Centos7.9修复openssh漏洞，使用rpm包升级openssh 9.7p

1.查看当前的系统版本和openssh，openssl版本

2.安装telnet

rpm -ivh xinetd-2.3.15-14.el7.x86_64.rpm
rpm -ivh telnet-0.17-66.el7.x86_64.rpm
rpm -ivh telnet-server-0.17-66.el7.x86_64.rpm
systemctl start telnet.socket && systemctl enable telnet.socket
sed -i 's/^auth[[:space:]]\+required[[:space:]]\+pam_securetty.so/#&/' /etc/pam.d/remote

3.在其他节点测试 telnet 连接

4.备份ssh历史配置以防万一

whereis ssh sshd openssl
cp -rf /etc/ssh /etc/ssh.bak
cp -rf /usr/bin/ssh /usr/bin/ssh.bak
cp -rf /usr/sbin/sshd /usr/sbin/sshd.bak
cp -rf /usr/bin/openssl /usr/bin/openssl.bak
cp -rf /usr/lib64/openssl /usr/lib64/openssl.bak

5.卸载openssl和openssh

yum remove openssl
手动输入 y 确认是否关键依赖组件会被卸载掉，开始没注意以前安装的ansible被卸载了
yum remove openssh
手动输入 y

6.安装openssl和openssh

rpm -ivh  openssl-1.1.1w-1.el7.x86_64.rpm --nodeps
rpm -ivh openssh-9.7p1-1.el7.centos.x86_64.rpm
rpm -ivh openssh-clients-9.7p1-1.el7.centos.x86_64.rpm
rpm -ivh openssh-server-9.7p1-1.el7.centos.x86_64.rpm
rpm -ivh openssh-debuginfo-9.7p1-1.el7.centos.x86_64.rpm

直接启动会报错，所以重新授权了，估计是7.4 和 9.7的权限管理差别
chmod 600 /etc/ssh/ssh_host_ed25519_key
systemctl restart sshd

7.检查ssh状态和开机启动

systemctl status sshd &&  systemctl is-enabled sshd

链接：https://pan.baidu.com/s/1GZyoJgiBNVFN_j3kJIbofQ
提取码：43qr