fanhuadesenlinnn/openssh-rpms

Fork 0

mirror of https://hubproxy.babadafafafafa.cn/https://github.com/boypt/openssh-rpms.git synced 2026-09-20 08:03:38 +08:00

Files

ChowRex f0b2bf7905 Important Version Updates (#19 )

* Important Version Updates
- Add dockerfile support for centos 8 series.
- Modify Dockerfile.centos to add CentOS 8 support and fix the problem of CentOS 5 series not being able to build.
- Modify modify_yum_source.sh to add CentOS 8 support and fix CentOS 5 series yum source problem.

* Update CentOS Stream support                                                                           INT ✘  base 
- Changed compile.sh to add support for CentOS Stream 8/9 series.
- Modified docker.README.md to add Stream series description.
- Modified Dockerfile.amazonlinux to add cleanup operations and reduce image size.
- Modify Dockerfile.centos, add cleanup operation, reduce image size
- Added Dockerfile.centos-stream to support Stream series build images.
- Added modify_dnf_source.pl to add Stream series yum source modification function.
- Modified README.md to add Stream series test pass information and correct formatting and word spelling errors.

---------

Co-authored-by: Rex Zhou <zhouruixi@goldwind.com>

2024-06-04 17:01:06 +08:00

3.6 KiB

Raw Blame History

Backport OpenSSH RPM / SRPM for old CentOS

A simple script to build latest OpenSSH backport RPMs for older CentOS/RHEL distros.

Supported (tested) Distro:

CentOS 5/6/7/8/Stream 8/9
Amazon Linux 1/2/2023
UnionTech OS Server 20
openEuler 22.03 (LTS-SP1)
AnolisOS 7.9/8.6

Current Version:

OpenSSH 9.7p1 (see: OpenSSH Official)
OpenSSL 3.0.13 / 3.0.9 (FIPS validated, see: OpenSSL Official)

The build script reads version.env for actual version definitions.

Build Requirements:

yum groupinstall -y "Development Tools"
yum install -y imake rpm-build pam-devel krb5-devel zlib-devel libXt-devel libX11-devel gtk2-devel perl perl-IPC-Cmd

# For CentOS5 only:
yum install -y gcc44

Usage

Build RPMs

Install build requirements listed above.
Edit version.env file if necessary.
Download source packages.
```
./pullsrc.sh
```
if any error comes up, manually download the source files into the downloads dir.
Run the script to build RPMs.
```
./compile.sh
```

Install RPMs

# Go go the generated RPMS directory.
cd $(./compile.sh RPMDIR)
pwd
ls
# you will find multiple RPM files in this directory.
# you may copy them to other machines, and continue following steps there.

# Backup current SSH config
[[ -f /etc/ssh/sshd_config ]] && mv /etc/ssh/sshd_config /etc/ssh/sshd_config.$(date +%Y%m%d)

# Install rpm packages. Exclude all debug packages.
find . ! -name '*debug*' -name '*.rpm' | xargs sudo yum --disablerepo=* localinstall -y

# in case host key files got permissions too open.
chmod -v 600 /etc/ssh/ssh_host_*_key

# For CentOS7+:
# in some cases previously installed systemd unit file is left on disk after upgrade.
# causes systemd mixing unit files and initscripts units provided by this package.
if [[ -d /run/systemd/system && -f /usr/lib/systemd/system/sshd.service ]]; then
    mv /usr/lib/systemd/system/sshd.service /usr/lib/systemd/system/sshd.service.$(date +%Y%m%d)
    systemctl daemon-reload
fi

# Check Installed version:
ssh -V && /usr/sbin/sshd -V

# Restart service
service sshd restart

DO NOT DISCONNECET current ssh shell yet, open a NEW shell and login to you machine to verify that sshd is working properly.

Trouble shoot

You may get complains during the yum localinstall process. It's mostly because some subpackages depend on the main openssh package, upgrading only the main package won't fit in their dependencies.

Commonly these packages are needed to be erased before installing built RPMs.

yum erase openssh-askpass openssh-keycat openssh-cavs openssh-askpass openssh-askpass-gnome openssh-debuginfo

If still not satisfied, you may try the final wepon: FORCED INSTALL.

rpm -ivh --force --nodeps --replacepkgs --replacefiles openssh-*.rpm

Use Docker

See file docker.README.md

Security Notes

This package provide following options in /etc/ssh/sshd_config to work like triditional sshd.

PubkeyAcceptedAlgorithms +ssh-rsa
PermitRootLogin yes
PasswordAuthentication yes
UseDNS no
UsePAM yes
KexAlgorithms -diffie-hellman-group1-sha1,diffie-hellman-group1-sha256,diffie-hellman-group14-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha256,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha512

3.6 KiB Raw Blame History