在麒麟操作系统或CentOS 7系列服务器升级OpenSSH 9.7版本以修复服务器漏洞【测试成功】

[root@host-192-168-66-18 ~]# cat etc/os-release 
NAME="Kylin Linux Advanced Server"
VERSION="V10 (Tercel)"
ID="kylin"
VERSION_ID="V10"
PRETTY_NAME="Kylin Linux Advanced Server V10 (Tercel)"
ANSI_COLOR="0;31"

[root@host-192-168-66-18 openssh9.7p1]# ls
openssh-9.7p1-1.el7.x86_64.rpm          openssh-debuginfo-9.7p1-1.el7.x86_64.rpm
openssh-clients-9.7p1-1.el7.x86_64.rpm  openssh-server-9.7p1-1.el7.x86_64.rpm

chmod 0600 etc/ssh/ssh_host_rsa_key
chmod 0600 etc/ssh/ssh_host_ecdsa_key
chmod 0600 etc/ssh/ssh_host_ed25519_key
chmod 0755 bin/ssh-copy-id
chmod u+x etc/init.d/sshd

#!/bin/bash


#install zlib start !!!!
lujing=$(pwd)
cd $lujing
tar -xf zlib-1.3.1.tar.gz
cd zlib-1.3.1
./configure --prefix=/usr/local/zlib.1.3.1
make && make test && make install
ll /usr/local/zlib.1.3.1/
ldconfig -V
sleep 2
/sbin/ldconfig
sleep 2


#install openssl start !!!
cd $lujing
tar zxf openssl-3.2.0.tar.gz
cd openssl-3.2.0
./config --prefix=/usr/local/openssl-3.2.0 --openssldir=/usr/shared
make clean && make -j 4 && make install
#更新函数库
echo "/usr/local/openssl-3.2.0/lib" >> /etc/ld.so.conf
ldconfig
sleep 3
bak_data=$(date +"%Y%m%d")
mv /usr/bin/openssl /usr/bin/openssl_${bak_data}.bak
ln -s /usr/local/openssl-3.2.0/bin/openssl /usr/bin/openssl
ln -s /usr/local/openssl-3.2.0/lib64/libssl.so.3 /usr/lib64/libssl.so.3
ln -s /usr/local/openssl-3.2.0/lib64/libcrypto.so.3 /usr/lib64/libcrypto.so.3
openssl version -a 
sleep 3


#install opensssh start !!
mkdir ~/ssh_openssh_${bak_data}_bak
cp /etc/ssh/sshd_config ~/ssh_openssh_${bak_data}_bak
cp /etc/pam.d/sshd ~/ssh_openssh_${bak_data}_bak
rpm -e --nodeps `rpm -qa | grep openssh`
# 安装OpenSSH
cd $lujing
tar -xf openssh-9.7p1.tar.gz
cd openssh-9.7p1
./configure --prefix=/usr/local/ssh --sysconfdir=/etc/ssh --with-ssl-dir=/usr/local/openssl-3.2.0 --with-zlib=/usr/local/zlib.1.3.1
chmod 0600 /etc/ssh/ssh_host_rsa_key
chmod 0600 /etc/ssh/ssh_host_ecdsa_key
chmod 0600 /etc/ssh/ssh_host_ed25519_key
make -j 4 && make install
/usr/local/ssh/bin/ssh -V
# 复制新ssh文件
cp -rf contrib/redhat/sshd.init /etc/init.d/sshd
cp -rf contrib/redhat/sshd.pam /etc/pam.d/sshd.pam
cp -rf sshd_config /etc/ssh/sshd_config
cp -rf /usr/local/ssh/sbin/sshd /usr/sbin/sshd
cp -rf /usr/local/ssh/bin/* /usr/bin/


# 开启sshd
cp -rf /usr/local/ssh/sbin/sshd /usr/sbin/sshd
cp -rf /usr/local/ssh/bin/ssh /usr/bin/ssh
cp -rf /usr/local/ssh/bin/ssh-keygen /usr/bin/ssh-keygen
cp {$bak_data}/openssh-9.6p1/contrib/ssh-copy-id /bin/
chmod 0755 /bin/ssh-copy-id
chmod u+x /etc/init.d/sshd 
chkconfig --add sshd
chkconfig --list | grep sshd
systemctl daemon-reload
chkconfig sshd on
# 允许root登录
echo "PermitRootLogin yes" >> /etc/ssh/sshd_config
sed -i "/Subsystem/s/^/# /" "/etc/ssh/sshd_config"
echo "Subsystem sftp /usr/local/ssh/libexec/sftp-server" >> /etc/ssh/sshd_config
# 添加加密算法
echo "KexAlgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1" >> /etc/ssh/sshd_config
echo "HostKeyAlgorithms +ssh-rsa" >> /etc/ssh/sshd_config
# 重启sshd服务
/etc/init.d/sshd restart
/etc/init.d/sshd status
# 查看升级后ssh版本
ssh -V

[root@KyLinux openssh]# ll
总用量 20584
-rw-r--r--  1 root root   1848766  5月 16 16:47 openssh-9.7p1.tar.gz
-rw-r--r--  1 root root  17698352  5月 16 16:47 openssl-3.2.0.tar.gz
-rwxrwxrwx  1 root root      2646  5月 16 16:49 update_ssh.sh
-rw-r--r--  1 root root   1512791  5月 16 16:47 zlib-1.3.1.tar.gz

[root@KyLinux openssh]# ./update_ssh.sh 
-bash: ./update_ssh.sh：/bin/bash^M：解释器错误: 没有那个文件或目录