細述CentOS使用OpenSSL編譯安裝OpenSSH

檢測已安裝的包

# rpm -qa | grep openssh openssh
# rpm -qa | grep openssh openssl

卸載用rpm -e 如果出現依賴包導致無法卸載，在最後面加上--nodeps即可,例：

# rpm -e openssl --nodeps

具體安裝過程如下：

下載最新軟件包源碼

http://ftp5.usa.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-7.3p1.tar.gz
http://www.openssl.org/source/openssl-1.0.2j.tar.gz
http://www.openssl.org/source/openssl-fips-2.0.13.tar.gz

使用YUM安裝必要的軟件開發包

# yum install -y zlib-devel pam-devel tcp_wrappers-devel

安裝openssl-fips

具體說明見 http://www.openssl.org/docs/fips ;

# tar zxpf openssl-fips-2.0.5.tar.gz
# cd openssl-fips
# ./config
# make && make install

安裝OpenSSL

# tar zxpf openssl-1.0.1h.tar.gz 

# cd openssl-1.0.1h
# ./config fips --shared
# make && make install 

將新編譯的openssl library 加入系統動態庫鏈接中

# echo "/usr/local/ssl/lib" >> /etc/ld.so.conf
# ldconfig

安裝OpenSSH

# tar zxpf openssh-6.6p1.tar.gz
# cd openssh-6.6p1
# ./configure \
 --prefix=/usr \
 --sysconfdir=/etc/ssh \
 --with-md5-passwords \
 --with-pam \
 --with-tcp-wrappers \
 --with-ssl-dir=/usr/local/ssl
# make && make install
# ssh -V

修改相關配置

# cp -p contrib/redhat/sshd.init /etc/init.d/sshd (此處的contrib路徑為解壓後的OpenSSH包路徑)
# chmod u+x /etc/init.d/sshd （加執行權限）
# chkconfig --add sshd （增加sshd服務）
# chkconfig sshd on （把sshd加入啟動項）
# yum install openssh (安裝OpenSSH客戶端)
# vim /etc/ssh/sshd_config
PermitRootLogin yes #允許root賬戶登錄，單root賬戶必須加上，其他的參數請自行修改
 

測試登錄

# /etc/init.d/sshd start
ssh-keygen: illegal option -- A
Usage: ssh-keygen [options]
Options:
-a trials Number of trials for screening DH-GEX moduli.
-B Show bubblebabble digest of key file.
-b bits Number of bits in the key to create.
-C comment Provide new comment.
-c Change comment in private and public key files.
-e Convert OpenSSH to IETF SECSH key file.
-F hostname Find hostname in known hosts file.
-f filename Filename of the key file.
-G file Generate candidates for DH-GEX moduli.
-g Use generic DNS resource record format.
-H Hash names in known_hosts file.
-i Convert IETF SECSH to OpenSSH key file.
-l Show fingerprint of key file.
-M memory Amount of memory (MB) to use for generating DH-GEX moduli.
-N phrase Provide new passphrase.
-P phrase Provide old passphrase.
-p Change passphrase of private key file.
-q Quiet.
-R hostname Remove host from known_hosts file.
-r hostname Print DNS resource record.
-S start Start point (hex) for generating DH-GEX moduli.
-T file Screen candidates for DH-GEX moduli.
-t type Specify type of key to create.
-v Verbose.
-W gen Generator to use for generating DH-GEX moduli.
-y Read private key file and print public key.
Starting sshd: [ OK ]

sshd文件的ssh-keygen參數有問題，暫時不知道怎麼解決，但是不影響使用。

閱讀更多 IT生涯 的文章

關鍵字: OpenSSH 卸載 OpenBSD