Test on CentOS release 6.8 (Final) using root user
by 司空琦爷
一、制作RPM安装包
1）依赖安装
yum install rpm-build gcc make wget openssl-devel krb5-devel pam-devel libX11-devel xmkmf libXt-devel
2）目录创建
mkdir -p /usr/src/redhat/{SOURCES,SPECS}
cd /usr/src/redhat/SOURCES/
3）安装文件下载
wget https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/openssh-7.9.tar.gz
wget https://src.fedoraproject.org/repo/pkgs/openssh/x11-ssh-askpass-1.2.4.1.tar.gz/8f2e41f3f7eaa8543a2440454637f3c3/x11-ssh-askpass-1.2.4.1.tar.gz
4）解压编译文件
cd /usr/src/redhat/SOURCES/
tar xfz openssh-7.9p1.tar.gz openssh-7.9p1/contrib/redhat/openssh.spec
mv openssh-7.9p1/contrib/redhat/openssh.spec ../SPECS/
chown sshd:sshd /usr/src/redhat/SPECS/openssh.spec
cp /usr/src/redhat/SPECS/openssh.spec /usr/src/redhat/SPECS/openssh.spec_bak
5) 修改几个配置选项
#关掉no_gnome_askpass no_x11_askpass这两个参数
sed -i -e "s/%define no_gnome_askpass 0/%define no_gnome_askpass 1/g" /usr/src/redhat/SPECS/openssh.spec
sed -i -e "s/%define no_x11_askpass 0/%define no_x11_askpass 1/g" /usr/src/redhat/SPECS/openssh.spec
#查看修改了哪些参数
diff openssh.spec openssh.spec_bak
6）拷贝安装软件到预编译目录
mkdir -pv /root/rpmbuild/SOURCES/
cp /usr/src/redhat/SOURCES/openssh-7.9p1.tar.gz /root/rpmbuild/SOURCES/
cp /usrsrc/redhat/SOURCES/x11-ssh-askpass-1.2.4.1.tar.gz /root/rpmbuild/SOURCES/
#执行编译操作
cd /usr/src/redhat/SPECS/
rpmbuild -ba openssh.spec
#编译后生成的目录结构如下
tree -L 2 /root/rpmbuild/
/root/rpmbuild/
├── BUILD
│ └── openssh-7.9p1
├── BUILDROOT
├── RPMS
│ └── x86_64
├── SOURCES
│ ├── openssh-7.9p1.tar.gz
│ └── x11-ssh-askpass-1.2.4.1.tar.gz
├── SPECS
└── SRPMS
└── openssh-7.9p1-1.el6.src.rpm
#编译后RPM包目录
/root/rpmbuild/RPMS/x86_64/openssh-7.9p1-1.el6.x86_64.rpm
/root/rpmbuild/RPMS/x86_64/openssh-clients-7.9p1-1.el6.x86_64.rpm
/root/rpmbuild/RPMS/x86_64/openssh-debuginfo-7.9p1-1.el6.x86_64.rpm
/root/rpmbuild/RPMS/x86_64/openssh-server-7.9p1-1.el6.x86_64.rpm
#取出供其他机器安装的RPM包
mkdir -pv /root/openssh7.9
cp /root/rpmbuild/RPMS/x86_64/{openssh-7.9p1-1.el6.x86_64.rpm,openssh-clients-7.9p1-1.el6.x86_64.rpm,openssh-server-7.9p1-1.el6.x86_64.rpm} /root/openssh7.9
6）自己打的rpm包下载地址，懒人可以直接下，centos6的！centos6的！centos6的！7别装！
https://pan.baidu.com/s/1UNete3cn9tX5taQt30qnwg
二、利用RPM安装包，升级openssh至7.9
1）查看系统已openssh安装包版本
#如果曾经有手动编译安装，未必能查到信息
rpm -qa|grep openssh*
2）查看查看已安装老rpm包和待安装新rpm版本有哪些文件
cd openssh新版rpm包的目录
rpm -ql openssh-???.???p1
rpm -qpl openssh-7.9p1-1.el6.x86_64.rpm
rpm -ql openssh-clients-???.???p1
rpm -qpl openssh-clients-7.9p1-1.el6.x86_64.rpm
rpm -ql openssh-server-???.???p1
rpm -qpl openssh-server-7.9p1-1.el6.x86_64.rpm
3）选择性备份一些配置
#备份原有的openssh服务
mkdir -pv /root/oppenssh_backup
cd /root/oppenssh_backup
tar -cvzf etc_ssh.tar.gz /etc/ssh
tar -cvzf etc_pamd.tar.gz /etc/pam.d
cp /etc/pam.d/sshd /etc/pam.d/system-auth .
cp -p /etc/pam.d/sshd /etc/pam.d/sshd_`date +%Y%m%d`
cp -p /etc/pam.d/system-auth /etc/pam.d/system-auth_`date +%Y%m%d`
一般来说rpm包安装时遇到存在的同名配置文件，不会覆盖。会把生成的同名文件重命名为filename.rpmnew
4）升级安装RPM
可能会由于各种原因爆炸，建议多开几个ssh窗口，保险起见可以也安装telnet并测试连接，保底当openssh配置错误，服务器不会失联
cd openssh新版rpm包的目录
rpm -Uvh ./*.rpm
5）按需修改配置文件
检查/etc/pam.d/sshd /etc/pam.d/system-auth /etc/ssh/sshd.conf等是否保持升级之前的配置，若被修改，就备份一下新生成的配置文件，再利用之前备份的文件把配置文件替换回升级前的配置。
6）重启sshd服务
#CentOS 6
service sshd restart
#CentOS 7
#systemctl restart sshd
7）重新连接查看版本
ssh -V
