• 编译CentOS6.10系统的OpenSSHV9.4rpm安装包

     目前OpenSSH版本已至9.4，其作为操作系统底层管理平台软件，需要保持更新以免遭受安全攻击，编译生成rpm包是生产环境中批量升级的最佳途径。编译软件包时与当前的运行环境有较大关系，请注意本安装包系在CentOS6.10原生系统纯净系统下编译完成的。

    一、准备编译环境：

     1、发布一台虚拟机，最小化安装CentOS6.10，查看系统信息如下：

    1. [root@localhost ~]# cat /etc/redhat-release 
    2. CentOS release 6.10 (Final)

     2、查看系统所带openssl的版本信息：

    1. [root@localhost ~]# rpm -qa|grep openssh
    2. openssh-5.3p1-123.el6_9.x86_64
    3. openssh-server-5.3p1-123.el6_9.x86_64
    4. [root@localhost ~]# rpm -qa|grep openssl
    5. openssl-1.0.1e-57.el6.x86_64

     3、修改系统源为阿里源：

    1. [root@localhost ~]# cd /etc/yum.repos.d/
    2. [root@localhost yum.repos.d]# rm CentOS-* -rf
    3. [root@localhost yum.repos.d]# vi http.repo 
    4. [root@localhost yum.repos.d]# cat http.repo 
    5. [os]
    6. name=os
    7. baseurl=https://mirrors.aliyun.com/centos-vault/6.10/os/x86_64/
    8. gpgcheck=0
    9. enabled=1
    10. [root@localhost yum.repos.d]# cd ~
    11. [root@localhost ~]# yum repolist
    12. 已加载插件：fastestmirror
    13. Determining fastest mirrors
    14. os                                                                                                                                | 3.7 kB     00:00     
    15. os/primary_db                                                                                                                     | 4.7 MB     00:04     
    16. 仓库标识                                                                     仓库名称                                                               状态
    17. os                                                                           os                                                                     6,713
    18. repolist: 6,713

     4、准备相关目录及工具

    1. [root@localhost ~]# cd ~
    2. [root@localhost ~]# mkdir -p rpmbuild/{SOURCES,SPECS}
    3. [root@localhost ~]# yum install wget tree -y
    4. 已加载插件：fastestmirror
    5. 设置安装进程
    6. Loading mirror speeds from cached hostfile
    7. 解决依赖关系
    8. --> 执行事务检查
    9. ---> Package tree.x86_64 0:1.5.3-3.el6 will be 安装
    10. ---> Package wget.x86_64 0:1.12-10.el6 will be 安装
    11. --> 完成依赖关系计算
    12.  
    13. 依赖关系解决
    14.  
    15. =========================================================================================================================================================
    16.  软件包                            架构                                版本                                        仓库                             大小
    17. =========================================================================================================================================================
    18. 正在安装:
    19.  tree                              x86_64                              1.5.3-3.el6                                 os                               36 k
    20.  wget                              x86_64                              1.12-10.el6                                 os                              484 k
    21.  
    22. 事务概要
    23. =========================================================================================================================================================
    24. Install       2 Package(s)
    25.  
    26. 总下载量：520 k
    27. Installed size: 1.9 M
    28. 下载软件包：
    29. (1/2): tree-1.5.3-3.el6.x86_64.rpm                                                                                                |  36 kB     00:00     
    30. (2/2): wget-1.12-10.el6.x86_64.rpm                                                                                                | 484 kB     00:00     
    31. ---------------------------------------------------------------------------------------------------------------------------------------------------------
    32. 总计                                                                                                                     799 kB/s | 520 kB     00:00     
    33. 运行 rpm_check_debug 
    34. 执行事务测试
    35. 事务测试成功
    36. 执行事务
    37.   正在安装   : tree-1.5.3-3.el6.x86_64                                                                                                               1/2 
    38.   正在安装   : wget-1.12-10.el6.x86_64                                                                                                               2/2 
    39.   Verifying  : wget-1.12-10.el6.x86_64                                                                                                               1/2 
    40.   Verifying  : tree-1.5.3-3.el6.x86_64                                                                                                               2/2 
    41.  
    42. 已安装:
    43.   tree.x86_64 0:1.5.3-3.el6                                                   wget.x86_64 0:1.12-10.el6                                                  
    44.  
    45. 完毕！

    5、 准备源文件

    1. [root@localhost ~]# cd rpmbuild/SOURCES/
    2. [root@localhost SOURCES]# wget https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-9.4p1.tar.gz --no-check-certificate
    3. ...
    4. 2023-09-05 18:33:37 (69.2 KB/s) - 已保存 “openssh-9.4p1.tar.gz” [1845094/1845094])
    5. [root@localhost SOURCES]# wget https://src.fedoraproject.org/repo/pkgs/openssh/x11-ssh-askpass-1.2.4.1.tar.gz/8f2e41f3f7eaa8543a2440454637f3c3/x11-ssh-askpass-1.2.4.1.tar.gz
    6. ...
    7. 2023-09-05 18:41:14 (114 KB/s) - 已保存 “x11-ssh-askpass-1.2.4.1.tar.gz” [29229/29229])
    8. [root@localhost SOURCES]# wget https://www.openssl.org/source/openssl-1.1.1v.tar.gz --no-check-certificate
    9. ...
    10. 2023-09-06 21:56:18 (901 KB/s) - 已保存 “openssl-1.1.1v.tar.gz” [9893443/9893443])
    11.  
    12. [root@localhost SOURCES]# vi sshd.pam.el6
    13. #%PAM-1.0
    14. auth       required     pam_sepermit.so
    15. auth       include      password-auth
    16. account    required     pam_nologin.so
    17. account    include      password-auth
    18. password   include      password-auth
    19. # pam_selinux.so close should be the first session rule
    20. session    required     pam_selinux.so close
    21. session    required     pam_loginuid.so
    22. # pam_selinux.so open should only be followed by sessions to be executed in the user context
    23. session    required     pam_selinux.so open env_params
    24. session    optional     pam_keyinit.so force revoke
    25. session    include      password-auth                                                                                                                        
    26. "sshd.pam.el6" [New] 13L, 575C written
    27. [root@localhost SOURCES]# cat sshd.pam.el6 
    28. #%PAM-1.0
    29. auth       required     pam_sepermit.so
    30. auth       include      password-auth
    31. account    required     pam_nologin.so
    32. account    include      password-auth
    33. password   include      password-auth
    34. # pam_selinux.so close should be the first session rule
    35. session    required     pam_selinux.so close
    36. session    required     pam_loginuid.so
    37. # pam_selinux.so open should only be followed by sessions to be executed in the user context
    38. session    required     pam_selinux.so open env_params
    39. session    optional     pam_keyinit.so force revoke
    40. session    include      password-auth 
    41. [root@localhost SOURCES]# ll
    42. 总用量 11504
    43. -rw-r--r--. 1 root root 1845094 8月  10 11:15 openssh-9.4p1.tar.gz
    44. -rw-r--r--. 1 root root 9893443 8月   1 22:09 openssl-1.1.1v.tar.gz
    45. -rw-r--r--. 1 root root     575 9月   6 19:38 sshd.pam.el6
    46. -rw-r--r--. 1 root root   29229 6月  26 2004 x11-ssh-askpass-1.2.4.1.tar.gz

    6、 安装编译工具

    1. [root@localhost SOURCES]# cd ../SPECS
    2. [root@localhost SPECS]# yum install rpm-build zlib-devel openssl-devel gcc perl-devel pam-devel -y
    3. ...
    4. 已安装:
    5.   gcc.x86_64 0:4.4.7-23.el6           openssl-devel.x86_64 0:1.0.1e-57.el6     pam-devel.x86_64 0:1.1.1-24.el6     perl-devel.x86_64 4:5.10.1-144.el6    
    6.   rpm-build.x86_64 0:4.8.0-59.el6     zlib-devel.x86_64 0:1.2.3-29.el6        
    7.  
    8. 作为依赖被安装:
    9.   cloog-ppl.x86_64 0:0.15.7-1.2.el6               cpp.x86_64 0:4.4.7-23.el6                    db4-cxx.x86_64 0:4.7.25-22.el6                          
    10.   db4-devel.x86_64 0:4.7.25-22.el6                elfutils.x86_64 0:0.164-2.el6                gdb.x86_64 0:7.2-92.el6                                 
    11.   gdbm-devel.x86_64 0:1.8.0-39.el6                glibc-devel.x86_64 0:2.12-1.212.el6          glibc-headers.x86_64 0:2.12-1.212.el6                   
    12.   kernel-headers.x86_64 0:2.6.32-754.el6          keyutils-libs-devel.x86_64 0:1.4-5.el6       krb5-devel.x86_64 0:1.10.3-65.el6                       
    13.   libcom_err-devel.x86_64 0:1.41.12-24.el6        libgomp.x86_64 0:4.4.7-23.el6                libkadm5.x86_64 0:1.10.3-65.el6                         
    14.   libselinux-devel.x86_64 0:2.0.94-7.el6          libsepol-devel.x86_64 0:2.0.41-4.el6         mpfr.x86_64 0:2.4.1-6.el6                               
    15.   patch.x86_64 0:2.6-8.el6_9                      perl.x86_64 4:5.10.1-144.el6                 perl-ExtUtils-MakeMaker.x86_64 0:6.55-144.el6           
    16.   perl-ExtUtils-ParseXS.x86_64 1:2.2003.0-144.el6 perl-Module-Pluggable.x86_64 1:3.90-144.el6  perl-Pod-Escapes.x86_64 1:1.04-144.el6                  
    17.   perl-Pod-Simple.x86_64 1:3.13-144.el6           perl-Test-Harness.x86_64 0:3.17-144.el6      perl-libs.x86_64 4:5.10.1-144.el6                       
    18.   perl-version.x86_64 3:0.77-144.el6              ppl.x86_64 0:0.10.2-11.el6                   redhat-rpm-config.noarch 0:9.0.3-51.el6.centos          
    19.   unzip.x86_64 0:6.0-5.el6                        xz.x86_64 0:4.999.9-0.5.beta.20091007git.el6 xz-lzma-compat.x86_64 0:4.999.9-0.5.beta.20091007git.el6
    20.  
    21. 完毕！

    7、 生成源spec文件

    1. [root@localhost SPECS]# vi openssh.spec 
    2. [root@localhost SPECS]# cat openssh.spec 
    3. %{?!opensslver: %global opensslver 1.1.1v}
    4. %{?!opensshver: %global opensshver 9.4p1}
    5. %define static_openssl 1
    6.  
    7. # wheather to build openssl
    8. %global no_build_openssl 0
    9.  
    10. #if defined openssl_dir, don't build it
    11. %{?openssl_dir:%global no_build_openssl 1}
    12.  
    13. %global ver %{?opensshver}
    14. %global rel %{?opensshpkgrel}%{?dist}
    15.  
    16. # OpenSSH privilege separation requires a user & group ID
    17. %global sshd_uid    74
    18. %global sshd_gid    74
    19.  
    20. # Version of ssh-askpass
    21. %global aversion 1.2.4.1
    22.  
    23. # Do we want to disable building of x11-askpass? (1=yes 0=no)
    24. %global no_x11_askpass 1
    25.  
    26. # Do we want to disable building of gnome-askpass? (1=yes 0=no)
    27. %global no_gnome_askpass 1
    28.  
    29. # Do we want to link against a static libcrypto? (1=yes 0=no)
    30. %global static_libcrypto 0
    31.  
    32. # Do we want smartcard support (1=yes 0=no)
    33. %global scard 0
    34.  
    35. # Use GTK2 instead of GNOME in gnome-ssh-askpass
    36. %global gtk2 1
    37.  
    38. # Use build6x options for older RHEL builds
    39. # RHEL 7 not yet supported
    40. %if 0%{?rhel} > 6
    41. %global build6x 0
    42. %else
    43. %global build6x 1
    44. %endif
    45.  
    46. %if 0%{?fedora} >= 26
    47. %global compat_openssl 1
    48. %else
    49. %global compat_openssl 0
    50. %endif
    51.  
    52. # Do we want kerberos5 support (1=yes 0=no)
    53. %global kerberos5 1
    54.  
    55. # Reserve options to override askpass settings with:
    56. # rpm -ba|--rebuild --define 'skip_xxx 1'
    57. %{?skip_x11_askpass:%global no_x11_askpass 1}
    58. %{?skip_gnome_askpass:%global no_gnome_askpass 1}
    59.  
    60. # Add option to build without GTK2 for older platforms with only GTK+.
    61. # RedHat <= 7.2 and Red Hat Advanced Server 2.1 are examples.
    62. # rpm -ba|--rebuild --define 'no_gtk2 1'
    63. %{?no_gtk2:%global gtk2 0}
    64.  
    65. # Is this a build for RHL 6.x or earlier?
    66. %{?build_6x:%global build6x 1}
    67.  
    68. # If this is RHL 6.x, the default configuration has sysconfdir in /usr/etc.
    69. %if %{build6x}
    70. %global _sysconfdir /etc
    71. %endif
    72.  
    73. # Options for static OpenSSL link:
    74. # rpm -ba|--rebuild --define "static_openssl 1"
    75. %{?static_openssl:%global static_libcrypto 1}
    76.  
    77. # Options for Smartcard support: (needs libsectok and openssl-engine)
    78. # rpm -ba|--rebuild --define "smartcard 1"
    79. %{?smartcard:%global scard 1}
    80.  
    81. # Is this a build for the rescue CD (without PAM, with MD5)? (1=yes 0=no)
    82. %global rescue 0
    83. %{?build_rescue:%global rescue 1}
    84.  
    85. # Turn off some stuff for resuce builds
    86. %if %{rescue}
    87. %global kerberos5 0
    88. %endif
    89.  
    90. Summary: The OpenSSH implementation of SSH protocol version 2.
    91. Name: openssh
    92. Version: %{ver}
    93. %if %{rescue}
    94. Release: %{rel}rescue
    95. %else
    96. Release: %{rel}
    97. %endif
    98. URL: https://www.openssh.com/portable.html
    99. Source0: https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz
    100. Source1: http://www.jmknoble.net/software/x11-ssh-askpass/x11-ssh-askpass-%{aversion}.tar.gz
    101. Source2: sshd.pam.el6
    102. %if ! %{no_build_openssl}
    103. Source3: https://www.openssl.org/source/openssl-%{opensslver}.tar.gz
    104. %endif
    105. License: BSD
    106. Group: Applications/Internet
    107. BuildRoot: %{_tmppath}/%{name}-%{version}-buildroot
    108. Obsoletes: ssh
    109. %if %{build6x}
    110. PreReq: initscripts >= 5.00
    111. %else
    112. Requires: initscripts >= 5.20
    113. %endif
    114. BuildRequires: perl
    115. #%if %{compat_openssl}
    116. #BuildRequires: compat-openssl10-devel
    117. #%else
    118. #BuildRequires: openssl-devel >= 1.0.1
    119. #BuildRequires: openssl-devel < 1.1
    120. #%endif
    121. BuildRequires: /bin/login
    122. %if ! %{build6x}
    123. BuildRequires: glibc-devel, pam
    124. %else
    125. BuildRequires: /usr/include/security/pam_appl.h
    126. %endif
    127. %if ! %{no_x11_askpass}
    128. BuildRequires: /usr/include/X11/Xlib.h
    129. # Xt development tools
    130. BuildRequires: libXt-devel
    131. # Provides xmkmf
    132. BuildRequires: imake
    133. # Rely on relatively recent gtk
    134. %if %{gtk2}
    135. BuildRequires: gtk2-devel
    136. %endif
    137. %endif
    138. %if ! %{no_gnome_askpass}
    139. BuildRequires: pkgconfig
    140. %endif
    141. %if %{kerberos5}
    142. BuildRequires: krb5-devel
    143. BuildRequires: krb5-libs
    144. %endif
    145.  
    146. %package clients
    147. Summary: OpenSSH clients.
    148. Requires: openssh = %{version}-%{release}
    149. Group: Applications/Internet
    150. Obsoletes: ssh-clients
    151.  
    152. %package server
    153. Summary: The OpenSSH server daemon.
    154. Group: System Environment/Daemons
    155. Obsoletes: ssh-server
    156. Requires: openssh = %{version}-%{release}, chkconfig >= 0.9
    157. %if ! %{build6x}
    158. Requires: /etc/pam.d/system-auth
    159. %endif
    160.  
    161. %package askpass
    162. Summary: A passphrase dialog for OpenSSH and X.
    163. Group: Applications/Internet
    164. Requires: openssh = %{version}-%{release}
    165. Obsoletes: ssh-extras
    166.  
    167. %package askpass-gnome
    168. Summary: A passphrase dialog for OpenSSH, X, and GNOME.
    169. Group: Applications/Internet
    170. Requires: openssh = %{version}-%{release}
    171. Obsoletes: ssh-extras
    172.  
    173. %description
    174. SSH (Secure SHell) is a program for logging into and executing
    175. commands on a remote machine. SSH is intended to replace rlogin and
    176. rsh, and to provide secure encrypted communications between two
    177. untrusted hosts over an insecure network. X11 connections and
    178. arbitrary TCP/IP ports can also be forwarded over the secure channel.
    179.  
    180. OpenSSH is OpenBSD's version of the last free version of SSH, bringing
    181. it up to date in terms of security and features, as well as removing
    182. all patented algorithms to separate libraries.
    184. This package includes the core files necessary for both the OpenSSH
    185. client and server. To make this package useful, you should also
    186. install openssh-clients, openssh-server, or both.
    188. %description clients
    189. OpenSSH is a free version of SSH (Secure SHell), a program for logging
    190. into and executing commands on a remote machine. This package includes
    191. the clients necessary to make encrypted connections to SSH servers.
    192. You'll also need to install the openssh package on OpenSSH clients.
    193.  
    194. %description server
    195. OpenSSH is a free version of SSH (Secure SHell), a program for logging
    196. into and executing commands on a remote machine. This package contains
    197. the secure shell daemon (sshd). The sshd daemon allows SSH clients to
    198. securely connect to your SSH server. You also need to have the openssh
    199. package installed.
    200.  
    201. %description askpass
    202. OpenSSH is a free version of SSH (Secure SHell), a program for logging
    203. into and executing commands on a remote machine. This package contains
    204. an X11 passphrase dialog for OpenSSH.
    205.  
    206. %description askpass-gnome
    207. OpenSSH is a free version of SSH (Secure SHell), a program for logging
    208. into and executing commands on a remote machine. This package contains
    209. an X11 passphrase dialog for OpenSSH and the GNOME GUI desktop
    210. environment.
    211.  
    212. %prep
    213.  
    214. %if ! %{no_x11_askpass}
    215. %setup -q -a 1
    216. %else
    217. %setup -q
    218. %endif
    219.  
    220. %if ! %{no_build_openssl}
    221. %define openssl_dir %{_builddir}/%{name}-%{version}/openssl
    222. mkdir -p openssl
    223. tar xfz %{SOURCE3} --strip-components=1 -C openssl
    224. pushd openssl
    225. ./config shared zlib -fPIC
    226. make %{?_smp_mflags}
    227. popd
    228. %endif
    229.  
    230. %build
    231. %if %{rescue}
    232. CFLAGS="$RPM_OPT_FLAGS -Os"; export CFLAGS
    233. %endif
    234.  
    235. export LD_LIBRARY_PATH="%{openssl_dir}"
    236. %configure \
    237.         --sysconfdir=%{_sysconfdir}/ssh \
    238.         --libexecdir=%{_libexecdir}/openssh \
    239.         --datadir=%{_datadir}/openssh \
    240.         --with-default-path=/usr/local/bin:/bin:/usr/bin \
    241.         --with-superuser-path=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin \
    242.         --with-privsep-path=%{_var}/empty/sshd \
    243.         --with-md5-passwords \
    244.         --mandir=%{_mandir} \
    245.         --with-mantype=man \
    246.         --disable-strip \
    247.         --with-ssl-dir="%{openssl_dir}" \
    248. %if %{scard}
    249.         --with-smartcard \
    250. %endif
    251. %if %{rescue}
    252.         --without-pam \
    253. %else
    254.         --with-pam \
    255. %endif
    256. %if %{kerberos5}
    257.          --with-kerberos5=$K5DIR \
    258. %endif
    259.  
    260.  
    261. %if %{static_libcrypto}
    262. #perl -pi -e "s|-lcrypto|%{_libdir}/libcrypto.a|g" Makefile
    263. perl -pi -e "s|-lcrypto|%{openssl_dir}/libcrypto.a -lpthread|g" Makefile
    264. %endif
    265.  
    266. make %{?_smp_mflags}
    267.  
    268. %if ! %{no_x11_askpass}
    269. pushd x11-ssh-askpass-%{aversion}
    270. %configure --libexecdir=%{_libexecdir}/openssh
    271. xmkmf -a
    272. make -j
    273. popd
    274. %endif
    275.  
    276. # Define a variable to toggle gnome1/gtk2 building.  This is necessary
    277. # because RPM doesn't handle nested %if statements.
    278. %if %{gtk2}
    279.         gtk2=yes
    280. %else
    281.         gtk2=no
    282. %endif
    283.  
    284. %if ! %{no_gnome_askpass}
    285. pushd contrib
    286. if [ $gtk2 = yes ] ; then
    287.         make gnome-ssh-askpass2
    288.         mv gnome-ssh-askpass2 gnome-ssh-askpass
    289. else
    290.         make gnome-ssh-askpass1
    291.         mv gnome-ssh-askpass1 gnome-ssh-askpass
    292. fi
    293. popd
    294. %endif
    295.  
    296. %install
    297. rm -rf $RPM_BUILD_ROOT
    298. mkdir -p -m755 $RPM_BUILD_ROOT%{_sysconfdir}/ssh
    299. mkdir -p -m755 $RPM_BUILD_ROOT%{_libexecdir}/openssh
    300. mkdir -p -m755 $RPM_BUILD_ROOT%{_var}/empty/sshd
    301.  
    302. make install DESTDIR=$RPM_BUILD_ROOT
    303. echo -e 'PubkeyAcceptedAlgorithms +ssh-rsa\nUsePAM yes\nPermitRootLogin yes\nUseDNS no' >> $RPM_BUILD_ROOT/etc/ssh/sshd_config
    304. install -d $RPM_BUILD_ROOT/etc/pam.d/
    305. install -d $RPM_BUILD_ROOT/etc/rc.d/init.d
    306. install -d $RPM_BUILD_ROOT%{_libexecdir}/openssh
    307. install -m755 contrib/ssh-copy-id $RPM_BUILD_ROOT/usr/bin/ssh-copy-id
    308. install -m644 %{SOURCE2}     $RPM_BUILD_ROOT/etc/pam.d/sshd
    309. install -m755 contrib/redhat/sshd.init $RPM_BUILD_ROOT/etc/rc.d/init.d/sshd
    310.  
    311. %if ! %{no_x11_askpass}
    312. install x11-ssh-askpass-%{aversion}/x11-ssh-askpass $RPM_BUILD_ROOT%{_libexecdir}/openssh/x11-ssh-askpass
    313. ln -s x11-ssh-askpass $RPM_BUILD_ROOT%{_libexecdir}/openssh/ssh-askpass
    314. %endif
    315.  
    316. %if ! %{no_gnome_askpass}
    317. install contrib/gnome-ssh-askpass $RPM_BUILD_ROOT%{_libexecdir}/openssh/gnome-ssh-askpass
    318. %endif
    319.  
    320. %if ! %{scard}
    321.          rm -f $RPM_BUILD_ROOT/usr/share/openssh/Ssh.bin
    322. %endif
    323.  
    324. %if ! %{no_gnome_askpass}
    325. install -m 755 -d $RPM_BUILD_ROOT%{_sysconfdir}/profile.d/
    326. install -m 755 contrib/redhat/gnome-ssh-askpass.csh $RPM_BUILD_ROOT%{_sysconfdir}/profile.d/
    327. install -m 755 contrib/redhat/gnome-ssh-askpass.sh $RPM_BUILD_ROOT%{_sysconfdir}/profile.d/
    328. %endif
    329.  
    330. perl -pi -e "s|$RPM_BUILD_ROOT||g" $RPM_BUILD_ROOT%{_mandir}/man*/*
    331.  
    332. %clean
    333. rm -rf $RPM_BUILD_ROOT
    334.  
    335. %triggerun server -- ssh-server
    336. if [ "$1" != 0 -a -r /var/run/sshd.pid ] ; then
    337.         touch /var/run/sshd.restart
    338. fi
    339.  
    340. %triggerun server -- openssh-server < 2.5.0p1
    341. # Count the number of HostKey and HostDsaKey statements we have.
    342. gawk    'BEGIN {IGNORECASE=1}
    343.          /^hostkey/ || /^hostdsakey/ {sawhostkey = sawhostkey + 1}
    344.          END {exit sawhostkey}' /etc/ssh/sshd_config
    345. # And if we only found one, we know the client was relying on the old default
    346. # behavior, which loaded the the SSH2 DSA host key when HostDsaKey wasn't
    347. # specified.  Now that HostKey is used for both SSH1 and SSH2 keys, specifying
    348. # one nullifies the default, which would have loaded both.
    349. if [ $? -eq 1 ] ; then
    350.         echo HostKey /etc/ssh/ssh_host_rsa_key >> /etc/ssh/sshd_config
    351.         echo HostKey /etc/ssh/ssh_host_dsa_key >> /etc/ssh/sshd_config
    352. fi
    353.  
    354. %triggerpostun server -- ssh-server
    355. if [ "$1" != 0 ] ; then
    356.         /sbin/chkconfig --add sshd
    357.         if test -f /var/run/sshd.restart ; then
    358.                 rm -f /var/run/sshd.restart
    359.                 /sbin/service sshd start > /dev/null 2>&1 || :
    360.         fi
    361. fi
    362.  
    363. %pre server
    364. %{_sbindir}/groupadd -r -g %{sshd_gid} sshd 2>/dev/null || :
    365. %{_sbindir}/useradd -d /var/empty/sshd -s /bin/false -u %{sshd_uid} \
    366.         -g sshd -M -r sshd 2>/dev/null || :
    367.  
    368. %post server
    369. /sbin/chkconfig --add sshd
    370.  
    371. %postun server
    372. /sbin/service sshd condrestart > /dev/null 2>&1 || :
    373.  
    374. %preun server
    375. if [ "$1" = 0 ]
    376. then
    377.         /sbin/service sshd stop > /dev/null 2>&1 || :
    378.         /sbin/chkconfig --del sshd
    379. fi
    380.  
    381. %files
    382. %defattr(-,root,root)
    383. %doc CREDITS ChangeLog INSTALL LICENCE OVERVIEW README* PROTOCOL* TODO
    384. %attr(0755,root,root) %{_bindir}/scp
    385. %attr(0644,root,root) %{_mandir}/man1/scp.1*
    386. %attr(0755,root,root) %dir %{_sysconfdir}/ssh
    387. %attr(0600,root,root) %config(noreplace) %{_sysconfdir}/ssh/moduli
    388. %if ! %{rescue}
    389. %attr(0755,root,root) %{_bindir}/ssh-keygen
    390. %attr(0755,root,root) %{_bindir}/ssh-copy-id
    391. %attr(0644,root,root) %{_mandir}/man1/ssh-keygen.1*
    392. %attr(0755,root,root) %dir %{_libexecdir}/openssh
    393. %attr(4711,root,root) %{_libexecdir}/openssh/ssh-keysign
    394. %attr(0755,root,root) %{_libexecdir}/openssh/ssh-pkcs11-helper
    395. %attr(0755,root,root) %{_libexecdir}/openssh/ssh-sk-helper
    396. %attr(0644,root,root) %{_mandir}/man8/ssh-keysign.8*
    397. %attr(0644,root,root) %{_mandir}/man8/ssh-pkcs11-helper.8*
    398. %attr(0644,root,root) %{_mandir}/man8/ssh-sk-helper.8*
    399. %endif
    400. %if %{scard}
    401. %attr(0755,root,root) %dir %{_datadir}/openssh
    402. %attr(0644,root,root) %{_datadir}/openssh/Ssh.bin
    403. %endif
    404.  
    405. %files clients
    406. %defattr(-,root,root)
    407. %attr(0755,root,root) %{_bindir}/ssh
    408. %attr(0644,root,root) %{_mandir}/man1/ssh.1*
    409. %attr(0644,root,root) %{_mandir}/man5/ssh_config.5*
    410. %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ssh/ssh_config
    411. %if ! %{rescue}
    412. %attr(2755,root,nobody) %{_bindir}/ssh-agent
    413. %attr(0755,root,root) %{_bindir}/ssh-add
    414. %attr(0755,root,root) %{_bindir}/ssh-keyscan
    415. %attr(0755,root,root) %{_bindir}/sftp
    416. %attr(0644,root,root) %{_mandir}/man1/ssh-agent.1*
    417. %attr(0644,root,root) %{_mandir}/man1/ssh-add.1*
    418. %attr(0644,root,root) %{_mandir}/man1/ssh-keyscan.1*
    419. %attr(0644,root,root) %{_mandir}/man1/sftp.1*
    420. %endif
    421.  
    422. %if ! %{rescue}
    423. %files server
    424. %defattr(-,root,root)
    425. %dir %attr(0111,root,root) %{_var}/empty/sshd
    426. %attr(0755,root,root) %{_sbindir}/sshd
    427. %attr(0755,root,root) %{_libexecdir}/openssh/sftp-server
    428. %attr(0644,root,root) %{_mandir}/man8/sshd.8*
    429. %attr(0644,root,root) %{_mandir}/man5/moduli.5*
    430. %attr(0644,root,root) %{_mandir}/man5/sshd_config.5*
    431. %attr(0644,root,root) %{_mandir}/man8/sftp-server.8*
    432. %attr(0755,root,root) %dir %{_sysconfdir}/ssh
    433. %attr(0600,root,root) %config(noreplace) %{_sysconfdir}/ssh/sshd_config
    434. %attr(0600,root,root) %config(noreplace) /etc/pam.d/sshd
    435. %attr(0755,root,root) %config /etc/rc.d/init.d/sshd
    436. %endif
    437.  
    438. %if ! %{no_x11_askpass}
    439. %files askpass
    440. %defattr(-,root,root)
    441. %doc x11-ssh-askpass-%{aversion}/README
    442. %doc x11-ssh-askpass-%{aversion}/ChangeLog
    443. %doc x11-ssh-askpass-%{aversion}/SshAskpass*.ad
    444. %{_libexecdir}/openssh/ssh-askpass
    445. %attr(0755,root,root) %{_libexecdir}/openssh/x11-ssh-askpass
    446. %endif
    447.  
    448. %if ! %{no_gnome_askpass}
    449. %files askpass-gnome
    450. %defattr(-,root,root)
    451. %attr(0755,root,root) %config %{_sysconfdir}/profile.d/gnome-ssh-askpass.*
    452. %attr(0755,root,root) %{_libexecdir}/openssh/gnome-ssh-askpass
    453. %endif
    454.  
    455. [root@localhost SPECS]#

    二、编译

    1、编译

    1. [root@localhost SPECS]# rpmbuild  -bb openssh.spec
    2. warning: line 108: prereq is deprecated: PreReq: initscripts >= 5.00
    3. Executing(%prep): /bin/sh -e /var/tmp/rpm-tmp.zWPwaj
    4. + umask 022
    5. + cd /root/rpmbuild/BUILD
    6. + LANG=C
    7. + export LANG
    8. + unset DISPLAY
    9. + cd /root/rpmbuild/BUILD
    10. + rm -rf openssh-9.4p1
    11. + /bin/tar -xf -
    12. + /usr/bin/gzip -dc /root/rpmbuild/SOURCES/openssh-9.4p1.tar.gz
    13. + STATUS=0
    14. + '[' 0 -ne 0 ']'
    15. + cd openssh-9.4p1
    16. ...
    17. Obsoletes: ssh-server
    18. Processing files: openssh-debuginfo-9.4p1-.el6.x86_64
    19. Checking for unpackaged file(s): /usr/lib/rpm/check-files /root/rpmbuild/BUILDROOT/openssh-9.4p1-.el6.x86_64
    20. Wrote: /root/rpmbuild/RPMS/x86_64/openssh-9.4p1-.el6.x86_64.rpm
    21. Wrote: /root/rpmbuild/RPMS/x86_64/openssh-clients-9.4p1-.el6.x86_64.rpm
    22. Wrote: /root/rpmbuild/RPMS/x86_64/openssh-server-9.4p1-.el6.x86_64.rpm
    23. Wrote: /root/rpmbuild/RPMS/x86_64/openssh-debuginfo-9.4p1-.el6.x86_64.rpm
    24. Executing(%clean): /bin/sh -e /var/tmp/rpm-tmp.qcMTW9
    25. + umask 022
    26. + cd /root/rpmbuild/BUILD
    27. + cd openssh-9.4p1
    28. + rm -rf /root/rpmbuild/BUILDROOT/openssh-9.4p1-.el6.x86_64
    29. + exit 0
    30. [root@localhost SPECS]#

    看到“+ exit 0”表示编译成功。

    三、测试验证

    1、安装新编译的openssh RPM包

    1. [root@localhost SPECS]# cd /root/rpmbuild/RPMS/x86_64/
    2. [root@localhost x86_64]# ll
    3. 总用量 15132
    4. -rw-r--r--. 1 root root 4817808 9月   6 19:58 openssh-9.4p1-.el6.x86_64.rpm
    5. -rw-r--r--. 1 root root 4849872 9月   6 19:58 openssh-clients-9.4p1-.el6.x86_64.rpm
    6. -rw-r--r--. 1 root root 4362628 9月   6 19:58 openssh-debuginfo-9.4p1-.el6.x86_64.rpm
    7. -rw-r--r--. 1 root root 1451744 9月   6 19:58 openssh-server-9.4p1-.el6.x86_64.rpm
    8. [root@localhost x86_64]# yum install *
    9. 已加载插件：fastestmirror
    10. 设置安装进程
    11. 诊断 openssh-9.4p1-.el6.x86_64.rpm: openssh-9.4p1-.el6.x86_64
    12. openssh-9.4p1-.el6.x86_64.rpm 将作为 openssh-5.3p1-123.el6_9.x86_64 的更新
    13. Loading mirror speeds from cached hostfile
    14. 诊断 openssh-clients-9.4p1-.el6.x86_64.rpm: openssh-clients-9.4p1-.el6.x86_64
    15. openssh-clients-9.4p1-.el6.x86_64.rpm 将被安装
    16. 诊断 openssh-debuginfo-9.4p1-.el6.x86_64.rpm: openssh-debuginfo-9.4p1-.el6.x86_64
    17. openssh-debuginfo-9.4p1-.el6.x86_64.rpm 将被安装
    18. 诊断 openssh-server-9.4p1-.el6.x86_64.rpm: openssh-server-9.4p1-.el6.x86_64
    19. openssh-server-9.4p1-.el6.x86_64.rpm 将作为 openssh-server-5.3p1-123.el6_9.x86_64 的更新
    20. 解决依赖关系
    21. --> 执行事务检查
    22. ---> Package openssh.x86_64 0:5.3p1-123.el6_9 will be 升级
    23. ---> Package openssh.x86_64 0:9.4p1-.el6 will be an update
    24. ---> Package openssh-clients.x86_64 0:9.4p1-.el6 will be 安装
    25. ---> Package openssh-debuginfo.x86_64 0:9.4p1-.el6 will be 安装
    26. ---> Package openssh-server.x86_64 0:5.3p1-123.el6_9 will be 升级
    27. ---> Package openssh-server.x86_64 0:9.4p1-.el6 will be an update
    28. --> 完成依赖关系计算
    29.  
    30. 依赖关系解决
    31.  
    32. =========================================================================================================================================================
    33.  软件包                              架构                     版本                          仓库                                                    大小
    34. =========================================================================================================================================================
    35. 正在安装:
    36.  openssh-clients                     x86_64                   9.4p1-.el6                    /openssh-clients-9.4p1-.el6.x86_64                      12 M
    37.  openssh-debuginfo                   x86_64                   9.4p1-.el6                    /openssh-debuginfo-9.4p1-.el6.x86_64                    17 M
    38. 正在升级:
    39.  openssh                             x86_64                   9.4p1-.el6                    /openssh-9.4p1-.el6.x86_64                              12 M
    40.  openssh-server                      x86_64                   9.4p1-.el6                    /openssh-server-9.4p1-.el6.x86_64                      3.5 M
    41.  
    42. 事务概要
    43. =========================================================================================================================================================
    44. Install       2 Package(s)
    45. Upgrade       2 Package(s)
    46.  
    47. 总文件大小：44 M
    48. 确定吗？[y/N]：y
    49. 下载软件包：
    50. 运行 rpm_check_debug 
    51. 执行事务测试
    52. 事务测试成功
    53. 执行事务
    54.   正在升级   : openssh-9.4p1-.el6.x86_64                                                                                                             1/6 
    55.   正在升级   : openssh-server-9.4p1-.el6.x86_64                                                                                                      2/6 
    56.   正在安装   : openssh-clients-9.4p1-.el6.x86_64                                                                                                     3/6 
    57.   正在安装   : openssh-debuginfo-9.4p1-.el6.x86_64                                                                                                   4/6 
    58.   清理       : openssh-server-5.3p1-123.el6_9.x86_64                                                                                                 5/6 
    59.   清理       : openssh-5.3p1-123.el6_9.x86_64                                                                                                        6/6 
    60.   Verifying  : openssh-debuginfo-9.4p1-.el6.x86_64                                                                                                   1/6 
    61.   Verifying  : openssh-server-9.4p1-.el6.x86_64                                                                                                      2/6 
    62.   Verifying  : openssh-9.4p1-.el6.x86_64                                                                                                             3/6 
    63.   Verifying  : openssh-clients-9.4p1-.el6.x86_64                                                                                                     4/6 
    64.   Verifying  : openssh-5.3p1-123.el6_9.x86_64                                                                                                        5/6 
    65.   Verifying  : openssh-server-5.3p1-123.el6_9.x86_64                                                                                                 6/6 
    66.  
    67. 已安装:
    68.   openssh-clients.x86_64 0:9.4p1-.el6                                        openssh-debuginfo.x86_64 0:9.4p1-.el6                                       
    69.  
    70. 更新完毕:
    71.   openssh.x86_64 0:9.4p1-.el6                                             openssh-server.x86_64 0:9.4p1-.el6                                            
    72.  
    73. 完毕！

    2、版本验证：

    可以将/root/rpmbuild/RPMS/x86_64下的软件包进行拷贝分发或放到http服务器共享。至此，rpm包制作完成。

    3、注意事项

    openssh升级到9.*后加密算法最低要求256位，因此升级openssh后低版本的客户端和CRT都将无法连接，报以下错误：

    Key exchange failed.
    No compatible key-exchange method. The server supports these methods: sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256

    此时其它未升级openssh的centos6服务器都连不上更新服务器的，不要以为升级失败了，只需将需要连接本服务器的主机的openssh-client也升级了即可。

    Windows连接请升级SecureCRT到8.*.*版本，同时会话属性中仅启用256或512位算法，即可正常连接。

    可以看到连接是没有任何问题的。

     本人编译的成品包下载地址：下载链接

  • 相关阅读:
    Docker在Centos7下的安装
    做销售，如何实现快速初筛客户？
    shell脚本之数组
    MySQL 内部组件结构以及SQL执行逻辑
    信息学奥赛一本通：1147：最高分数的学生姓名
    docker导致root空间满进入不了系统解决方案
    【QSPI】 什么是QSPI SPI和QSPI异同
    c++11 标准模板（STL）string（四）
    是真的吗？Nuture子刊告诉你这么多年的微生物组经验都是错的？！
    docker&docker-copose_限制容器cpu和内存
  • 原文地址：https://blog.csdn.net/forestqq/article/details/132685885