login jump server: 10.160.20.112 ```bash ssh -V OpenSSH_8.2p1, OpenSSL 1.1.1f 31 Mar 2020 ``` ```bash uname -a Linux v10-200g-clone-10 4.19.90-20.1stable.ky10.aarch64 #1 SMP Sun Aug 23 11:31:17 CST 2020 aarch64 aarch64 aarch64 GNU/Linux ``` ```bash uname -m aarch64 getenforce Disabled ``` 备份配置 ```bash cp -a /etc/ssh /etc/ssh.bak-$(date +%F) ``` 依赖安装 ```bash dnf groupinstall "Development Tools" -y ``` ```bash dnf install -y openssl-devel zlib-devel pam-devel libedit-devel krb5-devel audit-libs-devel libselinux-devel libcap-ng-devel systemd-devel ``` 编译 ```bash wget https://codeload.github.com/openssh/openssh-portable/zip/refs/heads/V_10_2 ``` ```bash unzip openssh-portable-V_10_2.zip cd openssh-portable-V_10_2 ``` ```bash ./configure --prefix=/usr --sysconfdir=/etc/ssh --sbindir=/usr/sbin --with-pam --with-privsep-path=/var/lib/sshd ``` ```bash make -j"$(nproc)" ``` ```bash make install ``` ```bash chmod 600 /etc/ssh/ssh_host_rsa_key /etc/ssh/ssh_host_ecdsa_key /etc/ssh/ssh_host_ed25519_key ``` - 找到对应行，前面加 #，或直接删除。例如： ```bash vi /etc/ssh/sshd_config ``` - # GSSAPIAuthentication no - # GSSAPICleanupCredentials yes - # RSAAuthentication no - # RhostsRSAAuthentication no ```bash /usr/sbin/sshd -t -f /etc/ssh/sshd_config ``` ``` chmod 600 /etc/ssh/ssh_host_rsa_key /etc/ssh/ssh_host_ecdsa_key /etc/ssh/ssh_host_ed25519_key ``` ```bash systemctl daemon-reload ``` ``` systemctl enable --now sshd ``` ``` systemctl status sshd ``` ``` journalctl -u sshd -b ``` ``` vi /etc/crypto-policies/back-ends/opensshserver.config ``` ``` dnf install -y rpm-build rpmlint ``` 制作安装包 ``` dnf install -y ruby ruby-devel gcc make rpm-build ``` ``` mkdir -p ~/buildroot ``` ``` install -D /usr/sbin/sshd ~/buildroot/usr/sbin/sshd install -D /usr/bin/ssh ~/buildroot/usr/bin/ssh install -D /usr/bin/scp ~/buildroot/usr/bin/scp install -D /usr/bin/sftp ~/buildroot/usr/bin/sftp install -D /usr/bin/ssh-keygen ~/buildroot/usr/bin/ssh-keygen install -D /usr/bin/ssh-agent ~/buildroot/usr/bin/ssh-agent install -D /usr/bin/ssh-add ~/buildroot/usr/bin/ssh-add install -D /usr/bin/ssh-keyscan ~/buildroot/usr/bin/ssh-keyscan rsync -aR /usr/libexec/ssh/ ~/buildroot/ 2>/dev/null || true rsync -aR /usr/lib/ssh/ ~/buildroot/ 2>/dev/null || true install -D /etc/ssh/sshd_config ~/buildroot/etc/ssh/sshd_config install -D /etc/ssh/ssh_config ~/buildroot/etc/ssh/ssh_config ``` ``` test -f /usr/lib/systemd/system/sshd.service && install -D /usr/lib/systemd/system/sshd.service ~/buildroot/usr/lib/systemd/system/sshd.service || true ``` ~/rpmbuild/SPECS/openssh-custom.spec ``` Name: openssh Version: 10.2 Release: 1%{?dist} Summary: An open source implementation of SSH protocol version 2 License: BSD URL: https://www.openssh.com/ Source0: https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz BuildRequires: gcc BuildRequires: make BuildRequires: openssl-devel >= 1.1.1 BuildRequires: zlib-devel BuildRequires: pam-devel BuildRequires: systemd BuildRequires: libselinux-devel %description SSH (Secure SHell) is a program for logging into and executing commands on a remote machine. SSH is intended to replace rlogin and rsh, and to provide secure encrypted communications between two untrusted hosts over an insecure network. This package includes the core files necessary for both the OpenSSH client and server. %package clients Summary: SSH client applications Requires: %{name} = %{version}-%{release} %description clients OpenSSH clients, including ssh, scp, and sftp. %package server Summary: SSH server daemon Requires: %{name} = %{version}-%{release} Requires(post): systemd Requires(preun): systemd Requires(postun): systemd %description server OpenSSH server daemon (sshd) with support for the new sshd-session and sshd-auth architecture introduced in OpenSSH 9.8+. %prep %setup -q -n openssh-portable-V_10_2 %build %configure \ --sysconfdir=%{_sysconfdir}/ssh \ --libexecdir=%{_libexecdir}/openssh \ --datadir=%{_datadir}/openssh \ --with-pam \ --with-selinux \ --with-privsep-path=/var/empty/sshd \ --with-pid-dir=/run \ --with-ssl-engine \ --disable-strip make %{?_smp_mflags} %install rm -rf %{buildroot} make install DESTDIR=%{buildroot} # Install systemd unit files install -d %{buildroot}%{_unitdir} # Create sshd.service file cat > %{buildroot}%{_unitdir}/sshd.service << 'SVCEOF' [Unit] Description=OpenSSH server daemon Documentation=man:sshd(8) man:sshd_config(5) After=network.target sshd-keygen.target Wants=sshd-keygen.target [Service] Type=notify EnvironmentFile=-/etc/sysconfig/sshd ExecStart=/usr/sbin/sshd -D $OPTIONS ExecReload=/bin/kill -HUP $MAINPID KillMode=process Restart=on-failure RestartSec=42s [Install] WantedBy=multi-user.target SVCEOF # Create sshd-keygen service cat > %{buildroot}%{_unitdir}/sshd-keygen@.service << 'KEYGENEOF' [Unit] Description=OpenSSH Server Key Generation ConditionFileNotEmpty=|!/etc/ssh/ssh_host_rsa_key ConditionFileNotEmpty=|!/etc/ssh/ssh_host_ecdsa_key ConditionFileNotEmpty=|!/etc/ssh/ssh_host_ed25519_key [Service] Type=oneshot ExecStart=/usr/bin/ssh-keygen -A RemainAfterExit=yes KEYGENEOF # Create sshd-keygen target cat > %{buildroot}%{_unitdir}/sshd-keygen.target << 'KEYTAREOF' [Unit] Description=OpenSSH Server Key Generation Documentation=man:sshd(8) man:ssh-keygen(1) ConditionFileNotEmpty=|!/etc/ssh/ssh_host_rsa_key ConditionFileNotEmpty=|!/etc/ssh/ssh_host_ecdsa_key ConditionFileNotEmpty=|!/etc/ssh/ssh_host_ed25519_key KEYTAREOF # Create empty sshd privsep directory install -d -m 0711 %{buildroot}/var/empty/sshd # Install PAM configuration install -d %{buildroot}%{_sysconfdir}/pam.d cat > %{buildroot}%{_sysconfdir}/pam.d/sshd << 'PAMEOF' #%PAM-1.0 auth substack password-auth auth include postlogin account required pam_sepermit.so account required pam_nologin.so account include password-auth password include password-auth session required pam_selinux.so close session required pam_loginuid.so session required pam_selinux.so open env_params session required pam_namespace.so session optional pam_keyinit.so force revoke session optional pam_motd.so session include password-auth session include postlogin PAMEOF # Modify sshd_config to enable root login sed -i 's/#PermitRootLogin prohibit-password/PermitRootLogin yes/' \ %{buildroot}%{_sysconfdir}/ssh/sshd_config # Ensure PermitRootLogin is set if ! grep -q "^PermitRootLogin" %{buildroot}%{_sysconfdir}/ssh/sshd_config; then echo "PermitRootLogin yes" >> %{buildroot}%{_sysconfdir}/ssh/sshd_config fi # Create sysconfig directory install -d %{buildroot}%{_sysconfdir}/sysconfig cat > %{buildroot}%{_sysconfdir}/sysconfig/sshd << 'SYSCONFIGEOF' # Configuration file for the sshd service. # Options for sshd OPTIONS="" SYSCONFIGEOF %files %license LICENCE %doc ChangeLog CREDITS OVERVIEW PROTOCOL* README* %dir %{_sysconfdir}/ssh %config(noreplace) %{_sysconfdir}/ssh/moduli %config(noreplace) %{_sysconfdir}/ssh/ssh_config %{_mandir}/man5/moduli.5* %{_mandir}/man5/ssh_config.5* %{_mandir}/man5/sshd_config.5* %files clients %{_bindir}/ssh %{_bindir}/scp %{_bindir}/sftp %{_bindir}/ssh-add %{_bindir}/ssh-agent %{_bindir}/ssh-keygen %{_bindir}/ssh-keyscan %dir %{_libexecdir}/openssh %{_libexecdir}/openssh/ssh-keysign %{_libexecdir}/openssh/ssh-pkcs11-helper %{_libexecdir}/openssh/ssh-sk-helper %{_mandir}/man1/scp.1* %{_mandir}/man1/sftp.1* %{_mandir}/man1/ssh.1* %{_mandir}/man1/ssh-add.1* %{_mandir}/man1/ssh-agent.1* %{_mandir}/man1/ssh-keygen.1* %{_mandir}/man1/ssh-keyscan.1* %{_mandir}/man8/ssh-keysign.8* %{_mandir}/man8/ssh-pkcs11-helper.8* %{_mandir}/man8/ssh-sk-helper.8* %files server %{_sbindir}/sshd %dir %{_libexecdir}/openssh %{_libexecdir}/openssh/sftp-server %{_libexecdir}/openssh/sshd-session %{_libexecdir}/openssh/sshd-auth %{_unitdir}/sshd.service %{_unitdir}/sshd-keygen@.service %{_unitdir}/sshd-keygen.target %dir %attr(0711,root,root) /var/empty/sshd %config(noreplace) %{_sysconfdir}/ssh/sshd_config %config(noreplace) %{_sysconfdir}/pam.d/sshd %config(noreplace) %{_sysconfdir}/sysconfig/sshd %{_mandir}/man8/sshd.8* %{_mandir}/man8/sftp-server.8* %pre server # Create sshd user if it doesn't exist getent group sshd >/dev/null || groupadd -r sshd getent passwd sshd >/dev/null || \ useradd -r -g sshd -d /var/empty/sshd -s /sbin/nologin \ -c "Privilege-separated SSH" sshd exit 0 %post server %systemd_post sshd.service # Generate host keys if they don't exist /usr/bin/ssh-keygen -A >/dev/null 2>&1 || : %preun server %systemd_preun sshd.service %postun server %systemd_postun_with_restart sshd.service %changelog * Wed Oct 22 2025 System Administrator - 10.2-1 - Update to OpenSSH 10.2 - Enable PermitRootLogin by default - Add support for sshd-session and sshd-auth - Include systemd service files - Add PAM configuration - Create privilege separation user and directory ``` ``` find ~/rpmbuild/BUILD/openssh-10.2-1.ky10.*/usr/libexec/openssh/ -type f ``` ``` 处理完： 117 177 不能ssh 102 ``` 处理102: 1. 下载新编译的openssh ``` -rw-r--r-- 1 root root 209096 Oct 22 14:45 openssh-10.2-1.ky10.ky10.aarch64.rpm -rw-r--r-- 1 root root 872348 Oct 22 14:45 openssh-clients-10.2-1.ky10.ky10.aarch64.rpm -rw-r--r-- 1 root root 576228 Oct 22 14:45 openssh-server-10.2-1.ky10.ky10.aarch64.rpm ``` 2. 修改 /etc/ssh/sshd_config 注释选项 ``` GSSAPIAuthentication ``` ``` GSSAPICleanupCredentials ``` ``` RSAAuthentication ``` ``` RhostsRSAAuthentication ``` 注释 ``` /etc/crypto-policies/back-ends/opensshserver.config ``` 3. 修改 ``` chmod 600 /etc/ssh/ssh_* ``` 3. 安装 ``` dnf install ./openssh-* ``` 4. 测试 ``` /usr/sbin/sshd -t ``` ``` /usr/sbin/sshd -D -d ``` ``` systemctl daemon-reload systemctl enable --now sshd systemctl start sshd systemctl status sshd ``` 112: 安装 openssh 10 with openssl 3 生成key ``` /usr/local/openssh-10/bin/ssh-keygen -t rsa -b 4096 -f /usr/local/openssh-10/etc/ssh_host_rsa_key -N "" -q /usr/local/openssh-10/bin/ssh-keygen -t ecdsa -b 521 -f /usr/local/openssh-10/etc/ssh_host_ecdsa_key -N "" -q /usr/local/openssh-10/bin/ssh-keygen -t ed25519 -f /usr/local/openssh-10/etc/ssh_host_ed25519_key -N "" -q ``` 测试语法 ``` /usr/local/openssh-10/sbin/sshd -t -f /usr/local/openssh-10/etc/sshd_config ``` ``` mkdir -p /var/empty chown root:root /var/empty chmod 755 /var/empty ``` 测试启动 ``` /usr/local/openssh-10/sbin/sshd -p 2222 -f /usr/local/openssh-10/etc/sshd_config -D ``` 备份 ``` mkdir -p /usr/local/openssh-backup cp /usr/sbin/sshd /usr/local/openssh-backup/ cp /usr/bin/ssh* /usr/local/openssh-backup/ cp -r /etc/ssh /usr/local/openssh-backup/etc_ssh_$(date +%F) ``` 替换 ``` ln -sf /usr/local/openssh-10/sbin/sshd /usr/sbin/sshd ln -sf /usr/local/openssh-10/bin/ssh /usr/bin/ssh ln -sf /usr/local/openssh-10/bin/scp /usr/bin/scp ln -sf /usr/local/openssh-10/bin/sftp /usr/bin/sftp ln -sf /usr/local/openssh-10/bin/ssh-keygen /usr/bin/ssh-keygen ln -sf /usr/local/openssh-10/bin/ssh-keyscan /usr/bin/ssh-keyscan ln -sf /usr/local/openssh-10/bin/ssh-agent /usr/bin/ssh-agent ln -sf /usr/local/openssh-10/bin/ssh-add /usr/bin/ssh-add ``` ``` cp /usr/lib/systemd/system/sshd.service /etc/systemd/system/sshd.service ``` ``` sed -i 's|ExecStart=.*|ExecStart=/usr/local/openssh-10/sbin/sshd -D -f /usr/local/openssh-10/etc/sshd_config|' /etc/systemd/system/sshd.service sed -i '/^\[Service\]/a Environment="LD_LIBRARY_PATH=/usr/local/openssl-3/lib"' /etc/systemd/system/sshd.service ``` ``` sudo systemctl daemon-reexec sudo systemctl daemon-reload ``` ``` sudo systemctl restart sshd sudo systemctl status sshd ``` 10.160.20.112, 10.160.20.113,10.160.20.114,10.160.20.115,10.160.20.116,10.160.20.118,10.160.20.119,10.160.20.107 ``` export LD_LIBRARY_PATH=/usr/local/openssl-3/lib:/usr/local/openssl-3/lib64 ``` ``` /usr/local/openssl-3/bin/openssl version -a /usr/local/openssh-10/bin/ssh -V ``` 生成key ``` /usr/local/openssh-10/bin/ssh-keygen -t rsa -b 4096 -f /usr/local/openssh-10/etc/ssh_host_rsa_key -N "" -q /usr/local/openssh-10/bin/ssh-keygen -t ecdsa -b 521 -f /usr/local/openssh-10/etc/ssh_host_ecdsa_key -N "" -q /usr/local/openssh-10/bin/ssh-keygen -t ed25519 -f /usr/local/openssh-10/etc/ssh_host_ed25519_key -N "" -q ``` 测试语法 ``` /usr/local/openssh-10/sbin/sshd -t -f /usr/local/openssh-10/etc/sshd_config ``` ``` mkdir -p /var/empty chown root:root /var/empty chmod 755 /var/empty ``` 测试启动 ``` /usr/local/openssh-10/sbin/sshd -p 2222 -f /usr/local/openssh-10/etc/sshd_config -D ``` 备份 ``` mkdir -p /usr/local/openssh-backup cp /usr/sbin/sshd /usr/local/openssh-backup/ cp /usr/bin/ssh* /usr/local/openssh-backup/ cp -r /etc/ssh /usr/local/openssh-backup/etc_ssh_$(date +%F) ``` 替换 ``` ln -sf /usr/local/openssh-10/sbin/sshd /usr/sbin/sshd ln -sf /usr/local/openssh-10/bin/ssh /usr/bin/ssh ln -sf /usr/local/openssh-10/bin/scp /usr/bin/scp ln -sf /usr/local/openssh-10/bin/sftp /usr/bin/sftp ln -sf /usr/local/openssh-10/bin/ssh-keygen /usr/bin/ssh-keygen ln -sf /usr/local/openssh-10/bin/ssh-keyscan /usr/bin/ssh-keyscan ln -sf /usr/local/openssh-10/bin/ssh-agent /usr/bin/ssh-agent ln -sf /usr/local/openssh-10/bin/ssh-add /usr/bin/ssh-add ``` ``` cp /usr/lib/systemd/system/sshd.service /etc/systemd/system/sshd.service ``` ``` sed -i 's|ExecStart=.*|ExecStart=/usr/local/openssh-10/sbin/sshd -D -f /usr/local/openssh-10/etc/sshd_config|' /etc/systemd/system/sshd.service sed -i '/^\[Service\]/a Environment="LD_LIBRARY_PATH=/usr/local/openssl-3/lib"' /etc/systemd/system/sshd.service ``` ``` sudo systemctl daemon-reexec sudo systemctl daemon-reload ``` ``` sudo systemctl restart sshd sudo systemctl status sshd ```