centeros 6 远程升级ssl ssh 的shell脚本

变量说明

SSL_N=openssl-1.0.2p #ssl 版本
SSH_N=openssh-7.9p1 #ssh 版本
ZLIB_N=zlib-1.2.11 # zlib 版本

脚本分为两个，因为升级ssh ssh存在断开问题，需要临时启用telnet继续执行

yum配置采用了ftp yum源，具体配置见我的博客：

https://www.cnblogs.com/levi-w/p/9675157.html

执行步骤：

1 首先在服务器执行openssh-update.telnet.sh

2 telnet 登录服务器，执行openssh-update.sh

脚本详情：

1 openssh-update.telnet.sh

#!/bin/bash
#config yum
export SSL_N=openssl-1.0.2p
export SSH_N=openssh-7.9p1
export ZLIB_N=zlib-1.2.11

cp -r /etc/yum.repos.d /etc/yum.repos.d_bak
rm -rf /etc/yum.repos.d/*

echo "[CenterOS-source]
name=Linux "'$releasever'" - "'$basearch'" - Source
baseurl=ftp://10.1.1.1/pub/cos6
enabled=1
gpgcheck=0" > /etc/yum.repos.d/rhel-source.repo

yum makecache

yum -y install gcc* telnet* pam-devel openssl-devel

##config telnet#一定要测试！
yum -y install telnet*
# disable字段改为no
sed -i '12c disable = no' /etc/xinetd.d/telnet
service xinetd restart
mv /etc/securetty /etc/securetty.bak

read -p "test telnet[y/n]: " number
if [ $number != 'y' ]
then
echo "Error"
exit
fi
echo "please use telnet to countinue"

2 openssh-update.sh

#!/bin/bash
#config yum
export SSL_N=openssl-1.0.2p
export SSH_N=openssh-7.9p1
export ZLIB_N=zlib-1.2.11

##config zlib
cd /opt
tar zxvf /opt/$ZLIB_N.tar.gz

cd /opt/$ZLIB_N/
./configure --prefix=/usr/local/$ZLIB_N -share
cd /opt/$ZLIB_N/
make -j4
make -j4 test
read -p "test $ZLIB_N [y/n]: " number
if [ $number != 'y' ]
then
echo "Error"
exit
fi
make -j4 install

mv /usr/local/$ZLIB_N/lib/libz.a /usr/local/$ZLIB_N/lib/libz.a.bak`date +%y%m%d`
/bin/cp -r /opt/$ZLIB_N/libz.a /usr/local/$ZLIB_N/lib
chmod 644 /usr/local/$ZLIB_N/lib/libz.a
/bin/cp -r /opt/$ZLIB_N/ libz.so.1.2.11 /usr/local/$ZLIB_N/lib
chmod 755 /usr/local/$ZLIB_N/lib/libz.so.1.2.11
mv /usr/local/$ZLIB_N/share/man/man3/zlib.3 /usr/local/$ZLIB_N/share/man/man3/zlib.3.bak`date +%y%m%d`
/bin/cp -r /opt/$ZLIB_N/zlib.3 /usr/local/$ZLIB_N/share/man/man3
mv /usr/local/$ZLIB_N/lib/pkgconfig/zlib.pc /usr/local/$ZLIB_N/lib/pkgconfig/zlib.pc.bak`date +%y%m%d`
cp -r /opt/$ZLIB_N/zlib.pc /usr/local/$ZLIB_N/lib/pkgconfig
chmod 644 /usr/local/$ZLIB_N/lib/pkgconfig/zlib.pc
mv /usr/local/$ZLIB_N/include/zlib.h /usr/local/$ZLIB_N/include/zlib.h.bak`date +%y%m%d`
mv /usr/local/$ZLIB_N/include/zconf.h /usr/local/$ZLIB_N/include/zconf.h.bak`date +%y%m%d`
/bin/cp -r /opt/$ZLIB_N/zlib.h zconf.h /usr/local/$ZLIB_N/include
chmod 644 /usr/local/$ZLIB_N/include/zlib.h /usr/local/$ZLIB_N/include/zconf.h

echo "include ld.so.conf.d/*.conf
## add for update ssh
/usr/local/$ZLIB_N/lib
##add end">>/etc/ld.so.conf
ldconfig -v

ln -s /usr/local/$ZLIB_N /usr/local/zlib

##install openssl
cp -r /usr/lib64/openssl /usr/lib64/openssl_old
cp -r /usr/bin/openssl /usr/bin/openssl_old

cd /opt
tar zxvf /opt/$SSL_N.tar.gz
cd /opt/$SSL_N/
./config zlib-dynamic --prefix=/usr/local/$SSL_N --with-zlib-lib=/usr/local/$ZLIB_N/lib --with-zlib-include=/usr/local/$ZLIB_N/include --shared
make
make test
read -p "test $SSL_N [y/n]: " number
if [ $number != 'y' ]
then
echo "Error"
exit
fi
make install

echo "## add below line to ld.so.conf
/usr/local/$SSL_N/lib
###">>/etc/ld.so.conf
ldconfig -v

ln -s /usr/local/$SSL_N /usr/local/openssl

echo "##config for ssl
export PATH=/usr/local/openssl/bin:"'$PATH'"
###">>/etc/profile
source /etc/profile

openssl version -a

##install openssh

service sshd stop
cp -r /etc/ssh /etc/ssh_old`date +%F`
rpm -qa | grep openssh | xargs rpm -e
cd /opt
tar zxvf /opt/$SSH_N.tar.gz
cd /opt/$SSH_N
./configure --prefix=/usr --sysconfdir=/etc/ssh --with-pam --with-ssl-dir=/usr/local/$SSL_N --with-md5-passwords --mandir=/usr/share/man --with-zlib=/usr/local/zlib

make && make install

/bin/cp -r ./contrib/redhat/sshd.init /etc/init.d/sshd
chmod +x /etc/init.d/sshd
chkconfig --add sshd

service sshd restart
ssh -V

##PermitRootLogin prohibit-password
#PermitRootLogin yes
cp /etc/ssh/sshd_config /etc/ssh/sshd_config_old`date +%F`
sed -i '33i PermitRootLogin yes' /etc/ssh/sshd_config
service sshd restart

read -p "test SSH [y/n]: " number
if [ $number != 'y' ]
then
echo "Error"
exit
fi

## config telnet close
sed -i '12c disable = yes' /etc/xinetd.d/telnet

#/etc/xinetd.d/telnet
mv /etc/securetty.bak /etc/securetty
service xinetd restart
echo "test telnet"