脚本之家 服务器常用软件
快捷导航
您的位置：首页 → 网站技巧 → 服务器 → Linux → linux环境openssl、openssh升级

linux环境openssl、openssh升级流程

 更新时间：2025年03月04日 15:51:19   作者：MRR、皮皮虾  
该文章详细介绍了在Ubuntu 22.04系统上升级OpenSSL和OpenSSH的方法,首先,升级OpenSSL的步骤包括下载最新版本、安装编译环境、备份和安装、验证等,然后,升级OpenSSH的步骤包括下载最新版本、安装相关依赖、解压和编译安装、查看版本、备份替换文件、重启服务等

linux常因openssl、openssh漏洞进行升级。

本文以ubuntu22.04为例，对openssl、openssh进行升级。

一.升级openssl

1.官网下载最新版openssl

wget https://www.openssl.org/source/openssl-3.0.15.tar.gz

如果因网络原因下载不动，可以直接访问官网，下载最新版本：

https://www.openssl.org/source/

root@localhost:~# wget https://www.openssl.org/source/openssl-3.0.15.tar.gz
--2024-07-19 07:31:28--  https://www.openssl.org/source/openssl-3.0.15.tar.gz
Resolving www.openssl.org (www.openssl.org)... 34.36.58.177, 2600:1901:0:1812::
Connecting to www.openssl.org (www.openssl.org)|34.36.58.177|:443... connected.
HTTP request sent, awaiting response... 301 Moved Permanently
Location: https://github.com:443/openssl/openssl/releases/download/openssl-3.0.15/openssl-3.0.15.tar.gz [following]
--2024-07-19 07:31:29--  https://objects.githubusercontent.com/github-production-release-asset-2e65be/7634677/6ac36897-7f0a-4dc5-8d1c-3d8b0eab4f5d?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20240719%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20240719T073129Z&X-Amz-Expires=300&X-Amz-Signature=658f52e12bd883cbda4f7abcbac2508a5642bccc70baf8d159b4e39a31623702&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=7634677&response-content-disposition=attachment%3B%20filename%3Dopenssl-3.0.15.tar.gz&response-content-type=application%2Foctet-stream
Resolving objects.githubusercontent.com (objects.githubusercontent.com)... 185.199.111.133, 185.199.108.133, 185.199.109.133
Connecting to objects.githubusercontent.com (objects.githubusercontent.com)|185.199.111.133|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 15305497 (15M) [application/octet-stream]
Saving to: ‘openssl-3.0.15.tar.gz'

openssl-3.0.15.tar.gz                  100%[===========================================================================>]  14.60M  81.0KB/s    in 4m 17s  

2024-07-19 07:35:48 (58.1 KB/s) - ‘openssl-3.0.15.tar.gz' saved [15305497/15305497]

2.安装编译环境

apt-get install -y build-essential
root@localhost:/opt/openssl-3.0.15# apt-get install -y build-essential
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following additional packages will be installed:
  bzip2 cpp cpp-11 dpkg-dev fakeroot fontconfig-config fonts-dejavu-core g++ g++-11 gcc gcc-11 gcc-11-base libalgorithm-diff-perl
  libalgorithm-diff-xs-perl libalgorithm-merge-perl libasan6 libatomic1 libc-dev-bin libc-devtools libc6-dev libcc1-0 libcrypt-dev libdeflate0
  libdpkg-perl libfakeroot libfile-fcntllock-perl libfontconfig1 libgcc-11-dev libgd3 libgomp1 libisl23 libitm1 libjbig0 libjpeg-turbo8 libjpeg8 liblsan0
  libmpc3 libnsl-dev libquadmath0 libstdc++-11-dev libtiff5 libtirpc-dev libtsan0 libubsan1 libwebp7 libxpm4 linux-libc-dev lto-disabled-list make
  manpages-dev rpcsvc-proto
Suggested packages:
  bzip2-doc cpp-doc gcc-11-locales debian-keyring g++-multilib g++-11-multilib gcc-11-doc gcc-multilib autoconf automake libtool flex bison gdb gcc-doc
  gcc-11-multilib glibc-doc bzr libgd-tools libstdc++-11-doc make-doc

如果系统为CentOS，则执行

yum install perl-IPC-Cmd perl-Data-Dumper gcc gcc-c++ perl perl-devel -y

3.下载后解压安装

tar -xf openssl-3.0.15.tar.gz -C /opt/

进入目录

cd /opt/openssl-3.0.15

编译配置openssl安装目录

./config --prefix=/usr/local/openssl
root@localhost:~# tar -xf openssl-3.0.15.tar.gz -C /opt/
root@localhost:~# cd /opt/openssl-3.0.15/
root@localhost:/opt/openssl-3.0.15# ./config --prefix=/usr/local/openssl
Configuring OpenSSL version 3.0.15 for target linux-x86_64
Using os-specific seed configuration
Created configdata.pm
Running configdata.pm
Created Makefile.in
Created Makefile
Created include/openssl/configuration.h

**********************************************************************
***                                                                ***
***   OpenSSL has been successfully configured                     ***
***                                                                ***
***   If you encounter a problem while building, please open an    ***
***   issue on GitHub <https://github.com/openssl/openssl/issues>  ***
***   and include the output from the following command:           ***
***                                                                ***
***       perl configdata.pm --dump                                ***
***                                                                ***
***   (If you are new to OpenSSL, you might want to consult the    ***
***   'Troubleshooting' section in the INSTALL.md file first)      ***
***                                                                ***
**********************************************************************

安装

make && make install
root@localhost:/opt/openssl-3.0.15# make && make install
/usr/bin/perl "-I." -Mconfigdata "util/dofile.pl" "-oMakefile" include/crypto/bn_conf.h.in > include/crypto/bn_conf.h
/usr/bin/perl "-I." -Mconfigdata "util/dofile.pl" "-oMakefile" include/crypto/dso_conf.h.in > include/crypto/dso_conf.h
/usr/bin/perl "-I." -Mconfigdata "util/dofile.pl" "-oMakefile" include/openssl/asn1.h.in > include/openssl/asn1.h
/usr/bin/perl "-I." -Mconfigdata "util/dofile.pl" "-oMakefile" include/openssl/asn1t.h.in > include/openssl/asn1t.h
/usr/bin/perl "-I." -Mconfigdata "util/dofile.pl" "-oMakefile" include/openssl/bio.h.in > include/openssl/bio.h
/usr/bin/perl "-I." -Mconfigdata "util/dofile.pl" "-oMakefile" include/openssl/cmp.h.in > include/openssl/cmp.h

4.备份更新openssl

备份openssl

mv /usr/bin/openssl /usr/bin/openssl_bak

复制openssl文件到/usr/bin/下

cp /usr/local/openssl/bin/openssl /usr/bin/

添加动态链接库数据

echo ‘/usr/local/openssl/lib64/' >> /etc/ld.so.conf

更新动态链接库

ldconfig
root@localhost:/opt/openssl-3.0.15# mv /usr/bin/openssl /usr/bin/openssl_bak
root@localhost:/opt/openssl-3.0.15# cp /usr/local/openssl/bin/openssl  /usr/bin/
root@localhost:/opt/openssl-3.0.15# echo "/usr/local/openssl/lib64/" >> /etc/ld.so.conf
root@localhost:/opt/openssl-3.0.15# ldconfig

5.进行验证

openssl version
root@localhost:/usr/local/openssl/lib64# openssl version
OpenSSL 3.0.15 3 Sep 2024 (Library: OpenSSL 3.0.15 3 Sep 2024)

若出现如下问题

root@localhost:/opt/openssl-3.0.15# openssl version
openssl: /lib/x86_64-linux-gnu/libcrypto.so.3: version `OPENSSL_3.0.9' not found (required by openssl)

备份libcrypto.so.3文件后，复制安装目录下lib64/libcrypto.so.3到/lib/x86_64-linux-gnu/目录

root@localhost:/opt/openssl-3.0.15# cd /usr/local/openssl/lib64/
root@localhost:/usr/local/openssl/lib64# ll
total 16636
drwxr-xr-x 5 root root    4096 Jul 19 07:49 ./
drwxr-xr-x 7 root root    4096 Jul 19 07:50 ../
drwxr-xr-x 2 root root    4096 Jul 19 07:49 engines-3/
-rw-r--r-- 1 root root 9541222 Jul 19 07:49 libcrypto.a
lrwxrwxrwx 1 root root      14 Jul 19 07:49 libcrypto.so -> libcrypto.so.3*
-rwxr-xr-x 1 root root 5383824 Jul 19 07:49 libcrypto.so.3*
-rw-r--r-- 1 root root 1268762 Jul 19 07:49 libssl.a
lrwxrwxrwx 1 root root      11 Jul 19 07:49 libssl.so -> libssl.so.3*
-rwxr-xr-x 1 root root  813928 Jul 19 07:49 libssl.so.3*
drwxr-xr-x 2 root root    4096 Jul 19 07:49 ossl-modules/
drwxr-xr-x 2 root root    4096 Jul 19 07:49 pkgconfig/

root@localhost:/usr/local/openssl/lib64# mv /lib/x86_64-linux-gnu/libcrypto.so.3 /root/
root@localhost:/usr/local/openssl/lib64# cp libcrypto.so.3 /lib/x86_64-linux-gnu/
root@localhost:/usr/local/openssl/lib64# openssl version
OpenSSL 3.0.15 3 Sep 2024 (Library: OpenSSL 3.0.15 3 Sep 2024)

二、升级openssh

1.下载最新版openssh

wget
https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-9.9p1.tar.gz

如因网络原因下载不动，可以直接访问 ，下载最新版本https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable

2.安装相关依赖

apt-get install -y zlib1g-dev libpam0g-dev
root@localhost:~#  apt-get install -y  zlib1g-dev libpam0g-dev
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following NEW packages will be installed:
  libpam0g-dev zlib1g-dev
0 upgraded, 2 newly installed, 0 to remove and 67 not upgraded.
Need to get 281 kB of archives.
After this operation, 1,010 kB of additional disk space will be used.
Get:1 http://archive.ubuntu.com/ubuntu jammy-updates/main amd64 libpam0g-dev amd64 1.4.0-11ubuntu2.4 [117 kB]
Get:2 http://archive.ubuntu.com/ubuntu jammy-updates/main amd64 zlib1g-dev amd64 1:1.2.11.dfsg-2ubuntu9.2 [164 kB]
Fetched 281 kB in 2s (142 kB/s)

系统为CentOS，则执行

yum install zlib-devel pam-devel -y

3.解压安装

tar xf openssh-9.9p1.tar.gz -C /opt/
cd /opt/openssh-9.9p1

配置安装目录

./configure --prefix=/usr/local/openssh
–with-ssl-dir=/usr/local/openssl --sysconfdir=/etc/ssh --with-pam --with-gssapi --with-rsa --with-rhosts-allowed --with-zlib --with-md5-passwords

编译安装

make && make install

4.查看目录版本

/usr/local/openssh/bin/ssh -V
root@localhost:/usr/local/openssh# ./bin/ssh -V
OpenSSH_9.9p1, OpenSSL 3.0.15 3 Sep 2024

5.备份替换相关文件

mv /usr/sbin/sshd /usr/sbin/sshd_bak
mv /usr/bin/ssh /usr/bin/ssh_bak
mv /usr/bin/ssh-keygen /usr/bin/ssh-keygen_bak
cp -rf /usr/local/openssh/sbin/sshd /usr/sbin/sshd
cp -rf /usr/local/openssh/bin/ssh /usr/bin/ssh
cp -rf /usr/local/openssh/bin/ssh-keygen /usr/bin/ssh-keygen

6.重启ssh服务

systemctl restart sshd
root@localhost:/usr/local/openssh# systemctl restart sshd.service 
root@localhost:/usr/local/openssh# ssh -V
OpenSSH_9.9p1, OpenSSL 3.0.15 3 Sep 2024

执行ssh服务状态查询命令

systemctl status sshd.service

查看发现文件的权限设置过于宽松

Permissions 0640 for'/etc/ssh/*****.key' are too open.

执行chmod -R 600 /etc/ssh限制权限后重启ssh服务

systemctl restart sshd

总结

以上为个人经验，希望能给大家一个参考，也希望大家多多支持脚本之家。

您可能感兴趣的文章:

相关文章

  • Linux下如何实现创建/删除软连接

    Linux下如何实现创建/删除软连接

    这篇文章主要介绍了Linux下如何实现创建/删除软连接方式，具有很好的参考价值，希望对大家有所帮助。如有错误或未考虑完全的地方，望不吝赐教
    2023-07-07
  • linux下vsftpd的安装及配置使用详细步骤(推荐)

    linux下vsftpd的安装及配置使用详细步骤(推荐)

    这篇文章主要介绍了linux下vsftpd的安装及配置使用详细步骤 ,需要的朋友可以参考下
    2018-01-01
  • /etc/security/limits.conf详解与配置过程

    /etc/security/limits.conf详解与配置过程

    在Linux系统中,通过/etc/security/limits.conf文件和/etc/security/limits.d/目录下的配置文件,可以设置用户或用户组的资源限制,配置文件中的soft和hard限制分别代表警告级别和硬性限制,它们需要匹配才能生效
    2024-10-10
  • 详解centos7上elastic search安装及填坑记

    详解centos7上elastic search安装及填坑记

    本篇文章主要介绍了centos7上elastic search安装及填坑记，小编觉得挺不错的，现在分享给大家，也给大家做个参考。一起跟随小编过来看看吧
    2018-01-01
  • linux中的编译驱动到内核方式

    linux中的编译驱动到内核方式

    这篇文章主要介绍了linux中的编译驱动到内核方式,具有很好的参考价值,希望对大家有所帮助,如有错误或未考虑完全的地方,望不吝赐教
    2025-09-09
  • Linux正确删除软链接方式

    Linux正确删除软链接方式

    在Linux上删除软链接时,只删除软链接而不要删除源文件,最推荐的做法是使用`rm`命令,其次的做法是使用`unlink`命令,不建议使用`rm-rf`命令,因为它会误删源文件
    2026-01-01
  • Linux之信号的保存方式

    Linux之信号的保存方式

    这篇文章主要介绍了Linux之信号的保存方式,具有很好的参考价值,希望对大家有所帮助,如有错误或未考虑完全的地方,望不吝赐教
    2024-02-02
  • CentOS7环境中DHCP配置教程

    CentOS7环境中DHCP配置教程

    大家好，本篇文章主要讲的是CentOS7环境中DHCP配置教程，感兴趣的同学赶快来看一看吧，对你有帮助的话记得收藏一下，方便下次浏览
    2021-11-11
  • 关于linux下core dump【总结】

    关于linux下core dump【总结】

    下面小编就为大家带来一篇关于linux下core dump【总结】。小编觉得挺不错的，现在就分享给大家，也给大家做个参考。一起跟随小编过来看看吧
    2017-01-01
  • Linux实现安装和配置lxqt桌面

    Linux实现安装和配置lxqt桌面

    LXQt是轻量级Linux桌面环境,适合低配置电脑,安装简单,选择会话即可启用,通过配置中心可自定义默认程序、壁纸、电源管理及分辨率,并支持任务栏组件调整
    2025-09-09

最新评论