升级openssh解压出来直接执行就行

#!/bin/bash set -e CONFIG_FILE="/etc/ssh/sshd_config" # 备份原文件 cp -p "$CONFIG_FILE" "${CONFIG_FILE}.bak.$(date +%F_%T)" # 批量注释指定行（无论是否已有注释都注释） sed -i -r ' s/^[[:space:]]*(GSSAPIAuthentication[[:space:]]+yes)/# \1/i s/^[[:space:]]*(GSSAPICleanupCredentials[[:space:]]+no)/# \1/i s/^[[:space:]]*(UsePAM[[:space:]]+yes)/# \1/i ' "$CONFIG_FILE" # 设置版本 OPENSSL_VER="3.5.1" OPENSSH_VER="10.0p2" OPENSSL_TAR="openssl-${OPENSSL_VER}.tar.gz" OPENSSH_TAR="openssh-${OPENSSH_VER}.tar.gz" TARGET_DIR="/usr/local/src" # 目标目录（编译目录） OPENSSL_INSTALL_DIR="/usr/local/openssl" # OpenSSL安装目录 # 切换yum源为阿里云 cd /etc/yum.repos.d/ # 仅在bak文件夹不存在时创建 if [ ! -d "bak" ]; then mkdir bak fi # 仅在aliyun.repo不存在时执行替换操作 if [ ! -f aliyun.repo ]; then mv *.repo /etc/yum.repos.d/bak 2>/dev/null || true wget -O /etc/yum.repos.d/aliyun.repo http://mirrors.aliyun.com/repo/Centos-7.repo yum clean all && yum makecache fi # 安装依赖 yum install -y gcc make zlib-devel pam-devel wget tar \ perl-core autoconf automake libtool \ libedit-devel openssl-devel # 定义文件检查和复制/下载函数 get_tar_file() { local tar_name=$1 local source_url=$2 local target_dir=$3 # 1. 检查当前目录是否有目标tar包 if [ -f "./${tar_name}" ]; then echo "当前目录存在${tar_name}，复制到${target_dir}..." cp "./${tar_name}" "${target_dir}/" return 0 fi # 2. 检查目标目录是否已有tar包（避免重复操作） if [ -f "${target_dir}/${tar_name}" ]; then echo "${target_dir}已存在${tar_name}，跳过处理..." return 0 fi # 3. 上述情况都不满足，从网络下载 echo "开始下载${tar_name}..." cd "${target_dir}" || exit 1 # 尝试直接下载 if wget --timeout=10 --tries=2 "${source_url}"; then return 0 fi # 下载失败时尝试代理 echo "直接下载失败，尝试代理下载..." local proxy_url="https://ghproxy.com/${source_url}" if wget --timeout=10 --tries=2 "${proxy_url}"; then return 0 fi echo "错误：无法获取${tar_name}" return 1 } # 处理OpenSSL tar包 openssl_url="https://github.com/openssl/openssl/releases/download/openssl-${OPENSSL_VER}/${OPENSSL_TAR}" get_tar_file "${OPENSSL_TAR}" "${openssl_url}" "${TARGET_DIR}" # 编译OpenSSL cd "${TARGET_DIR}" || exit 1 if [ ! -d "openssl-${OPENSSL_VER}" ]; then tar -xzf "${OPENSSL_TAR}" fi cd "openssl-${OPENSSL_VER}" || exit 1 # 清理之前可能的错误安装 if [ -d "${OPENSSL_INSTALL_DIR}" ]; then echo "清理之前的OpenSSL安装..." rm -rf "${OPENSSL_INSTALL_DIR}" fi ./config --prefix="${OPENSSL_INSTALL_DIR}" shared zlib make -j$(nproc) make install # 确保关键目录存在并正确 echo "验证OpenSSL安装目录结构..." # 检查并创建lib目录（解决核心错误） if [ ! -d "${OPENSSL_INSTALL_DIR}/lib" ]; then echo "创建${OPENSSL_INSTALL_DIR}/lib目录..." mkdir -p "${OPENSSL_INSTALL_DIR}/lib" chmod 755 "${OPENSSL_INSTALL_DIR}/lib" fi # 检查并创建include目录 if [ ! -d "${OPENSSL_INSTALL_DIR}/include" ]; then echo "创建${OPENSSL_INSTALL_DIR}/include目录..." mkdir -p "${OPENSSL_INSTALL_DIR}/include" chmod 755 "${OPENSSL_INSTALL_DIR}/include" fi # 设置环境变量 export PATH="${OPENSSL_INSTALL_DIR}/bin:$PATH" export CPPFLAGS="-I${OPENSSL_INSTALL_DIR}/include" export LDFLAGS="-L${OPENSSL_INSTALL_DIR}/lib" export LD_LIBRARY_PATH="${OPENSSL_INSTALL_DIR}/lib:$LD_LIBRARY_PATH" echo "${OPENSSL_INSTALL_DIR}/lib" > /etc/ld.so.conf.d/openssl.conf ldconfig # 验证OpenSSL二进制文件 echo "验证OpenSSL安装..." ldd "${OPENSSL_INSTALL_DIR}/bin/openssl" # 添加库路径 echo "${OPENSSL_INSTALL_DIR}/lib" >> /etc/ld.so.conf echo "${OPENSSL_INSTALL_DIR}/lib64" >> /etc/ld.so.conf echo "${OPENSSL_INSTALL_DIR}-${OPENSSL_VER}" >> /etc/ld.so.conf ldconfig -v ldd "${OPENSSL_INSTALL_DIR}/bin/openssl" # 替换系统openssl if [ -f "/usr/bin/openssl" ]; then mv /usr/bin/openssl /usr/bin/openssl.old fi ln -sf "${OPENSSL_INSTALL_DIR}/bin/openssl" /usr/bin/openssl # 手动复制so.3动态库（增加安全检查） echo "复制OpenSSL动态库..." SSL_SO3_PATH="${TARGET_DIR}/openssl-${OPENSSL_VER}/libssl.so.3" CRYPTO_SO3_PATH="${TARGET_DIR}/openssl-${OPENSSL_VER}/libcrypto.so.3" # 检查源文件是否存在 if [ ! -f "${SSL_SO3_PATH}" ]; then echo "错误：未找到${SSL_SO3_PATH}，请检查OpenSSL编译是否成功" exit 1 fi if [ ! -f "${CRYPTO_SO3_PATH}" ]; then echo "错误：未找到${CRYPTO_SO3_PATH}，请检查OpenSSL编译是否成功" exit 1 fi # 确保目标目录是目录 if [ ! -d "${OPENSSL_INSTALL_DIR}/lib" ]; then echo "错误：${OPENSSL_INSTALL_DIR}/lib不是目录，无法继续" exit 1 fi # 复制文件 cp "${SSL_SO3_PATH}" "${OPENSSL_INSTALL_DIR}/lib/" cp "${CRYPTO_SO3_PATH}" "${OPENSSL_INSTALL_DIR}/lib/" # 重新建立链接 强制覆盖原来的软链接 cd "${OPENSSL_INSTALL_DIR}/lib" || exit 1 ln -sf libssl.so.3 libssl.so ln -sf libcrypto.so.3 libcrypto.so # 验证链接 echo "验证OpenSSL库链接..." readlink -f "${OPENSSL_INSTALL_DIR}/lib/libssl.so" readlink -f "${OPENSSL_INSTALL_DIR}/lib/libcrypto.so" ldconfig which openssl ldd $(which openssl) | grep ssl # 处理OpenSSH tar包 openssh_url="https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/${OPENSSH_TAR}" get_tar_file "${OPENSSH_TAR}" "${openssh_url}" "${TARGET_DIR}" # 编译OpenSSH cd "${TARGET_DIR}" || exit 1 # 注意：10.0p2解包后目录名为10.0p1 if [ ! -d "openssh-10.0p1" ]; then tar -xzf "${OPENSSH_TAR}" fi cd "openssh-10.0p1" || exit 1 ./configure --prefix=/usr/local/openssh \ --sysconfdir=/etc/ssh \ --with-pam \ --with-zlib \ --with-ssl-dir="${OPENSSL_INSTALL_DIR}" \ --without-openssl-header-check make -j$(nproc) make install # 替换系统ssh/sshd可执行文件 mv /usr/bin/ssh /usr/bin/ssh.bak 2>/dev/null || true mv /usr/sbin/sshd /usr/sbin/sshd.bak 2>/dev/null || true ln -sf /usr/local/openssh/bin/ssh /usr/bin/ssh ln -sf /usr/local/openssh/sbin/sshd /usr/sbin/sshd # 创建systemd服务文件 cat > /etc/systemd/system/sshd.service <<EOF [Unit] Description=OpenSSH ${OPENSSH_VER} server daemon After=network.target auditd.service ConditionPathExists=/etc/ssh/sshd_config [Service] ExecStart=/usr/local/openssh/sbin/sshd -D ExecReload=/bin/kill -HUP \$MAINPID KillMode=process Restart=on-failure RestartSec=3s [Install] WantedBy=multi-user.target EOF # 修改配置 grep -q "^X11Forwarding" /etc/ssh/sshd_config || echo 'X11Forwarding yes' >> /etc/ssh/sshd_config grep -q "^PasswordAuthentication" /etc/ssh/sshd_config || echo 'PasswordAuthentication yes' >> /etc/ssh/sshd_config grep -q "^PermitRootLogin" /etc/ssh/sshd_config || echo 'PermitRootLogin yes' >> /etc/ssh/sshd_config # 重启服务 systemctl disable sshd rm -f /etc/systemd/system/multi-user.target.wants/sshd.service systemctl daemon-reexec systemctl daemon-reload systemctl enable --now sshd systemctl restart sshd # 显示版本 /usr/local/openssh/sbin/sshd -v ssh -V sshd -V openssl version # 增强SSH密钥文件安全性 echo "设置SSH密钥文件权限和归属..." chmod 600 /etc/ssh/ssh_host_*_key chown root:root /etc/ssh/ssh_host_*_key echo "✅ OpenSSH ${OPENSSH_VER} 安装完成并启动成功，密钥权限已配置"