实操——修复OpenSSH远程代码执行漏洞

文章目录说明修复步骤1.安装telnet服务2.升级openssh2.1 **开始安装openssl****2.2 安装openssh**说明首先openssh漏洞需要升级openssh所以在升级过程中我们是无法用ssh连接过去的所以我们需要先安装telnet 来进行连接。参考文章https://www.cnblogs.com/nmap/p/10779658.html修复步骤1.安装telnet服务给需要修复的系统安装telnet服务方便在ssh不能用的时候连接安装telnet-server以及xinetd[rootlinux-node3 ~]# yum install xinetd telnet-server -yLoaded plugins: fastestmirror Loading mirror speeds from cached hostfile * base: mirrors.163.com * epel: mirrors.aliyun.com * extras: mirrors.cn99.com * updates: mirrors.cn99.com Package2:xinetd-2.3.15-13.el7.x86_64 already installed and latest version Package1:telnet-server-0.17-64.el7.x86_64 already installed and latest version Nothing todo配置telnet现在很多centos7版本安装telnet-server以及xinetd之后没有一个叫telnet的配置文件了。如果下面telnet文件不存在的话可以跳过这部分的更改[rootlinux-node3 ~]# ll /etc/xinetd.d/telnetls: cannot access /etc/xinetd.d/telnet: No suchfileor directory如果下面文件存在请更改配置telnet可以root登录设置disable no[rootrhel yum.repos.d]# cat /etc/xinetd.d/telnet# default: on# description: The telnet server serves telnet sessions; it uses \# unencrypted username/password pairs for authentication.servicetelnet{disableno flagsREUSE socket_typestreamwaitno userroot server/usr/sbin/in.telnetd log_on_failureUSERID}[rootrhel yum.repos.d]# vim /etc/xinetd.d/telnet配置telnet登录的终端类型在/etc/securetty文件末尾增加一些pts终端如下 ***如果不加会登录不了[rootlinux-node3 ~]# vim /etc/securetty#文件末尾增加一些pts终端pts/0 pts/1 pts/2 pts/3[rootlinux-node3 ~]# tail -5 /etc/securettyxvc0 pts/0 pts/1 pts/2 pts/3启动telnet服务并设置开机自动启动#查看是否已安装了xinetdrpm-qaxinetd#安装xinetd然后启动)yum-yinstallxinetd#(启动xinetd守护进程,如有unit not found 说明xinetd未安装)或者 /etc/init.d/xinetd restartservicexinetd start centos6执行# iptables防火墙会阻止telnet所以需要在iptables允许用如下命令# 当你启动telnet服务后你可以用netstat –tunlp命令来查看telnet服务所使用的端口可以发现有23。使用下面命令开启这些端口:serviceiptables stop# //关闭防火墙# 开放23访问端口 ---telnet的默认端口iptables-IINPUT-ptcp--dport23-jACCEPTiptables-IINPUT-pudp--dport23-jACCEPT#保存serviceiptables save#重启防火墙serviceiptables start# 或者来点狠的直接关闭防火墙!serviceiptables stop centos7执行# 重启防火墙servicefirewalld start#添加防火墙firewall-cmd--permanent--add-port23/tcp firewall-cmd--permanent--add-port23/udp#重启防火墙(修改配置后要重启防火墙)firewall-cmd--reload# 重启防火墙servicefirewalld restart#查看防火墙规则firewall-cmd --list-all[rootlinux-node3 ~]# systemctl enable xinetd[rootlinux-node3 ~]# systemctl enable telnet.socketCreated symlink from /etc/systemd/system/sockets.target.wants/telnet.socket to /usr/lib/systemd/system/telnet.socket.[rootlinux-node3 ~]# systemctl start telnet.socket[rootlinux-node3 ~]# systemctl start xinetdsystemctlenablexinetd systemctlenabletelnet.socket systemctl start telnet.socket systemctl start xinetd[rootlinux-node3 ~]# netstat -lntp|grep 23tcp600:::23 :::* LISTEN1/systemd切换到telnet方式登录以后的操作都在telnet终端下操作防止ssh连接意外中断造成升级失败telnet方式登录 也可用其他机器直接 telnet XXX.XXX.XXX.XX ,然后输入用户名和密码登录telnet使用root登陆报“Login incorrect”应该修改/etc/pam.d/下的remote文件第一行[root pam.d]#cd/etc/pam.d/catremote#%PAM-1.0auth required pam_securetty.so 把第一行给注释掉再试试[root pam.d]# cat remote#%PAM-1.0#auth required pam_securetty.so2.升级openssh2.1开始安装openssl安装依赖包升级需要几个组件有些是和编译相关的等[rootlinux-node3 ~]# yum install -y gcc gcc-c glibc make autoconf openssl openssl-devel pcre-devel pam-develLoaded plugins: fastestmirror Loading mirror speeds from cached hostfile * base: mirrors.163.com * epel: mirrors.aliyun.com * extras: mirrors.cn99.com * updates: mirrors.cn99.com Package gcc-4.8.5-36.el7_6.1.x86_64 already installed and latest version Package gcc-c-4.8.5-36.el7_6.1.x86_64 already installed and latest version Package glibc-2.17-260.el7_6.4.x86_64 already installed and latest version Package1:make-3.82-23.el7.x86_64 already installed and latest version Package autoconf-2.69-11.el7.noarch already installed and latest version Package1:openssl-1.0.2k-16.el7_6.1.x86_64 already installed and latest version Package1:openssl-devel-1.0.2k-16.el7_6.1.x86_64 already installed and latest version Package pcre-devel-8.32-17.el7.x86_64 already installed and latest version Package pam-devel-1.1.8-22.el7.x86_64 already installed and latest version Nothing todo安装pam和zlib等后面的升级操作可能没用到pam安装上也没啥影响如果不想安装pam请自行测试[rootlinux-node3 ~]# yum install -y pam* zlib*下载openssh包和openssl的包下载最新版本下载箭头指的包OpenSSH: Portable ReleaseIndex of /pub/OpenBSD/OpenSSH/portable/ (edgecast.com)https://ftp.openssl.org/source/开始安装openssl个人习惯把安装包或者工具之类的放下面目录。根据个人喜好随便放不影响安装yum-yinstallzlib yum-yinstallgcc pam-devel zlib-devel yum-yinstallgcc openssl-devel[rootlinux-node3 ~]# mkdir /opt/tools -p[rootlinux-node3 ~]# cd /opt/tools/[rootlinux-node3 /data/tools]# lltotal5224-rw-r--r--1root root5348369Apr2712:19 openssl-1.0.2r.tar.gz#解压文件 文件名按实际文件写[rootlinux-node3 /data/tools]# tar -zxvf openssl-1.0.2r.tar.gz[rootlinux-node3 /data/tools]# lltotal5228drwxr-xr-x20root root4096Apr2712:20 openssl-1.0.2r -rw-r--r--1root root5348369Apr2712:19 openssl-1.0.2r.tar.gz[rootlinux-node3 /data/tools]# cd[rootlinux-node3 ~]## 现在是系统默认的版本等会升级完毕对比下[rootlinux-node3 ~]# openssl versionOpenSSL1.0.2k-fips26Jan2017[rootlinux-node3 ~]#备份下面2个文件或目录如果存在的话就执行[rootlinux-node3 ~]# ll /usr/bin/openssl-rwxr-xr-x1root root555248Mar1218:12 /usr/bin/openssl[rootlinux-node3 ~]# mv /usr/bin/openssl /usr/bin/openssl_bak[rootlinux-node3 ~]# ll /usr/include/openssltotal1864-rw-r--r--1root root6146Mar1218:12 aes.h -rw-r--r--1root root63204Mar1218:12 asn1.h -rw-r--r--1root root24435Mar1218:12 asn1_mac.h -rw-r--r--1root root34475Mar1218:12 asn1t.h -rw-r--r--1root root38742Mar1218:12 bio.h -rw-r--r--1root root5351Mar1218:12 blowfish.h......[rootlinux-node3 ~]# mv /usr/include/openssl /usr/include/openssl_bak[rootlinux-node3 ~]#编译安装新版本的openssl配置、编译、安装3个命令一起执行符号表示前面的执行成功才会执行后面的[rootlinux-node3 ~]# cd /opt/tools/openssl-1.0.2r/[rootlinux-node3 /data/tools/openssl-1.0.2r]#./config--prefix/usr/local/openssl shared zlibmakemakeinstallecho$?以上命令执行完毕echo $?查看下最后的make install是否有报错0表示没有问题下面2个文件或者目录做软链接 刚才前面的步骤mv备份过原来的ln-s/usr/local/openssl/bin/openssl /usr/bin/opensslln-s/usr/local/openssl/include/openssl /usr/include/openssl[rootlinux-node3 ~]# ll /usr/bin/openssllrwxrwxrwx1root root26Apr2712:31 /usr/bin/openssl -/usr/local/ssl/bin/openssl[rootlinux-node3 ~]# ll /usr/include/openssl -ldlrwxrwxrwx1root root30Apr2712:31 /usr/include/openssl -/usr/local/ssl/include/openssl命令行执行下面2个命令加载新配置echo/usr/local/openssl/lib/etc/ld.so.conf ldconfig#重新加载文件openssl version查看确认版本。没问题# 或者 openssl version -a # //查看是否升级成功[roottestssh ~]# openssl versionOpenSSL1.1.1g21Apr20202.2 安装openssh上传openssh的tar包并解压yum-yinstallgcc openssl-devel zlib-devel# 备份当前openssh 无需卸载当前版本servicesshd stop ---备份前先停止ssh服务# 进行mv备份以下文件mv/etc/init.d/sshd /etc/init.d/sshd.bakmv/etc/ssh /etc/ssh.bakmv/usr/sbin/sshd /usr/sbin/sshd.bakmv/usr/bin/ssh /usr/bin/ssh.bak[roottestssh ~]# cd /opt/tools/[roottestssh tools]# lltotal7628-rw-r--r--1root root1597697Apr1807:02 openssh-8.0p1.tar.gz drwxr-xr-x20root root4096Apr2323:12 openssl-1.0.2r -rw-r--r--1root root5348369Feb2622:34 openssl-1.0.2r.tar.gz -rwxr-xr-x1root root853040Apr112018sshd[roottestssh tools]# tar -zxvf openssh-8.0p1.tar.gz[roottestssh tools]# cd openssh-8.0p1可能文件默认显示uid和gid数组都是1000这里重新授权下。不授权可能也不影响安装请自行测试[roottestssh tools]# chown -R root.root /opt/tools/openssh-8.2p1命令行删除原先ssh的配置文件和目录然后配置、编译、安装注意下面编译安装的命令是一行./configure--prefix/usr/local/openssh--sysconfdir/etc/ssh --with-pam --with-ssl-dir/usr/local/openssl --with-md5-passwords--mandir/usr/share/man --with-zlib 其中--with-ssl-dir是openssl的安装路径 如果报configure: error: PAM headers not found 执行命令yum-yinstallpam-devel 然后再 ./configure 一次makemakeinstall# 安装完毕 检查下结果echo$?安装完毕 检查下结果修改配置文件最终为如下内容其他的不要动vim/etc/ssh/sshd_config#注释掉这行PermitRootLogin prohibit-password#新建一行 添加 恢复root 用户登录 看情况恢复PermitRootLoginyesUseDNS no[rootlinux-node3 ~]# grep ^PermitRootLogin /etc/ssh/sshd_configPermitRootLoginyes[rootlinux-node3 ~]# grep UseDNS /etc/ssh/sshd_configUseDNS no从原先的解压的包中拷贝一些文件到目标位置如果目标目录存在就覆盖(可能下面的ssh.pam文件都没用到因为sshd_config配置文件貌似没使用它请自行测试。我这边是拷贝了)cp-acontrib/redhat/sshd.init /etc/init.d/sshdcp-acontrib/redhat/sshd.pam /etc/pam.d/sshd.pamchmodx /etc/init.d/sshdcp/usr/local/openssh/sbin/sshd /usr/sbin/sshdcp/usr/local/openssh/bin/ssh /usr/bin/[rootlinux-node3 /data/tools/openssh-8.0p1]# chkconfig --add sshd[rootlinux-node3 /data/tools/openssh-8.0p1]# systemctl enable sshd把原先的systemd管理的sshd文件删除或者移走或者删除不移走的话影响我们重启sshd服务[rootlinux-node3 ~]# mv /usr/lib/systemd/system/sshd.service /opt/设置sshd服务开机启动[rootlinux-node3 ~]# chkconfig sshd onNote: Forwarding request tosystemctl enable sshd.socket.Created symlink from /etc/systemd/system/sockets.target.wants/sshd.socket to /usr/lib/systemd/system/sshd.socket.接下来测试启停服务。都正常以后管理sshd通过下面方式了[rootlinux-node3 ~]# /etc/init.d/sshd restartRestarting sshd(via systemctl):[OK][rootlinux-node3 ~]#[rootlinux-node3 ~]#[rootlinux-node3 ~]# netstat -lntpActive Internet connections(only servers)Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp000.0.0.0:220.0.0.0:* LISTEN31800/sshd tcp600:::22 :::* LISTEN31800/sshd tcp600:::23 :::* LISTEN1/systemd[rootlinux-node3 ~]# /etc/init.d/sshd stopStopping sshd(via systemctl):[OK][rootlinux-node3 ~]# netstat -lntpActive Internet connections(only servers)Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp600:::23 :::* LISTEN1/systemd[rootlinux-node3 ~]# /etc/init.d/sshd startStarting sshd(via systemctl):[OK]使用systemd方式也行[rootlinux-node3 ~]# systemctl stop sshd[rootlinux-node3 ~]# netstat -lntpActive Internet connections(only servers)Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp600:::23 :::* LISTEN1/systemd[rootlinux-node3 ~]# systemctl start sshd[rootlinux-node3 ~]# netstat -lntpActive Internet connections(only servers)Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp000.0.0.0:220.0.0.0:* LISTEN31958/sshd tcp600:::22 :::* LISTEN31958/sshd tcp600:::23 :::* LISTEN1/systemd[rootlinux-node3 ~]# systemctl restart sshd[rootlinux-node3 ~]# netstat -lntpActive Internet connections(only servers)Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp000.0.0.0:220.0.0.0:* LISTEN31999/sshd tcp600:::22 :::* LISTEN31999/sshd tcp600:::23 :::* LISTEN1/systemd[rootlinux-node3 ~]#测试版本。都正常[rootlinux-node3 ~]# ssh -VOpenSSH_8.0p1, OpenSSL1.0.2r26Feb2019[rootlinux-node3 ~]#[rootlinux-node3 ~]# telnet 127.0.0.1 22Trying127.0.0.1... Connected to127.0.0.1. Escape character is^].SSH-2.0-OpenSSH_8.0如果不是生产机器。可以试着重启机器测试下登录sshd是否正常。我这边测试都没问题测试没问题后可以把telnet服务关闭了[rootlinux-node3 ~]# systemctl disable xinetd.serviceRemoved symlink /etc/systemd/system/multi-user.target.wants/xinetd.service.[rootlinux-node3 ~]# systemctl stop xinetd.service[rootlinux-node3 ~]# systemctl disable telnet.socket[rootlinux-node3 ~]# systemctl stop telnet.socket[rootlinux-node3 ~]# netstat -lntp添加开机启动脚本 ******由于云平台主机开机可能无法启动ssh需要添加开机启动脚本vim/etc/rc.d/rc.local#centos6/etc/init.d/sshd restart#centos7添加如下内容systemctl start sshd# 由于centos7的开机启动没有执行权限需要授权chmodx /etc/rc.d/rc.local