OpenSSH 업그레이드 - CentOS/RHEL 7.9

CVE 취약점 조치 일환이다.
OpenSSL도 같이 올려줘야 한다.
가급적 최신 것으로 올린다.
민감한 서비스가 실행되고 있으면 업그레이드에 신중을 기한다.
SSH를 중지해야 하니 콘솔이나 Telnet으로 작업한다.
yum으로 OpenSSL, OpenSSH 삭제시 디펜던시들이 제거되지 않도록 한다.
OpenSSL을 먼저한다.

 

【버전 확인】

cat /etc/redhat-release
openssl version
ssh -V

【OpenSSL】

yum remove openssl -y
yum groupinstall "Development Tools" -y
yum install wget perl-core zlib-devel -y
cd /usr/local/src
wget --no-check-certificate https://www.openssl.org/source/openssl-1.1.1t.tar.gz
tar -xzvf openssl-1.1.1t.tar.gz
cd openssl-1.1.1t
./config --prefix=/usr/local/ssl --openssldir=/usr/local/ssl shared zlib
make
make install
echo /usr/local/ssl/lib > /etc/ld.so.conf.d/openssl-1.1.1t.conf
ldconfig -v
vi /etc/profile.d/openssl.sh

OPENSSL_PATH=/usr/local/ssl/bin
export OPENSSL_PATH
PATH=$PATH:$OPENSSL_PATH
export PATH

chmod +x /etc/profile.d/openssl.sh
source /etc/profile.d/openssl.sh
echo $PATH
which openssl
openssl version
cd ..

 

【OpenSSH】

cd /usr/local/src
wget https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-9.2p1.tar.gz
tar -xzvf openssh-9.2p1.tar.gz
systemctl stop sshd
cp -r /etc/ssh /etc/ssh.backup
yum remove openssh -y
rm -f /etc/ssh/ssh_host_*
cd openssh-9.2p1
./configure --prefix=/usr/local/openssh --with-ssl-dir=/usr/local/ssl --with-sysconfdir=/etc/ssh --with-md5-passwords
make
make install
cd ./contrib
cp sshd.pam.generic /etc/pam.d/sshd
cp redhat/sshd.init /etc/init.d/sshd

vi /etc/init.d/sshd

...
SSHD=/usr/local/openssh/sbin/sshd
...
/usr/local/openssh/bin/ssh-keygen -A
...

chkconfig --add sshd
ln -s /usr/local/openssh/bin/* /usr/bin/
ln -s /usr/local/openssh/sbin/* /usr/sbin/
vi /usr/local/openssh/etc/sshd_config

PermitRootLogin yes

 

【확인】

service sshd start
ssh -V

 

***텔넷으로 할 경우 사전 작업은,

yum install telnet-server -y
mv /etc/securetty /etc/securetty.bak
systemctl start telnet.socket
firewall-cmd --permanent --zone=public --add-port=23/tcp
firewall-cmd --reload
이며 끝나고 마무리는 SSH로 로그인해서,
mv /etc/securetty.bak /etc/securetty
firewall-cmd --permanent --zone=public --remove-port=23/tcp
firewall-cmd --reload
systemctl stop telnet.socket
yum remove telnet-server -y