vault-para/100-project/Work/公文交换/升级openssh.md

login jump server: 10.160.20.112



```bash
ssh -V
OpenSSH_8.2p1, OpenSSL 1.1.1f  31 Mar 2020

```

```bash
uname -a
Linux v10-200g-clone-10 4.19.90-20.1stable.ky10.aarch64 #1 SMP Sun Aug 23 11:31:17 CST 2020 aarch64 aarch64 aarch64 GNU/Linux
```


```bash
uname -m
aarch64
getenforce
Disabled
```



备份配置

```bash
cp -a /etc/ssh /etc/ssh.bak-$(date +%F)
```


依赖安装

```bash
dnf groupinstall "Development Tools" -y
```
```bash
dnf install -y openssl-devel zlib-devel pam-devel libedit-devel krb5-devel audit-libs-devel libselinux-devel libcap-ng-devel systemd-devel
```


编译

```bash
wget https://codeload.github.com/openssh/openssh-portable/zip/refs/heads/V_10_2
```

```bash
unzip openssh-portable-V_10_2.zip
cd openssh-portable-V_10_2
```

```bash
./configure  --prefix=/usr --sysconfdir=/etc/ssh --sbindir=/usr/sbin  --with-pam  --with-privsep-path=/var/lib/sshd 
```

```bash
make -j"$(nproc)"
```

```bash
make install
```


```bash
chmod 600 /etc/ssh/ssh_host_rsa_key /etc/ssh/ssh_host_ecdsa_key /etc/ssh/ssh_host_ed25519_key
```

- 找到对应行，前面加 #，或直接删除。例如：
```bash
vi /etc/ssh/sshd_config
```


    - # GSSAPIAuthentication no
        
    - # GSSAPICleanupCredentials yes
        
    - # RSAAuthentication no
        
    - # RhostsRSAAuthentication no

```bash
/usr/sbin/sshd -t -f /etc/ssh/sshd_config
```



```
chmod 600 /etc/ssh/ssh_host_rsa_key /etc/ssh/ssh_host_ecdsa_key /etc/ssh/ssh_host_ed25519_key
```


```bash
systemctl daemon-reload
```

```
systemctl enable --now sshd
```

```
systemctl status sshd
```

```
journalctl -u sshd -b
```


```
vi /etc/crypto-policies/back-ends/opensshserver.config
```

```
dnf install -y rpm-build rpmlint
```

制作安装包

```
dnf install -y ruby ruby-devel gcc make rpm-build 
```

```
mkdir -p ~/buildroot
```

```
install -D /usr/sbin/sshd ~/buildroot/usr/sbin/sshd 
install -D /usr/bin/ssh ~/buildroot/usr/bin/ssh 
install -D /usr/bin/scp ~/buildroot/usr/bin/scp 
install -D /usr/bin/sftp ~/buildroot/usr/bin/sftp 
install -D /usr/bin/ssh-keygen ~/buildroot/usr/bin/ssh-keygen 
install -D /usr/bin/ssh-agent ~/buildroot/usr/bin/ssh-agent 
install -D /usr/bin/ssh-add ~/buildroot/usr/bin/ssh-add 
install -D /usr/bin/ssh-keyscan ~/buildroot/usr/bin/ssh-keyscan 
rsync -aR /usr/libexec/ssh/ ~/buildroot/ 2>/dev/null || true rsync -aR /usr/lib/ssh/ ~/buildroot/ 2>/dev/null || true 
install -D /etc/ssh/sshd_config ~/buildroot/etc/ssh/sshd_config 
install -D /etc/ssh/ssh_config ~/buildroot/etc/ssh/ssh_config
```


```
test -f /usr/lib/systemd/system/sshd.service && install -D /usr/lib/systemd/system/sshd.service ~/buildroot/usr/lib/systemd/system/sshd.service || true
```

~/rpmbuild/SPECS/openssh-custom.spec

```
Name:           openssh
Version:        10.2
Release:        1%{?dist}
Summary:        An open source implementation of SSH protocol version 2

License:        BSD
URL:            https://www.openssh.com/
Source0:        https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz

BuildRequires:  gcc
BuildRequires:  make
BuildRequires:  openssl-devel >= 1.1.1
BuildRequires:  zlib-devel
BuildRequires:  pam-devel
BuildRequires:  systemd
BuildRequires:  libselinux-devel

%description
SSH (Secure SHell) is a program for logging into and executing
commands on a remote machine. SSH is intended to replace rlogin and
rsh, and to provide secure encrypted communications between two
untrusted hosts over an insecure network. This package includes the
core files necessary for both the OpenSSH client and server.

%package clients
Summary:        SSH client applications
Requires:       %{name} = %{version}-%{release}

%description clients
OpenSSH clients, including ssh, scp, and sftp.

%package server
Summary:        SSH server daemon
Requires:       %{name} = %{version}-%{release}
Requires(post): systemd
Requires(preun): systemd
Requires(postun): systemd

%description server
OpenSSH server daemon (sshd) with support for the new sshd-session
and sshd-auth architecture introduced in OpenSSH 9.8+.

%prep
%setup -q -n openssh-portable-V_10_2

%build
%configure \
    --sysconfdir=%{_sysconfdir}/ssh \
    --libexecdir=%{_libexecdir}/openssh \
    --datadir=%{_datadir}/openssh \
    --with-pam \
    --with-selinux \
    --with-privsep-path=/var/empty/sshd \
    --with-pid-dir=/run \
    --with-ssl-engine \
    --disable-strip

make %{?_smp_mflags}

%install
rm -rf %{buildroot}
make install DESTDIR=%{buildroot}

# Install systemd unit files
install -d %{buildroot}%{_unitdir}

# Create sshd.service file
cat > %{buildroot}%{_unitdir}/sshd.service << 'SVCEOF'
[Unit]
Description=OpenSSH server daemon
Documentation=man:sshd(8) man:sshd_config(5)
After=network.target sshd-keygen.target
Wants=sshd-keygen.target

[Service]
Type=notify
EnvironmentFile=-/etc/sysconfig/sshd
ExecStart=/usr/sbin/sshd -D $OPTIONS
ExecReload=/bin/kill -HUP $MAINPID
KillMode=process
Restart=on-failure
RestartSec=42s

[Install]
WantedBy=multi-user.target
SVCEOF

# Create sshd-keygen service
cat > %{buildroot}%{_unitdir}/sshd-keygen@.service << 'KEYGENEOF'
[Unit]
Description=OpenSSH Server Key Generation
ConditionFileNotEmpty=|!/etc/ssh/ssh_host_rsa_key
ConditionFileNotEmpty=|!/etc/ssh/ssh_host_ecdsa_key
ConditionFileNotEmpty=|!/etc/ssh/ssh_host_ed25519_key

[Service]
Type=oneshot
ExecStart=/usr/bin/ssh-keygen -A
RemainAfterExit=yes
KEYGENEOF

# Create sshd-keygen target
cat > %{buildroot}%{_unitdir}/sshd-keygen.target << 'KEYTAREOF'
[Unit]
Description=OpenSSH Server Key Generation
Documentation=man:sshd(8) man:ssh-keygen(1)
ConditionFileNotEmpty=|!/etc/ssh/ssh_host_rsa_key
ConditionFileNotEmpty=|!/etc/ssh/ssh_host_ecdsa_key
ConditionFileNotEmpty=|!/etc/ssh/ssh_host_ed25519_key
KEYTAREOF

# Create empty sshd privsep directory
install -d -m 0711 %{buildroot}/var/empty/sshd

# Install PAM configuration
install -d %{buildroot}%{_sysconfdir}/pam.d
cat > %{buildroot}%{_sysconfdir}/pam.d/sshd << 'PAMEOF'
#%PAM-1.0
auth       substack     password-auth
auth       include      postlogin
account    required     pam_sepermit.so
account    required     pam_nologin.so
account    include      password-auth
password   include      password-auth
session    required     pam_selinux.so close
session    required     pam_loginuid.so
session    required     pam_selinux.so open env_params
session    required     pam_namespace.so
session    optional     pam_keyinit.so force revoke
session    optional     pam_motd.so
session    include      password-auth
session    include      postlogin
PAMEOF

# Modify sshd_config to enable root login
sed -i 's/#PermitRootLogin prohibit-password/PermitRootLogin yes/' \
    %{buildroot}%{_sysconfdir}/ssh/sshd_config

# Ensure PermitRootLogin is set
if ! grep -q "^PermitRootLogin" %{buildroot}%{_sysconfdir}/ssh/sshd_config; then
    echo "PermitRootLogin yes" >> %{buildroot}%{_sysconfdir}/ssh/sshd_config
fi

# Create sysconfig directory
install -d %{buildroot}%{_sysconfdir}/sysconfig
cat > %{buildroot}%{_sysconfdir}/sysconfig/sshd << 'SYSCONFIGEOF'
# Configuration file for the sshd service.

# Options for sshd
OPTIONS=""
SYSCONFIGEOF

%files
%license LICENCE
%doc ChangeLog CREDITS OVERVIEW PROTOCOL* README*
%dir %{_sysconfdir}/ssh
%config(noreplace) %{_sysconfdir}/ssh/moduli
%config(noreplace) %{_sysconfdir}/ssh/ssh_config
%{_mandir}/man5/moduli.5*
%{_mandir}/man5/ssh_config.5*
%{_mandir}/man5/sshd_config.5*

%files clients
%{_bindir}/ssh
%{_bindir}/scp
%{_bindir}/sftp
%{_bindir}/ssh-add
%{_bindir}/ssh-agent
%{_bindir}/ssh-keygen
%{_bindir}/ssh-keyscan
%dir %{_libexecdir}/openssh
%{_libexecdir}/openssh/ssh-keysign
%{_libexecdir}/openssh/ssh-pkcs11-helper
%{_libexecdir}/openssh/ssh-sk-helper
%{_mandir}/man1/scp.1*
%{_mandir}/man1/sftp.1*
%{_mandir}/man1/ssh.1*
%{_mandir}/man1/ssh-add.1*
%{_mandir}/man1/ssh-agent.1*
%{_mandir}/man1/ssh-keygen.1*
%{_mandir}/man1/ssh-keyscan.1*
%{_mandir}/man8/ssh-keysign.8*
%{_mandir}/man8/ssh-pkcs11-helper.8*
%{_mandir}/man8/ssh-sk-helper.8*

%files server
%{_sbindir}/sshd
%dir %{_libexecdir}/openssh
%{_libexecdir}/openssh/sftp-server
%{_libexecdir}/openssh/sshd-session
%{_libexecdir}/openssh/sshd-auth
%{_unitdir}/sshd.service
%{_unitdir}/sshd-keygen@.service
%{_unitdir}/sshd-keygen.target
%dir %attr(0711,root,root) /var/empty/sshd
%config(noreplace) %{_sysconfdir}/ssh/sshd_config
%config(noreplace) %{_sysconfdir}/pam.d/sshd
%config(noreplace) %{_sysconfdir}/sysconfig/sshd
%{_mandir}/man8/sshd.8*
%{_mandir}/man8/sftp-server.8*

%pre server
# Create sshd user if it doesn't exist
getent group sshd >/dev/null || groupadd -r sshd
getent passwd sshd >/dev/null || \
    useradd -r -g sshd -d /var/empty/sshd -s /sbin/nologin \
    -c "Privilege-separated SSH" sshd
exit 0

%post server
%systemd_post sshd.service
# Generate host keys if they don't exist
/usr/bin/ssh-keygen -A >/dev/null 2>&1 || :

%preun server
%systemd_preun sshd.service

%postun server
%systemd_postun_with_restart sshd.service

%changelog
* Wed Oct 22 2025 System Administrator <admin@example.com> - 10.2-1
- Update to OpenSSH 10.2
- Enable PermitRootLogin by default
- Add support for sshd-session and sshd-auth
- Include systemd service files
- Add PAM configuration
- Create privilege separation user and directory

```



```
find ~/rpmbuild/BUILD/openssh-10.2-1.ky10.*/usr/libexec/openssh/ -type f
```



```
处理完：
117
177

不能ssh
102

```



处理102:

1. 下载新编译的openssh
```
-rw-r--r-- 1 root root 209096 Oct 22 14:45 openssh-10.2-1.ky10.ky10.aarch64.rpm
-rw-r--r-- 1 root root 872348 Oct 22 14:45 openssh-clients-10.2-1.ky10.ky10.aarch64.rpm
-rw-r--r-- 1 root root 576228 Oct 22 14:45 openssh-server-10.2-1.ky10.ky10.aarch64.rpm

```




2.  修改 /etc/ssh/sshd_config
注释选项

```
GSSAPIAuthentication
```

```
GSSAPICleanupCredentials
```

```
RSAAuthentication
```

```
RhostsRSAAuthentication
```

注释

```
/etc/crypto-policies/back-ends/opensshserver.config
```


3.  修改    
```
chmod 600 /etc/ssh/ssh_*
```



3. 安装
```
dnf install ./openssh-*
```

4. 测试

```
/usr/sbin/sshd -t 
```


```
/usr/sbin/sshd -D -d 
```

```
systemctl daemon-reload 
systemctl enable --now sshd
systemctl start sshd
systemctl status sshd
```


112:
安装 openssh 10 with openssl 3

生成key
```
/usr/local/openssh-10/bin/ssh-keygen -t rsa -b 4096 -f /usr/local/openssh-10/etc/ssh_host_rsa_key -N "" -q
/usr/local/openssh-10/bin/ssh-keygen -t ecdsa -b 521 -f /usr/local/openssh-10/etc/ssh_host_ecdsa_key -N "" -q
/usr/local/openssh-10/bin/ssh-keygen -t ed25519 -f /usr/local/openssh-10/etc/ssh_host_ed25519_key -N "" -q
```

测试语法

```
/usr/local/openssh-10/sbin/sshd -t -f /usr/local/openssh-10/etc/sshd_config
```


```
mkdir -p /var/empty
chown root:root /var/empty
chmod 755 /var/empty
```


测试启动
```
/usr/local/openssh-10/sbin/sshd -p 2222 -f /usr/local/openssh-10/etc/sshd_config -D
```


备份
```
mkdir -p /usr/local/openssh-backup
cp /usr/sbin/sshd /usr/local/openssh-backup/
cp /usr/bin/ssh* /usr/local/openssh-backup/
cp -r /etc/ssh /usr/local/openssh-backup/etc_ssh_$(date +%F)
```

替换
```
 ln -sf /usr/local/openssh-10/sbin/sshd /usr/sbin/sshd
 ln -sf /usr/local/openssh-10/bin/ssh /usr/bin/ssh
 ln -sf /usr/local/openssh-10/bin/scp /usr/bin/scp
 ln -sf /usr/local/openssh-10/bin/sftp /usr/bin/sftp
 ln -sf /usr/local/openssh-10/bin/ssh-keygen /usr/bin/ssh-keygen
 ln -sf /usr/local/openssh-10/bin/ssh-keyscan /usr/bin/ssh-keyscan
 ln -sf /usr/local/openssh-10/bin/ssh-agent /usr/bin/ssh-agent
 ln -sf /usr/local/openssh-10/bin/ssh-add /usr/bin/ssh-add
```


```
cp /usr/lib/systemd/system/sshd.service /etc/systemd/system/sshd.service
```


```
sed -i 's|ExecStart=.*|ExecStart=/usr/local/openssh-10/sbin/sshd -D -f /usr/local/openssh-10/etc/sshd_config|' /etc/systemd/system/sshd.service

sed -i '/^\[Service\]/a Environment="LD_LIBRARY_PATH=/usr/local/openssl-3/lib"' /etc/systemd/system/sshd.service

```

```
sudo systemctl daemon-reexec
sudo systemctl daemon-reload
```

```
sudo systemctl restart sshd
sudo systemctl status sshd
```


10.160.20.112, 10.160.20.113,10.160.20.114,10.160.20.115,10.160.20.116,10.160.20.118,10.160.20.119,10.160.20.107



```
export LD_LIBRARY_PATH=/usr/local/openssl-3/lib:/usr/local/openssl-3/lib64
```

```
/usr/local/openssl-3/bin/openssl version -a
/usr/local/openssh-10/bin/ssh -V
```



生成key
```
/usr/local/openssh-10/bin/ssh-keygen -t rsa -b 4096 -f /usr/local/openssh-10/etc/ssh_host_rsa_key -N "" -q
/usr/local/openssh-10/bin/ssh-keygen -t ecdsa -b 521 -f /usr/local/openssh-10/etc/ssh_host_ecdsa_key -N "" -q
/usr/local/openssh-10/bin/ssh-keygen -t ed25519 -f /usr/local/openssh-10/etc/ssh_host_ed25519_key -N "" -q
```

测试语法

```
/usr/local/openssh-10/sbin/sshd -t -f /usr/local/openssh-10/etc/sshd_config
```


```
mkdir -p /var/empty
chown root:root /var/empty
chmod 755 /var/empty
```


测试启动
```
/usr/local/openssh-10/sbin/sshd -p 2222 -f /usr/local/openssh-10/etc/sshd_config -D
```


备份
```
mkdir -p /usr/local/openssh-backup
cp /usr/sbin/sshd /usr/local/openssh-backup/
cp /usr/bin/ssh* /usr/local/openssh-backup/
cp -r /etc/ssh /usr/local/openssh-backup/etc_ssh_$(date +%F)
```


替换
```
 ln -sf /usr/local/openssh-10/sbin/sshd /usr/sbin/sshd
 ln -sf /usr/local/openssh-10/bin/ssh /usr/bin/ssh
 ln -sf /usr/local/openssh-10/bin/scp /usr/bin/scp
 ln -sf /usr/local/openssh-10/bin/sftp /usr/bin/sftp
 ln -sf /usr/local/openssh-10/bin/ssh-keygen /usr/bin/ssh-keygen
 ln -sf /usr/local/openssh-10/bin/ssh-keyscan /usr/bin/ssh-keyscan
 ln -sf /usr/local/openssh-10/bin/ssh-agent /usr/bin/ssh-agent
 ln -sf /usr/local/openssh-10/bin/ssh-add /usr/bin/ssh-add
```


```
cp /usr/lib/systemd/system/sshd.service /etc/systemd/system/sshd.service
```


```
sed -i 's|ExecStart=.*|ExecStart=/usr/local/openssh-10/sbin/sshd -D -f /usr/local/openssh-10/etc/sshd_config|' /etc/systemd/system/sshd.service

sed -i '/^\[Service\]/a Environment="LD_LIBRARY_PATH=/usr/local/openssl-3/lib"' /etc/systemd/system/sshd.service

```

```
sudo systemctl daemon-reexec
sudo systemctl daemon-reload
```

```
sudo systemctl restart sshd
sudo systemctl status sshd
```