update_openssh

#!/bin/bash ################################################################# ###### update openssl openssh scirpt ######### ##### Author:Lixw ##### ###### Date:2020/09/27 ##### ###### LastModified:2020/09/27 ####### #### Warning:start telnet service before use the script ##### ################################################################# #################################################################################### # update openssh and openssl ######### ##### ## #################################################################################### #Determine whether the current system installed gcc compiler tools # Test list # RedHat5,RedHat6,RedHat7,CentOS5,CentOS6,CentOS7 install_dir=`pwd` zlib_version="zlib-1.2.11" openssl_version="openssl-1.1.1h" openssh_version="openssh-8.4p1" #gcc_path=`which gcc` #gcc_name=`basename $gcc_path` DATE=$(date +%Y%m%d) if ! rpm -qa|egrep 'which|util-linux' &> /dev/null || ! rpm -qa|grep util-linux &> /dev/null; then echo "which is not installed" && exit fi #ADD USER USER_COUNT=`cat /etc/passwd | grep '^lixw:' -c` USER_NAME='lixw' if [ $USER_COUNT -ne 1 ] then useradd $USER_NAME echo "Wisedu@123" | passwd $USER_NAME --stdin else echo 'user exits' exit fi # OS TYPE #Distributor_ID=$(lsb_release -i) # OS Version OSVersion='cat /etc/redhat-release |cut -d'.' -f1' if which lsb_release &> /dev/null; then Distributor=`lsb_release -i|cut -c 17-` else echo "starting install redhat-lsb" if [ "$OSVersion" != "CentOS Linux release 7" ];then rpm -Uvh ${install_dir}/centos7_lsb/*.rpm --nodeps --force Distributor=`lsb_release -i|cut -c 17-` else rpm -Uvh ${install_dir}/redhat7_lsb/*.rpm --nodeps --force Distributor=`lsb_release -i|cut -c 17-` fi fi Distributor_VE=$(lsb_release -a|grep Release|tr -cd '[0-9.]'|cut -d'.' -f1) # Determine whether the root user userid=`id -u` if [ "$userid" -ne 0 ]; then echo "sorry,only root can execute the script. " exit fi # SET SELINUX=disabled if [ "$Distributor" != "SUSE LINUX" ]; then sed -i '/SELINUX/s/enforcing/disabled/' /etc/selinux/config setenforce 0 # pam-devel,tcp_wrappers-devel need be installed, Otherwise, the software will install failure # Support for tcpwrappers/libwrap has been removed in openssh6.7 if ! rpm -qa|grep pam-devel &>/dev/null; then echo "pam-devel is not installed && starting install" rpm -ivh ${install_dir}/other/pam-devel-1.1.1-24.el6.x86_64.rpm --nodeps fi fi # Check whether to open the xinetd service if ! rpm -qa|grep xinetd &>/dev/null; then echo "xinetd is not running && starting install" rpm -ivh ${install_dir}/other/xinetd-2.3.14-39.el6_4.x86_64.rpm fi # Check whether to open the telnet service if ! rpm -qa|grep telnet-server &>/dev/null; then echo "telnet service is not running && starting install" rpm -ivh ${install_dir}/other/telnet-server-0.17-47.el6_3.1.x86_64.rpm fi # SET TELNET=ENABLE sed -i '/disable/s/yes/no/' /etc/xinetd.d/telnet service xinetd restart chkconfig xinetd on # Determine whether to install gcc package if which gcc &> /dev/null; then echo "gcc is installed----------------[yes]" else echo "gcc is not installed && starting install" if (("$Distributor_VE" == "7")) ; then rpm -Uvh ${install_dir}/gcc_os7/*.rpm --nodeps --force else rpm -Uvh ${install_dir}/gcc_os56/*.rpm --nodeps --force fi fi # stop sshd service netstat -tnlp | grep -w 22 RETVAL4=$? if [ $RETVAL4 -eq 0 ]; then service sshd stop echo "stop sshd service --------------[yes]" fi if [ -e /etc/init.d/sshd ]; then cp /etc/init.d/sshd /root fi # remove openssh*.rpm if exists if rpm -qa | grep openssh &> /dev/null; then rpm -qa | grep openssh > openssh_list.txt while read line do rpm -e $line --nodeps echo "remove $line success------------[yes]" done < openssh_list.txt fi echo "###########install zlib ##################" tar -zxvf "${install_dir}/zlib/${zlib_version}.tar.gz" > /dev/null cd $zlib_version ./configure --prefix=/usr/local/zlib-1.2.11 --shared RETVAL5=$? if [ $RETVAL5 -ne 0 ]; then echo "Configure zlib has encountered an error" exit fi make RETVAL6=$? if [ $RETVAL6 -ne 0 ]; then echo "make zlib has encountered an error" exit fi make install echo \/usr/local/zlib-1.2.11/lib\ >>/etc/ld.so.conf ldconfig -v | grep zlib echo "#########################################################" echo "################ #################" echo "################ zlib install success #################" echo "################ #################" echo "#########################################################" sleep 2 echo "############### install openssl ###############" tar -zxvf "${install_dir}/openssl/${openssl_version}.tar.gz" > /dev/null cd $openssl_version ./config shared zlib-dynamic --prefix=/usr/local/openssl-1.1.1h --with-zlib-lib=/usr/local/zlib-1.2.11/lib --with-zlib-include=/usr/local/zlib-1.2.11/include RETVAL7=$? if [ $RETVAL7 -ne 0 ]; then echo "Configure openssl has encountered an error" exit fi make RETVAL8=$? if [ $RETVAL8 -ne 0 ]; then echo "make openssl has encountered an error" exit fi make install if [ -e /usr/bin/openssl ]; then mv /usr/bin/openssl /usr/bin/openssl.OFF && ln -s /usr/local/ssl/bin/openssl /usr/bin/openssl else ln -s /usr/local/ssl/bin/openssl /usr/bin/openssl fi if [ -e /usr/include/openssl ]; then mv /usr/include/openssl /usr/include/openssl.OFF && ln -s /usr/local/ssl/include/openssl /usr/include/openssl else ln -s /usr/local/ssl/include/openssl /usr/include/openssl fi ## Add "/usr/local/ssl/lib" to /etc/ld.so.conf ssl_lib=`grep -w "/usr/local/openssl-1.1.1h/lib" /etc/ld.so.conf` if [ ! -e "$ssl_lib" ]; then echo \/usr/local/openssl-1.1.1h/lib\ >>/etc/ld.so.conf fi ldconfig -v |grep openssl echo "#########################################################" echo "################ #################" echo "################ openssl install sucess ################" echo "################ #################" echo "#########################################################" sleep 2 echo "############### install openssh ################" if [ -e /etc/ssh ]; then mv /etc/ssh /etc/ssh_$DATE fi tar -zxvf "${install_dir}/openssh/${openssh_version}.tar.gz" > /dev/null cd $openssh_version if [ "$Distributor" != "SUSE LINUX" ]; then ./configure --prefix=/usr --sysconfdir=/etc/ssh --with-pam --with-ssl-dir=/usr/local/openssl-1.1.1h --with-md5-passwords --mandir=/usr/share/man --with-zlib=/usr/local/zlib-1.2.11 --without-openssl-header-check else ./configure --prefix=/usr --sysconfdir=/etc/ssh --with-ssl-dir=/usr/local/openssl-1.1.1h --with-md5-passwords --mandir=/usr/share/man --with-zlib=/usr/local/zlib-1.2.11 --without-openssl-header-check fi RETVAL9=$? if [ $RETVAL9 -ne 0 ]; then echo "Configure openssh has encountered an error" exit fi make RETVAL10=$? if [ $RETVAL10 -ne 0 -a $RETVAL10 -ne 0 ]; then echo "make openssh has encountered an error" exit fi make install if [ "$Distributor" == "SUSE LINUX" ]; then cd contrib/suse cp rc.sshd /etc/init.d/sshd chmod +x /etc/init.d/sshd chkconfig --add sshd else cd contrib/redhat cp sshd.init /etc/init.d/sshd chmod +x /etc/init.d/sshd chkconfig --add sshd fi #A generic PAM configuration is included as "contrib/sshd.pam.generic", #you may need to edit it before using it on your system. cd .. if [ "$Distributor" != "SUSE LINUX" ]; then cp sshd.pam.generic /etc/pam.d/sshd sed -i 's/\/lib\/security\///g' /etc/pam.d/sshd fi # Modify /etc/ssh/sshd_config # Backup /etc/ssh/sshd_config cp -p /etc/ssh/sshd_config