Linux 服务器安全加固:OpenSSH/OpenSSL 源码升级避坑指南(含内网方案)

需要升级的服务器尽可能连通外网，因为涉及 zlib-devel、pam-devel、gcc、perl-core 等依赖包的安装。如果是纯内网环境，则需要提前在联网辅助机上下载好所有依赖包并上传到内网服务器后再进行操作。

yum install -y telnet-server telnet

systemctl start telnet.socket

systemctl stop telnet.socket

yum remove -y telnet-server 

telnet

ssh -V

OpenSSH_10.2p1, OpenSSL 3.6.0 1 Oct 2025

whereis openssl

openssl: /usr/bin/openssl /usr/lib64/openssl /usr/include/openssl /usr/local/openssl /usr/share/man/man1/openssl.1ssl.gz

mv /usr/bin/openssl /usr/bin/openssl.old

mv /usr/lib64/openssl /usr/lib64/openssl.old

mv /usr/include/openssl /usr/include/openssl.old

mv /usr/local/openssl /usr/local/openssl.old

mkdir -p /data/updateSsl /data/updateSsh

tar xf openssl-4.0.0.tar.gz -C /data/updateSsl

tar xf openssh-10.3p1.tar.gz -C /data/updateSsh

cd /data/updateSsl/openssl-4.0.0

./config --prefix=/usr --shared && make && make install

cd /data/updateSsl/openssl-4.0.0

make distcleansed -i '/enc_b64_avx2.c/d' crypto/evp/build.info

./config -std=gnu99 no-asm

make -j$(nproc)make install

Can't locate IPC/Cmd.pm in @INC ...

yum install -y perl-core

 openssl version

OpenSSL 4.0.0 1 Oct 2025

mv /etc/ssh/ /home/ssh-bak

mv /usr/bin/ssh /usr/bin/ssh.bak

mv /usr/sbin/sshd /usr/sbin/sshd.bak

mv /etc/pam.d/sshd /etc/pam.d/sshd.old

cd /data/updateSsh/openssh-10.3p1

./configure --prefix=/usr --sysconfdir=/etc/ssh --with-pam --with-zlib --with-md5-passwords

./configure 仅做配置检查，确认依赖满足后即可进入下一步编译。若出现以下报错，按提示安装对应依赖：

make && make install

cp contrib/redhat/sshd.init /etc/init.d/sshd

echo 'X11Forwarding yes' >> /etc/ssh/sshd_config

echo "PermitRootLogin yes" >> /etc/ssh/sshd_config

systemctl enable sshd

systemctl restart sshd

systemctl status sshd

ssh -V

openssl versionssh localhostss -tlnp | grep :22

# 1. 安装 yum-utils（提供 repotrack 命令）yum install -y yum-utils 2. 下载 perl-core 及其所有依赖 mkdir -p /tmp/all_perl_rpms && cd /tmp/all_perl_rpms && repotrack perl-core 3. 下载 zlib-devel 及其所有依赖 mkdir -p /tmp/zlib-devel-pkgs && cd /tmp/zlib-devel-pkgs && repotrack zlib-devel 4. 下载 pam-devel 及其所有依赖 mkdir -p /tmp/pam-devel-pkgs && cd /tmp/pam-devel-pkgs && repotrack pam-devel 5. 打包 cd /tmptar -czf perl-core-pkgs.tar.gz all_perl_rpms/tar -czf zlib-devel-pkgs.tar.gz zlib-devel-pkgs/tar -czf pam-devel-pkgs.tar.gz pam-devel-pkgs/

# 解压cd /tmptar -xzf perl-core-pkgs.tar.gztar -xzf zlib-devel-pkgs.tar.gztar -xzf pam-devel-pkgs.tar.gz 清除代理环境变量，避免 yum 尝试联网 unset http_proxy https_proxy 安装 cd /tmp/all_perl_rpms && yum localinstall -y *.rpm

cd /tmp/zlib-devel-pkgs && yum localinstall -y *.rpm

cd /tmp/pam-devel-pkgs && yum localinstall -y *.rpm

repotrack 仅下载 RPM 包及其全量依赖，不会自动安装，非常适合离线环境使用。