ansible批量漏洞升级openssh版本

1、ansible宿主机准备好环境，并写好hosts文件

[root@oxidized ansible]# cat hosts
[all]
10.10.200.33
10.10.200.34
10.10.200.35
 
跑playbook之前记得提前发送秘钥
ssh-copy-id 10.10.200.33/34/35

2、下载好安装包，然后编写yml

[root@oxidized ansible]# cat loudongBD.yml
- name: 漏洞修复
  hosts: all
  tasks:
    - name: copy openssl
      copy:
        src: /openssh_upgrade_9.7/openssl-3.1.5.tar.gz
        dest: /usr/local/src/openssl-3.1.5.tar.gz
    - name: copy openssh
      copy:
        src: /openssh_upgrade_9.7/openssh-9.7p1.tar.gz
        dest: /usr/local/src/openssh-9.7p1.tar.gz
    - name: copy upgrade脚本
      copy:
        src: /etc/ansible/loudongBD_ssh.sh
        dest: /usr/local/src/loudongBD_ssh.sh
    - name:
      copy:
        src: /etc/ansible/loudongBD_ssl.sh
        dest: /usr/local/src/loudongBD_ssl.sh
    - name: openssl升级
      shell: sh /usr/local/src/loudongBD_ssl.sh
    - name: openssh升级
      shell: sh /usr/local/src/loudongBD_ssh.sh

3、两个shell脚本内容如下

openssl升级脚本：

[root@oxidized ansible]# cat loudongBD_ssl.sh
#!/bin/bash
cd /etc/yum.repos.d/ && mkdir bak
mv *.repo bak/
cat >>/etc/yum.repos.d/local.repo <
[base]
name=Nexus
baseurl=http://10.10.200.20:8081/repository/yumHosted/
enabled=1
gpgcheck=0
EOF
 
yum makecache fast
 
 
yum install gcc gcc-c++ openssl-devel libstdc++* libcap* pam-devel zlib-devel perl perl-IPC-Cmd -y
 
cd /usr/local/src/
 
mv /usr/lib64/openssl /usr/lib64/openssl.old
 
yum -y remove openssl
 
tar xf openssl-3.1.5.tar.gz
 
cd /usr/local/src/openssl-3.1.5
 
./config --prefix=/usr
 
make && make install

openssh升级脚本：

[root@oxidized ansible]# cat loudongBD_ssh.sh
 #!/bin/bash
 
cd  /usr/local/src/
 
tar xf openssh-9.7p1.tar.gz
 
mkdir /etc/ssh.bak
 
mv /etc/ssh/ /etc/ssh.bak
 
cd /usr/local/src/openssh-9.7p1
 
./configure --prefix=/usr --sysconfdir=/etc/ssh --with-ssl-dir=/usr/local/openssl --with-md5-passwords
 
make && make install
 
cp /usr/local/src/openssh-9.7p1/contrib/redhat/sshd.init /etc/init.d/sshd
 
mv /usr/lib/systemd/system/sshd.service /usr/lib/systemd/system/sshd.service.bak
 
cp /etc/ssh/sshd_config{,.bak}
 
sed -i 's/^PermitRootLogin/#&/' /etc/ssh/sshd_config
 
sed -i '32i PermitRootLogin yes' /etc/ssh/sshd_config
 
chkconfig --add sshd
 
systemctl daemon-reload
 
systemctl restart sshd

4、环境准备好后，直接运行剧本即可

[root@oxidized ansible]# ansible-playbook loudongBD.yml

5、升级后检查ssh版本

[root@oxidized ansible]# ssh -V
OpenSSH_9.7p1, OpenSSL 3.1.5 30 Jan 2024