Linux-SSH升级及回退方案

1、LINUX-SSHh级及回退方案1 .验证对比与记录的当前ssh及ssl版本是否一致ssh-V2 .验证对比与记录的当前系统版本是否一致cat/etc/redhat-release一、配置yum源方法一：服务器中插入对应版本系统镜像光盘。cd/etc/yum.repos.d/转移原始配置文件lsmkdirbakmv*.repobak重新生成配置文件viyum.repolocal_rhel6name=local_rhel6baseurl=file:/mnt/enabled=1gpgcheck=0挂载光盘镜像mount/dev/sr0/mnt清除yum缓存yumcleanall方法二：在系统中传入

2、yum软件包创建yum目录cd/homemkdiryum向yum文件夹中考入yum软件包cd/etc/yum.repos.d/转移原始配置文件lsmkdirbakmv*.repobak重新生成配置文件viyum.repolocal_rhel6name=local_rhel6baseurl=file:/home/yumenabled=1gpgcheck=0挂载光盘镜像mount/dev/sr0/mnt清除yum缓存yumcleanall二、安装Telnet查看telnet安装情况rpm-qa|greptelnet安装telnetyuminstalltelnet*将disable的yes修改为no

3、vi/etc/xinetd.d/telnetservicetelnetflags=REUSEsocket_type=streamwait=nouser=rootserver=/usr/sbin/in.telnetdlog_on_failure+=USERIDdisable=no重启服务servicexinetdrestart查询防火墙状态/etc/init.d/iptablesstatus临时关闭防火墙/etc/init.d/iptablesstop创建telnet登录用户useraddteltestpasswdteltest测试telnet登录三、安装相关软件查询软件安装状态rpm-qa|g

4、repgccrpm-qa|grepzlib-develrpm-qa|grepopenssl-develrpm-qa|greppam-devel安装软件yum-yinstallgccyum-yinstallzlib-develyum-yinstallopenssl-develyum-yinstallpam-devel四、编译安装opensshcd/homemkdirsshtest传入openssh7.4文件解压并进入软件目录tar-xvfopenssh-7.4p1.tar.gzcdopenssh-7.4p1备份公钥cp-ar/etc/ssh/etc/ssh_bak编译安装./configure-

5、prefix=/usr-sysconfdir=/etc/ssh-with-pam-without-zlib-version-check-with-openssl-includes=/usr/-with-md5-passwords-mandir=/usr/share/manmakemakeinstall修改/etc/ssh/sshd_config文件sed-is/GSSAPIAuthentication/#GSSAPIAuthentication/g/etc/ssh/sshd_configsed-is/GSSAPIAuthentication/#GSSAPIAuthentication/g/et

6、c/ssh/ssh_configsed-is/GSSAPICleanupCredentials/#GSSAPICleanupCredentials/g/etc/ssh/sshd_config允许root登录vi/etc/ssh/sshd_config#PermitRootLoginyes将ssh设置为开机启动chkconfigsshdonRedhat7版本命令行有变化systemctlenablesshd.service重启服务servicesshdrestart验证版本及登录ssh-V关闭TELNE橙录将disable的no修改为yesvi/etc/xinetd.d/telnetservic

7、etelnetflags=REUSEsocket_type=streamwait=nouser=rootserver=/usr/sbin/in.telnetdlog_on_failure+=USERIDdisable=yes重启服务servicexinetdrestart五、回退方案卸载旧版sshyum-yremoveopenssh重装旧版sshyum-yinstallopensshopenssh-clientsopenssh-server将ssh设置为开机启动chkconfigsshdon重启服务servicesshdrestart验证版本及登录ssh-V六、禁用R系列服务检查rsh、rexec、rlogin服务是否关闭监听端口rexec512端口rlogin513端口netstat-an|grep512netstat-an|grep513netstat-an|grep514chkconfig-list基于x