Backport OpenSSH RPM / SRPM for CentOS

A simple script to backport latest OpenSSH RPMs for CentOS/RHEL (like) distros.

Supported (tested) Distro:

CentOS 5/6/7/8/Stream 8/9
Amazon Linux 1/2/2023
UnionTech OS Server 20
openEuler 22.03 (LTS-SP1)
AnolisOS 7.9/8.6
Rocky Linux 8/9

Current Version:

OpenSSH 10.2p1 (see: OpenSSH Official)
OpenSSL 3.0.18 / 3.0.9 (see: OpenSSL Official)

The build script reads version.env for actual version definitions.

OpenSSL is not needed when using WITH_OPENSSL=0. (see version.env)

Build Requirements:

yum groupinstall -y "Development Tools"
yum install -y imake rpm-build pam-devel krb5-devel zlib-devel libXt-devel libX11-devel gtk2-devel perl perl-IPC-Cmd perl-Time-Piece

# For CentOS5 only:
yum install -y gcc44

Usage

Build RPMs

Note: It is not necessary to build on every system that needs the latest version of OpenSSH, as most RPM-based Linux distributions are glibc compatible with each other. That is, RPMs built on CentOS can be installed and run on Rocky Linux 8/AlmaLinux/Oracle Linux 8, etc.

Install build requirements listed above.
Edit version.env file if necessary.
Download source packages.
```
./pullsrc.sh
```
if any error comes up, manually download the source files into the downloads dir.
Run the script to build RPMs.
```
./compile.sh
```

Install RPMs

# Go to the generated RPMS directory.
cd $(./compile.sh RPMDIR)
pwd
ls
# you will find multiple RPM files in this directory.
# you may copy them to other machines, and continue following steps there.

# Backup current SSH config
[[ -f /etc/ssh/sshd_config ]] && mv /etc/ssh/sshd_config /etc/ssh/sshd_config.$(date +%Y%m%d)

# Install rpm packages.
sudo yum --disablerepo=* localinstall -y ./openssh*.rpm

# In case host key file permissions are too open.
chmod -v 600 /etc/ssh/ssh_host_*_key

# For CentOS7+:
# In some cases, the previously installed systemd unit file is left on disk after an upgrade,
# causing systemd to mix unit files and initscripts units provided by this package.
if [[ -d /run/systemd/system && -f /usr/lib/systemd/system/sshd.service ]]; then
    mv /usr/lib/systemd/system/sshd.service /usr/lib/systemd/system/sshd.service.$(date +%Y%m%d)
    systemctl daemon-reload
fi

# Check Installed version:
ssh -V && /usr/sbin/sshd -V

# Restart service
sudo service sshd restart

# Test a new ssh connection
ssh localhost

DO NOT DISCONNECET current ssh shell yet, open a NEW shell and login to you machine to verify that sshd is working properly.

Trouble shooting

You may get complains during the yum localinstall process. It's mostly because some subpackages depend on the main openssh package, upgrading only the main package won't fit in their dependencies.

Commonly these packages are needed to be erased before installing built RPMs.

yum erase openssh-askpass openssh-keycat openssh-cavs openssh-askpass openssh-askpass-gnome openssh-debuginfo

If still not satisfied, you may try the final weapon: FORCED INSTALL.

rpm -ivh --force --nodeps --replacepkgs --replacefiles openssh-*.rpm

Use Docker

TL;DR

# Define output directory
OUTPUT="/tmp/openssh-rpms"
# Specify build os and versions
declare -A MAPPING
MAPPING["centos-stream9"]="el7"
MAPPING["centos-stream8"]="el7"
MAPPING["centos7"]="el7"
MAPPING["centos6"]="el6"
MAPPING["centos5"]="el5"

for VERSION in "${!MAPPING[@]}";
do
  DIST=${MAPPING[$VERSION]}
  echo "Create for OS: ${VERSION}"
  mkdir -p $OUTPUT/$VERSION
  # Run the builder container
  docker run -it --rm \
             -v $OUTPUT/$VERSION:/data/$DIST/RPMS \
             chowrex/openssh-rpms:$VERSION
done

For more details, see file docker.README.md

Security Notes

This package provide following options in /etc/ssh/sshd_config to work like triditional sshd.

Note: when built with WITH_OPENSSL=0, ssh-rsa is not supported.

PubkeyAcceptedAlgorithms +ssh-rsa
PermitRootLogin yes
PasswordAuthentication yes
UseDNS no
UsePAM yes
KexAlgorithms -diffie-hellman-group1-sha1,diffie-hellman-group1-sha256,diffie-hellman-group14-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha256,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha512

4.6 KiB Raw Blame History