AlmaLinux9.4 升级OpenSSH到9.8p1版本

# 启动后无法登录、权限等问题，关闭SELinux
cat /etc/selinux/config
setenforce 0 && sed -i 's/^SELINUX=.*/SELINUX=disabled/' /etc/selinux/config && getenforce
cat /etc/selinux/config

[root@host121 ~]# ssh -V
OpenSSH_8.7p1, OpenSSL 3.2.2 4 Jun 2024
[gzapps@host88 ~]$ which ssh
/usr/bin/ssh
[gzapps@host88 ~]$ whereis ssh
ssh: /usr/bin/ssh /etc/ssh /usr/share/man/man1/ssh.1.gz
[root@host121 gxjt]# openssl version
OpenSSL 3.2.2 4 Jun 2024 (Library: OpenSSL 3.2.2 4 Jun 2024)

dnf install telnet telnet-server  -y
firewall-cmd --permanent --add-port=23/tcp --zone=public
firewall-cmd --reload
systemctl start telnet.socket
firewall-cmd --list-ports
ss -nltp| grep 23

#备份ssh相关文件
mkdir -p ~/sshbak20241226/
cp -rf /etc/ssh ~/sshbak20241226/
cp -rf /usr/bin/openssl ~/sshbak20241226/openssl
cp /usr/bin/ssh ~/sshbak20241226/ssh.bak
cp /usr/bin/ssh-keygen ~/sshbak20241226/
cp /usr/sbin/sshd ~/sshbak20241226/
cp -rf /etc/pam.d/ ~/sshbak20241226/pam.d
cp -rf /usr/lib/systemd/system  ~/sshbak20241226/
#验证备份
ls -l ~/sshbak20241226/

#安装源码编译依赖包
#yum groupinstall "Development Tools" -y
yum install -y zlib-devel openssl-devel gcc make perl-devel pam-devel unzip wget tar

# 自行查看版本:openssl version，如需编译安装可参考：https://199604.com/2420 编译安装openssl


# 下载源码并编译升级 openssh
cd /usr/local/src/
wget https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-9.8p1.tar.gz
tar -xzf openssh-9.8p1.tar.gz
cd openssh-9.8p1
./configure --prefix=/usr/ --sysconfdir=/etc/ssh --with-zlib --with-md5-passwords --with-pam

# 如编译openssl了，需要指定--with-ssl-dir目录路径
#./configure --prefix=/usr/ --sysconfdir=/etc/ssh --with-ssl-dir=/usr/local/openssl --with-zlib --with-md5-passwords --with-pam

make -j 4 && make install 

# 配置文件权限
chmod 600 /etc/ssh/ssh_host_*_key

# 重启ssh
systemctl restart sshd
systemctl status sshd

#错误1：
-------------
12月 26 21:25:38 host103 sshd[2265892]: /etc/crypto-policies/back-ends/opensshserver.config: line 3: Bad configuration option: GSSAPIKexAlgorithms
12月 26 21:25:38 host103 sshd[2265892]: /etc/crypto-policies/back-ends/opensshserver.config: terminating, 1 bad configuration options
12月 26 21:25:38 host103 systemd[1]: sshd.service: Main process exited, code=exited, status=255/EXCEPTION
-------------
#解决，注释/etc/crypto-policies/back-ends/opensshserver.config文件的GSSAPIKexAlgorithms
--------------------------
vim /etc/crypto-policies/back-ends/opensshserver.config
#GSSAPIKexAlgorithms gss-curve25519-sha256-,gss-nistp256-sha256-,gss-group14-sha256-,gss-group16-sha512-
-------------


#错误2：
12月 26 21:29:02 host103 sshd[2267542]: /etc/ssh/sshd_config.d/50-redhat.conf line 12: Unsupported option GSSAPIAuthentication
12月 26 21:29:02 host103 sshd[2267542]: /etc/ssh/sshd_config.d/50-redhat.conf line 13: Unsupported option GSSAPICleanupCredentials
#解决，注释etc/ssh/sshd_config.d/50-redhat.conf文件的 GSSAPIAuthentication和GSSAPICleanupCredentials
--------------------------
vim /etc/ssh/sshd_config.d/50-redhat.conf
#GSSAPIAuthentication yes
#GSSAPICleanupCredentials no

[root@host27 openssh-9.8p1]# ssh -V
OpenSSH_9.8p1, OpenSSL 3.2.2 4 Jun 2024


[gzapps@host90 ~]$ which ssh
/usr/bin/ssh

#关闭Telnet服务
#停止Telnet 服务
systemctl stop telnet.socket
systemctl status telnet.socket
#禁用Telnet服务开机启动
systemctl disable telnet.socket