OpenSSH漏洞预警：无需用户交互，可提权至 root
https://mp.weixin.qq.com/s/c_gATfwcjyXVGj0g6xXIBg
OpenSSH远程代码执行漏洞分析及POC（CVE-2024-6387）
https://mp.weixin.qq.com/s/79P1zpb36D0ku-gwwXfPtQ
OenSSH官方只提供源码包，我们考虑自己将源码编译为rpm包来升级环境的OpenSSH。
当然编译过程也尽量简单化，这里我们直接使用开源的脚本进行编译。
https://github.com/boypt/openssh-rpms
# yum -y install epel-release
# yum -y install git zip unzip
# yum -y groupinstall "Development Tools"
# yum -y install imake rpm-build pam-devel krb5-devel zlib-devel libXt-devel libX11-devel gtk2-devel
# git clone https://github.com/boypt/openssh-rpms.git
# cd openssh-rpms-main
# ls -l
-rwxr-xr-x. 1 root root 1959 9月 3 21:44 compile.sh
drwxr-xr-x. 2 root root 114 9月 3 21:40 downloads
drwxr-xr-x. 7 root root 72 8月 10 15:22 el5
drwxr-xr-x. 7 root root 72 8月 10 15:22 el6
drwxr-xr-x. 8 root root 89 9月 3 21:44 el7
-rwxr-xr-x. 1 root root 1304 9月 3 21:39 pullsrc.sh
-rw-r--r--. 1 root root 1440 8月 10 15:22 README.md
-rw-r--r--. 1 root root 255 8月 10 15:22 version.env
将出现 source version.env 行改为 source ./version.env
# grep "version.env" *.sh
compile.sh:source ./version.env
pullsrc.sh:source ./version.env
将出现 wget 的行加上 --no-check-certificate 参数，避免因为证书问题导致源码下载失败。
# grep "wget" pullsrc.sh
wget --no-check-certificate $OPENSSLMIR/$OPENSSLSRC
wget --no-check-certificate $OPENSSHMIR/$OPENSSHSRC
wget --no-check-certificate $ASKPASSMIR/$ASKPASSSRC
# sh pullsrc.sh
# sh compile.sh
Obsoletes: ssh-server
处理文件：openssh-debuginfo-9.8p1-1.el7.x86_64
Provides: openssh-debuginfo = 9.8p1-1.el7 openssh-debuginfo(x86-64) = 9.8p1-1.el7
Requires(rpmlib): rpmlib(FileDigests) <= 4.6.0-1 rpmlib(PayloadFilesHavePrefix) <= 4.0-1 rpmlib(CompressedFileNames) <= 3.0.4-1
检查未打包文件：/usr/lib/rpm/check-files /root/openssh-rpms-main/el7/BUILDROOT/openssh-9.8p1-1.el7.x86_64
写道:/root/openssh-rpms-main/el7/SRPMS/openssh-9.8p1-1.el7.src.rpm
写道:/root/openssh-rpms-main/el7/RPMS/x86_64/openssh-9.8p1-1.el7.x86_64.rpm
写道:/root/openssh-rpms-main/el7/RPMS/x86_64/openssh-clients-9.8p1-1.el7.x86_64.rpm
写道:/root/openssh-rpms-main/el7/RPMS/x86_64/openssh-server-9.8p1-1.el7.x86_64.rpm
写道:/root/openssh-rpms-main/el7/RPMS/x86_64/openssh-debuginfo-9.8p1-1.el7.x86_64.rpm
执行(%clean): /bin/sh -e /var/tmp/rpm-tmp.GHFx0p
+ umask 022
+ cd /root/openssh-rpms-main/el7/BUILD
+ cd openssh-9.8p1
+ rm -rf /root/openssh-rpms-main/el7/BUILDROOT/openssh-9.8p1-1.el7.x86_64
+ exit 0
~/openssh-rpms-main
# ll /root/openssh-rpms-main/el7/RPMS/x86_64/
总用量 15408
-rw-r--r--. 1 root root 5150056 9月 3 21:44 openssh-9.8p1-1.el7.x86_64.rpm
-rw-r--r--. 1 root root 5179640 9月 3 21:45 openssh-clients-9.8p1-1.el7.x86_64.rpm
-rw-r--r--. 1 root root 3911916 9月 3 21:45 openssh-debuginfo-9.8p1-1.el7.x86_64.rpm
-rw-r--r--. 1 root root 1527088 9月 3 21:45 openssh-server-9.8p1-1.el7.x86_64.rpm
# yum -y localinstall /root/openssh-rpms-main/el7/RPMS/x86_64/*.rpm
# systemctl restart sshd
Job for sshd.service failed because the control process exited with error code. See "systemctl status sshd.service" and "journalctl -xe" for details.
# systemctl status sshd
sshd.service - SYSV: OpenSSH server daemon
Loaded: loaded (/etc/rc.d/init.d/sshd; bad; vendor preset: enabled)
Active: failed (Result: exit-code) since 日 2023-09-03 21:47:05 CST; 9s ago
Docs: man:systemd-sysv-generator(8)
Process: 85319 ExecStop=/etc/rc.d/init.d/sshd stop (code=exited, status=0/SUCCESS)
Process: 85344 ExecStart=/etc/rc.d/init.d/sshd start (code=exited, status=1/FAILURE)
Main PID: 1079 (code=exited, status=0/SUCCESS)
9月 03 21:47:05 localhost.localdomain sshd[85344]: @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
9月 03 21:47:05 localhost.localdomain sshd[85344]: Permissions 0640 for '/etc/ssh/ssh_host_ed25519_key' are too open.
9月 03 21:47:05 localhost.localdomain sshd[85344]: It is required that your private key files are NOT accessible by others.
9月 03 21:47:05 localhost.localdomain sshd[85344]: This private key will be ignored.
9月 03 21:47:05 localhost.localdomain sshd[85344]: sshd: no hostkeys available -- exiting.
9月 03 21:47:05 localhost.localdomain sshd[85344]: [失败]
9月 03 21:47:05 localhost.localdomain systemd[1]: sshd.service: control process exited, code=exited status=1
9月 03 21:47:05 localhost.localdomain systemd[1]: Failed to start SYSV: OpenSSH server daemon.
9月 03 21:47:05 localhost.localdomain systemd[1]: Unit sshd.service entered failed state.
9月 03 21:47:05 localhost.localdomain systemd[1]: sshd.service failed.
# chmod 400 /etc/ssh/*key
# systemctl restart sshd
# systemctl status sshd
# systemctl status sshd
sshd.service - SYSV: OpenSSH server daemon
Loaded: loaded (/etc/rc.d/init.d/sshd; bad; vendor preset: enabled)
Active: active (running) since 日 2023-09-03 21:47:46 CST; 6s ago
Docs: man:systemd-sysv-generator(8)
Process: 85319 ExecStop=/etc/rc.d/init.d/sshd stop (code=exited, status=0/SUCCESS)
Process: 85364 ExecStart=/etc/rc.d/init.d/sshd start (code=exited, status=0/SUCCESS)
Main PID: 85372 (sshd)
Tasks: 1
Memory: 772.0K
CGroup: /system.slice/sshd.service
└─85372 sshd: /usr/sbin/sshd [listener] 0 of 10-100 startups
9月 03 21:47:46 localhost.localdomain systemd[1]: Starting SYSV: OpenSSH server daemon...
9月 03 21:47:46 localhost.localdomain sshd[85364]: /sbin/restorecon: lstat(/etc/ssh/ssh_host_dsa_key.pub) failed: No such file or directory
9月 03 21:47:46 localhost.localdomain sshd[85364]: Starting sshd:[ 确定 ]
9月 03 21:47:46 localhost.localdomain sshd[85372]: Server listening on 0.0.0.0 port 22.
9月 03 21:47:46 localhost.localdomain sshd[85372]: Server listening on :: port 22.
9月 03 21:47:46 localhost.localdomain systemd[1]: Can't open PID file /var/run/sshd.pid (yet?) after start: No such file or directory
9月 03 21:47:46 localhost.localdomain systemd[1]: Started SYSV: OpenSSH server daemon.
OpenSSH 从 7.0 后开始对于version 1.x 就不支持了，相应的RSA1算法也不再支持了
编译OpenSSH 源码的时候也不会在/etc/ssh目录下面生成ssh_host_key/ssh_host_key.pub
http://www.openssh.com/txt/release-6.9
将 /sbin/restorecon /etc/ssh/ssh_host_dsa_key.pub 行注释掉
# sed -i '/ssh_host_dsa_key.pub/s/^/#/' /etc/init.d/sshd
# systemctl daemon-reload
# systemctl restart sshd
# systemctl status sshd
sshd.service - SYSV: OpenSSH server daemon
Loaded: loaded (/etc/rc.d/init.d/sshd; bad; vendor preset: enabled)
Active: active (running) since 日 2023-09-03 21:51:03 CST; 2s ago
Docs: man:systemd-sysv-generator(8)
Process: 85457 ExecStop=/etc/rc.d/init.d/sshd stop (code=exited, status=0/SUCCESS)
Process: 85464 ExecStart=/etc/rc.d/init.d/sshd start (code=exited, status=0/SUCCESS)
Main PID: 85471 (sshd)
Tasks: 1
Memory: 788.0K
CGroup: /system.slice/sshd.service
└─85471 sshd: /usr/sbin/sshd [listener] 0 of 10-100 startups
9月 03 21:51:03 localhost.localdomain systemd[1]: Starting SYSV: OpenSSH server daemon...
9月 03 21:51:03 localhost.localdomain sshd[85471]: Server listening on 0.0.0.0 port 22.
9月 03 21:51:03 localhost.localdomain sshd[85471]: Server listening on :: port 22.
9月 03 21:51:03 localhost.localdomain sshd[85464]: Starting sshd:[ 确定 ]
9月 03 21:51:03 localhost.localdomain systemd[1]: Started SYSV: OpenSSH server daemon.
# ssh -V
OpenSSH_9.8p1, OpenSSL 1.1.1w 1 Aug 2023
# sshd -V
OpenSSH_9.4, OpenSSL 1.1.1w 1 Aug 2023
# rpm -qa | grep openssh
openssh-9.8p1-1.el7.x86_64
openssh-clients-9.8p1-1.el7.x86_64
openssh-debuginfo-9.8p1-1.el7.x86_64
openssh-server-9.8p1-1.el7.x86_64
# mkdir install_openssh-9.8p1
# cd install_openssh-9.8p1
# cp /root/openssh-rpms-main//el7/BUILD/openssh-9.8p1/contrib/ssh-copy-id ./
# cp /root/openssh-rpms-main/el7/RPMS/x86_64/* ./
cat install_openssh-9.8p1.sh
#!/bin/bash
if ! yum -y localinstall *.rpm ; then
echo "OpenSSH rpm 安装失败！"
exit 1
fi
chmod 400 /etc/ssh/ssh_host_*_key
cp ssh-copy-id /usr/bin/
chmod 755 /usr/bin/ssh-copy-id
sed -i '/ssh_host_dsa_key.pub/s/^/#/' /etc/init.d/sshd
systemctl daemon-reload
systemctl restart sshd
systemctl enable sshd
systemctl status sshd
rpm -qa | grep openssh
ssh -V
参考
如何编译打包OpenSSH 9.4并实现批量升级
https://mp.weixin.qq.com/s/XHyHJjwnO4P2XO5WUS4Ehw
CentOS7下快速升级至OpenSSH9.8p1安全版本
https://mp.weixin.qq.com/s/HokRwGqzK6uiSgCId3E0QA
OpenSSH重启，/sbin/restorecon:lstat(/etc/ssh/ssh_host_key.pub) failed报错
https://blog.51cto.com/kk876435928/1737597
sed 在行首或者行尾添加文本
https://blog.csdn.net/w2909526/article/details/102587577
