld.so.conf.d/openssl3.conf
|
||
echo "/usr/local/openssl/lib" | sudo tee -a /etc/ld.so.conf.d/openssl3.conf
|
||
echo "/usr/local/zlib/lib" | sudo tee /etc/ld.so.conf.d/zlib.conf
|
||
sudo ldconfig
|
||
|
||
```
|
||
|
||
```
|
||
ldconfig -p | grep libssl.so.3
|
||
ldconfig -p | grep libz.so
|
||
```
|
||
|
||
|
||
验证：
|
||
```
|
||
/usr/local/openssl/bin/openssl version -a
|
||
/usr/local/openssh/bin/ssh -V
|
||
|
||
```
|
||
|
||
备份：
|
||
```
|
||
sudo mkdir -p /usr/local/openssh-backup
|
||
sudo cp /usr/sbin/sshd /usr/local/openssh-backup/
|
||
sudo cp /usr/bin/ssh* /usr/local/openssh-backup/
|
||
sudo cp -r /etc/ssh /usr/local/openssh-backup/etc_ssh_$(date +%F)
|
||
|
||
```
|
||
|
||
|
||
测试启动：
|
||
|
||
```
|
||
sudo sed -i 's/^[[:space:]]*GSSAPIAuthentication/#&/' /etc/ssh/sshd_config
|
||
sudo sed -i 's/^[[:space:]]*GSSAPICleanupCredentials/#&/' /etc/ssh/sshd_config
|
||
sudo sed -i 's/^[[:space:]]*UsePrivilegeSeparation/#&/' /etc/ssh/sshd_config
|
||
|
||
```
|
||
|
||
```
|
||
sudo chmod 600 /etc/ssh/ssh_host_*_key
|
||
sudo chmod 644 /etc/ssh/ssh_host_*_key.pub
|
||
|
||
```
|
||
|
||
```
|
||
sudo mkdir -p /var/lib/sshd
|
||
sudo chmod 700 /var/lib/sshd
|
||
sudo chown root:sys /var/lib/sshd 2>/dev/null || sudo chown root:root /var/lib/sshd
|
||
|
||
```
|
||
|
||
|
||
```
|
||
sudo /usr/local/openssh/sbin/sshd -p 2222 -f /etc/ssh/sshd_config -D
|
||
|
||
```
|
||
|
||
|
||
替换：
|
||
|
||
```
|
||
sudo ln -sf /usr/local/openssh/sbin/sshd /usr/sbin/sshd
|
||
sudo ln -sf /usr/local/openssh/bin/ssh /usr/bin/ssh
|
||
sudo ln -sf /usr/local/openssh/bin/scp /usr/bin/scp
|
||
sudo ln -sf /usr/local/openssh/bin/sftp /usr/bin/sftp
|
||
sudo ln -sf /usr/local/openssh/bin/ssh-keygen /usr/bin/ssh-keygen
|
||
sudo ln -sf /usr/local/openssh/bin/ssh-keyscan /usr/bin/ssh-keyscan
|
||
sudo ln -sf /usr/local/openssh/bin/ssh-agent /usr/bin/ssh-agent
|
||
sudo ln -sf /usr/local/openssh/bin/ssh-add /usr/bin/ssh-add
|
||
|
||
```
|
||
|
||
|
||
|
||
```
|
||
sudo systemctl daemon-reexec
|
||
sudo systemctl daemon-reload
|
||
```
|
||
|
||
```
|
||
sudo systemctl restart sshd
|
||
sudo systemctl status sshd
|
||
|
||
```
|
||
|
||
|
||
|
||
|
||
10.194.67.122:
|
||
|
||
|
||
```
|
||
wget https://ftp.gnu.org/gnu/gmp/gmp-6.2.1.tar.xz
|
||
wget https://ftp.gnu.org/gnu/mpfr/mpfr-4.2.1.tar.xz
|
||
wget https://ftp.gnu.org/gnu/mpc/mpc-1.3.1.tar.gz
|
||
```
|
||
|
||
|
||
gcc:
|
||
```
|
||
../configure --prefix=/usr/local/gcc-10 \
|
||
--enable-languages=c,c++ \
|
||
--disable-multilib \
|
||
--enable-bootstrap
|
||
```
|
||
|
||
|
||
```
|
||
make -j$(nproc)
|
||
sudo make install
|
||
```
|
||
|
||
```
|
||
sudo chmod -R a+rx /usr/local/gcc-10
|
||
|
||
```
|
||
|
||
|
||
```
|
||
export CC=/usr/local/gcc-10/bin/gcc
|
||
export CXX=/usr/local/gcc-10/bin/g++
|
||
```
|
||
|
||
编译zlib
|
||
|
||
```
|
||
./configure --prefix=/usr/local/zlib
|
||
make -j$(nproc)
|
||
sudo make install
|
||
```
|
||
|
||
```
|
||
sudo chmod -R a+rx /usr/local/zlib
|
||
```
|
||
|
||
|
||
编译openssl
|
||
```
|
||
./Configure \
|
||
--prefix=/usr/local/openssl-3 \
|
||
--openssldir=/usr/local/openssl-3 \
|
||
shared zlib \
|
||
-I/usr/local/zlib/include \
|
||
-L/usr/local/zlib/lib
|
||
```
|
||
|
||
|
||
```
|
||
sudo chmod -R a+rx /usr/local/openssl-3
|
||
```
|
||
|
||
编译openssh
|
||
|
||
```
|
||
export CC=/usr/local/gcc-10/bin/gcc
|
||
export CXX=/usr/local/gcc-10/bin/g++
|
||
export CPPFLAGS="-I/usr/local/openssl-3/include"
|
||
export LDFLAGS="-L/usr/local/openssl-3/lib64"
|
||
|
||
```
|
||
|
||
|
||
```
|
||
echo "/usr/local/openssl-3/lib64" | sudo tee /etc/ld.so.conf.d/openssl-3.conf
|
||
```
|
||
|
||
|
||
|
||
|
||
|
||
|
||
```
|
||
./configure \
|
||
--prefix=/usr/local/openssh-9 \
|
||
--sysconfdir=/usr/local/openssh-9/etc \
|
||
--with-ssl-dir=/usr/local/openssl-3 \
|
||
--with-zlib=/usr/local/zlib \
|
||
--with-pam \
|
||
--with-md5-passwords
|
||
|
||
```
|
||
|
||
|
||
```
|
||
make -j2
|
||
sudo make install
|
||
```
|
||
|
||
```
|
||
sudo chmod -R a+X /usr/local/openssh-9
|
||
```
|
||
|
||
|
||
```
|
||
/usr/local/openssl-3/bin/openssl version -a
|
||
/usr/local/openssh-9/bin/ssh -V
|
||
```
|
||
|
||
|
||
|
||
```
|
||
sudo mkdir -p /usr/local/openssh-backup
|
||
sudo cp /usr/sbin/sshd /usr/local/openssh-backup/
|
||
sudo cp /usr/bin/ssh* /usr/local/openssh-backup/
|
||
sudo cp -r /etc/ssh /usr/local/openssh-backup/etc_ssh_$(date +%F)
|
||
```
|
||
|
||
```
|
||
sudo sed -i 's/^[[:space:]]*GSSAPIAuthentication/#&/' /etc/ssh/sshd_config
|
||
sudo sed -i 's/^[[:space:]]*GSSAPICleanupCredentials/#&/' /etc/ssh/sshd_config
|
||
sudo sed -i 's/^[[:space:]]*UsePrivilegeSeparation/#&/' /etc/ssh/sshd_config
|
||
```
|
||
|
||
```
|
||
sudo chmod 600 /etc/ssh/ssh_host_*_key
|
||
sudo chmod 644 /etc/ssh/ssh_host_*_key.pub
|
||
```
|
||
|
||
|
||
|
||
```
|
||
sudo /usr/local/openssh-9/sbin/sshd -p 2222 -f /etc/ssh/sshd_config -D
|
||
```
|
||
|
||
|
||
|
||
|
||
```
|
||
sudo ln -sf /usr/local/openssh-9/sbin/sshd /usr/sbin/sshd
|
||
sudo ln -sf /usr/local/openssh-9/bin/ssh /usr/bin/ssh
|
||
sudo ln -sf /usr/local/openssh-9/bin/scp /usr/bin/scp
|
||
sudo ln -sf /usr/local/openssh-9/bin/sftp /usr/bin/sftp
|
||
sudo ln -sf /usr/local/openssh-9/bin/ssh-keygen /usr/bin/ssh-keygen
|
||
sudo ln -sf /usr/local/openssh-9/bin/ssh-keyscan /usr/bin/ssh-keyscan
|
||
sudo ln -sf /usr/local/openssh-9/bin/ssh-agent /usr/bin/ssh-agent
|
||
sudo ln -sf /usr/local/openssh-9/bin/ssh-add /usr/bin/ssh-add
|
||
|
||
```
|
||
|
||
|
||
|
||
```
|
||
sudo systemctl daemon-reexec
|
||
sudo systemctl daemon-reload
|
||
```
|
||
|
||
```
|
||
sudo systemctl restart sshd
|
||
sudo systemctl status sshd
|
||
```
|
||
|
||
|
||
123，125 , 126,127,128,130:
|
||
|
||
```
|
||
echo "/usr/local/openssl-3/lib64" | sudo tee /etc/ld.so.conf.d/openssl3.conf
|
||
echo "/usr/local/openssl-3/lib" | sudo tee -a /etc/ld.so.conf.d/openssl3.conf
|
||
echo "/usr/local/zlib/lib" | sudo tee /etc/ld.so.conf.d/zlib.conf
|
||
sudo ldconfig
|
||
```
|
||
|
||
|
||
```
|
||
/usr/local/openssl-3/bin/openssl version -a
|
||
/usr/local/openssh-9/bin/ssh -V
|
||
```
|
||
|
||
|
||
```
|
||
sudo mkdir -p /usr/local/openssh-backup
|
||
sudo cp /usr/sbin/sshd /usr/local/openssh-backup/
|
||
sudo cp /usr/bin/ssh* /usr/local/openssh-backup/
|
||
sudo cp -r /etc/ssh /usr/local/openssh-backup/etc_ssh_$(date +%F)
|
||
```
|
||
|
||
|
||
```
|
||
sudo sed -i 's/^[[:space:]]*GSSAPIAuthentication/#&/' /etc/ssh/sshd_config
|
||
|
||
sudo sed -i 's/^[[:space:]]*GSSAPICleanupCredentials/#&/' /etc/ssh/sshd_config
|
||
|
||
sudo sed -i 's/^[[:space:]]*UsePrivilegeSeparation/#&/' /etc/ssh/sshd_config
|
||
|
||
```
|
||
|
||
|
||
生成新服务器key:
|
||
|
||
```
|
||
sudo /usr/local/openssh-9/bin/ssh-keygen -t rsa -b 4096 -f /usr/local/openssh-9/etc/ssh_host_rsa_key -N "" -q
|
||
sudo /usr/local/openssh-9/bin/ssh-keygen -t ecdsa -b 521 -f /usr/local/openssh-9/etc/ssh_host_ecdsa_key -N "" -q
|
||
sudo /usr/local/openssh-9/bin/ssh-keygen -t ed25519 -f /usr/local/openssh-9/etc/ssh_host_ed25519_key -N "" -q
|
||
|
||
```
|
||
|
||
|
||
|
||
|
||
```
|
||
sudo chmod 600 /etc/ssh/ssh_host_*_key
|
||
sudo chmod 644 /etc/ssh/ssh_host_*_key.pub
|
||
```
|
||
|
||
|
||
```
|
||
sudo mkdir -p /var/empty
|
||
sudo chown root:root /var/empty
|
||
sudo chmod 755 /var/empty
|
||
|
||
```
|
||
|
||
|
||
```
|
||
sudo /usr/local/openssh-9/sbin/sshd -p 2222 -f /etc/ssh/sshd_config -D
|
||
```
|
||
|
||
```
|
||
sudo ln -sf /usr/local/openssh-9/sbin/sshd /usr/sbin/sshd
|
||
|
||
sudo ln -sf /usr/local/openssh-9/bin/ssh /usr/bin/ssh
|
||
|
||
sudo ln -sf /usr/local/openssh-9/bin/scp /usr/bin/scp
|
||
|
||
sudo ln -sf /usr/local/openssh-9/bin/sftp /usr/bin/sftp
|
||
|
||
sudo ln -sf /usr/local/openssh-9/bin/ssh-keygen /usr/bin/ssh-keygen
|
||
|
||
sudo ln -sf /usr/local/openssh-9/bin/ssh-keyscan /usr/bin/ssh-keyscan
|
||
|
||
sudo ln -sf /usr/local/openssh-9/bin/ssh-agent /usr/bin/ssh-agent
|
||
|
||
sudo ln -sf /usr/local/openssh-9/bin/ssh-add /usr/bin/ssh-add
|
||
|
||
```
|
||
|
||
|
||
|
||
```
|
||
sudo systemctl daemon-reexec
|
||
|
||
sudo systemctl daemon-reload
|
||
```
|
||
|
||
```
|
||
sudo systemctl restart sshd
|
||
|
||
sudo systemctl status sshd
|
||
```
|
||
|
||
|
||
debug ssh 断开错误
|
||
|
||
```
|
||
sudo /usr/local/openssh-9/sbin/sshd -D -f /usr/local/openssh-9/test/sshd_debug -E /usr/local/openssh-9/test/sshd_debug.log
|
||
|
||
```
|
||
|
||
备份
|
||
```
|
||
sudo mkdir -p /etc/ssh/backup-$(date +%F)
|
||
sudo cp -a /etc/ssh/sshd_config /etc/ssh/backup-$(date +%F)/
|
||
sudo cp -a /etc/ssh/ssh_host_* /etc/ssh/backup-$(date +%F)/
|
||
```
|
||
|
||
|
||
|
||
|
||
```
|
||
sudo /usr/local/openssh-9/bin/ssh-keygen -t rsa -b 4096 -f /usr/local/openssh-9/etc/ssh_host_rsa_key -N ""
|
||
sudo /usr/local/openssh-9/bin/ssh-keygen -t ecdsa -b 521 -f /usr/local/openssh-9/etc/ssh_host_ecdsa_key -N ""
|
||
sudo /usr/local/openssh-9/bin/ssh-keygen -t ed25519 -f /usr/local/openssh-9/etc/ssh_host_ed25519_key -N ""
|
||
|
||
```
|
||
|
||
|
||
```
|
||
sudo chmod 600 /usr/local/openssh-9/etc/ssh/ssh_host_*_key
|
||
sudo chmod 644 /usr/local/openssh-9/etc/ssh/ssh_host_*_key.pub
|
||
```
|
||
|
||
|
||
sshd_config
|
||
|
||
```
|
||
#Port 22
|
||
Port 2222
|
||
ListenAddress 0.0.0.0
|
||
Protocol 2
|
||
HostKey /usr/local/openssh-9/etc/ssh_host_rsa_key
|
||
HostKey /usr/local/openssh-9/etc/ssh_host_ecdsa_key
|
||
HostKey /usr/local/openssh-9/etc/ssh_host_ed25519_key
|
||
PermitRootLogin prohibit-password
|
||
PasswordAuthentication yes
|
||
PubkeyAuthentication yes
|
||
AuthorizedKeysFile .ssh/authorized_keys
|
||
PermitEmptyPasswords no
|
||
ChallengeResponseAuthentication no
|
||
UsePAM yes
|
||
LoginGraceTime 30
|
||
MaxAuthTries 3
|
||
ClientAliveInterval 60
|
||
ClientAliveCountMax 3
|
||
LogLevel INFO
|
||
PidFile /usr/local/openssh-9/etc/sshd.pid
|
||
Subsystem sftp /usr/local/openssh-9/libexec/sftp-server
|
||
|
||
```
|
||
|
||
|
||
|
||
测试语法
|
||
```
|
||
sudo /usr/local/openssh-9/sbin/sshd -t -f /usr/local/openssh-9/etc/sshd_config
|
||
```
|
||
|
||
|
||
|
||
测试运行
|
||
```
|
||
sudo /usr/local/openssh-9/sbin/sshd -D -f /usr/local/openssh-9/etc/sshd_config -E /usr/local/openssh-9/etc/sshd_debug.log
|
||
```
|
||
|
||
|
||
|
||
```
|
||
sudo nano /etc/systemd/system/sshd.service
|
||
```
|
||
|
||
```
|
||
[Unit]
|
||
Description=OpenSSH Daemon (custom build)
|
||
After=network.target auditd.service
|
||
Wants=network.target
|
||
|
||
[Service]
|
||
Type=simple
|
||
ExecStart=/usr/local/openssh-9/sbin/sshd -D -f /usr/local/openssh-9/etc/sshd_config
|
||
ExecReload=/bin/kill -HUP $MAINPID
|
||
Restart=on-failure
|
||
PIDFile=/usr/local/openssh-9/etc/sshd.pid
|
||
|
||
[Install]
|
||
WantedBy=multi-user.target
|
||
|
||
```
|
||
|
||
|
||
```
|
||
sudo /usr/local/openssh-9/sbin/sshd -t -f /usr/local/openssh-9/etc/sshd_config
|
||
```
|
||
|
||
|
||
|
||
```
|
||
sudo systemctl stop ssh
|
||
|
||
sudo systemctl disable ssh
|
||
|
||
```
|
||
|
||
|
||
```
|
||
sudo systemctl daemon-reexec
|
||
|
||
sudo systemctl daemon-reload
|
||
|
||
sudo systemctl enable sshd.service
|
||
|
||
sudo systemctl start sshd.service
|
||
|
||
```
|
||
|
||
```
|
||
sudo /usr/local/openssh-9/sbin/sshd -D -e -f /usr/local/openssh-9/etc/sshd_config
|
||
```
|
||
|
||
|
||
10.194.67.222:
|
||
centos 6.8
|
||
|
||
编译gcc 6.5.0
|
||
|
||
# GMP
|
||
```
|
||
|
||
tar -xf gmp-6.1.2.tar.xz
|
||
cd gmp-6.1.2
|
||
./configure --prefix=/usr/local/gmp
|
||
make -j$(nproc)
|
||
make install
|
||
|
||
```
|
||
|
||
|
||
# MPFR
|
||
```
|
||
tar xf mpfr-4.1.0.tar.xz
|
||
cd mpfr-4.1.0
|
||
./configure \
|
||
--prefix=/usr/local/mpfr \
|
||
--with-gmp=/usr/local/gmp \
|
||
CPPFLAGS="-I/usr/local/gmp/include" \
|
||
LDFLAGS="-L/usr/local/gmp/lib"
|
||
|
||
make -j4
|
||
make install
|
||
|
||
```
|
||
|
||
|
||
# MPC
|
||
```
|
||
|
||
tar xf mpc-1.2.1.tar.gz
|
||
cd mpc-1.2.1
|
||
./configure --prefix=/usr/local/mpc \
|
||
--with-gmp=/usr/local/gmp \
|
||
--with-mpfr=/usr/local/mpfr \
|
||
CPPFLAGS="-I/usr/local/gmp/include -I/usr/local/mpfr/include" \
|
||
LDFLAGS="-L/usr/local/gmp/lib -L/usr/local/mpfr/lib"
|
||
|
||
make -j4
|
||
make install
|
||
|
||
```
|
||
|
||
|
||
# gcc
|
||
|
||
```
|
||
../configure --prefix=/opt/gcc-6.5 \
|
||
--enable-languages=c,c++ \
|
||
--disable-multilib \
|
||
--disable-bootstrap \
|
||
--disable-nls \
|
||
--enable-checking=release \
|
||
--enable-shared \
|
||
--enable-threads=posix \
|
||
--enable-lto \
|
||
--enable-__cxa_atexit \
|
||
--with-system-zlib \
|
||
--with-gmp=/usr/local/gmp \
|
||
--with-mpfr=/usr/local/mpfr \
|
||
--with-mpc=/usr/local/mpc \
|
||
CPPFLAGS="-I/usr/local/gmp/include -I/usr/local/mpfr/include -I/usr/local/mpc/include" \
|
||
LDFLAGS="-L/usr/local/gmp/lib -L/usr/local/mpfr/lib -L/usr/local/mpc/lib"
|
||
|
||
```
|
||
|
||
|
||
|
||
|