本文涉及rpm源码包下载地址：http://mirrors.163.com/centos/6/os/x86\_64/Packages

安装之前配置环境变量 /etc/profile 增加以下几行

1export C_INCLUDE_PATH=/usr/local/include:$C_INCLUDE_PATH
2export LD_LIBRARY_PATH=/usr/local/lib:$LD_LIBRARY_PATH

1.安装Telnet服务

防止升级ssh时意外断开无法再次登陆服务器

1###Redhat6
2#在其他机器批量安装时，可安装以下两个rpm包以免make install的时候报错
3rpm -ivhU --nodeps pam-devel-1.1.1-24.el6.x86_64.rpm
4rpm -ivhU --nodeps gcc-4.4.7-18.el6.x86_64.rpm
5rpm -ivhU --nodeps glibc-devel-2.12-1.209.el6.x86_64.rpm
6#安装Telnet服务
7rpm -ivhU xinetd-2.3.14-40.el6.x86_64.rpm
8rpm -ivhU telnet-server-0.17-48.el6.x86_64.rpm
9rpm -ivhU telnet-0.17-48.el6.x86_64.rpm
10###Redhat7
11rpm -ivhU --nodeps pam-devel-1.1.8-18.el7.x86_64.rpm 
12rpm -ivhU --nodeps gcc-4.8.5-16.el7.x86_64.rpm 
13rpm -ivhU --nodeps glibc-devel-2.17-196.el7.x86_64.rpm 
14rpm -ivhU xinetd-2.3.15-13.el7.x86_64.rpm 
15rpm -ivhU telnet-server-0.17-64.el7.x86_64.rpm 
16rpm -ivhU telnet-0.17-64.el7.x86_64.rpm 

将文件/etc/xinetd.d/telnet内容“disable=yes”值改为“no”

1#启动Telnet服务
2service xinetd restart

2.卸载旧版本openssl和openssh

1rpm -qa|grep openssl
2rpm -e --nodeps xxx
3rpm -qa|grep openssh
4rpm -e --nodeps xxx

3.关闭SELinux

1# 设置SELinux 成为permissive模式
2setenforce 0

将文件/etc/selinux/config内容“SELINUX=enforcing”值改为“disabled”

4.安装openssl-1.0.2m

1# 下载 https://www.openssl.org/source/openssl-1.0.2m.tar.gz
2# 解压openssl-1.0.2m.tar.gz
3tar xvf openssl-1.0.2m.tar.gz
4# 进入openssl-1.0.2m目录
5cd /openssl-1.0.2m
6# 编译安装，编译后在其他机器安装只需执行make install即可
7./config shared && make && make install
8# 更新ld
9echo "/usr/local/ssl/lib" >> /etc/ld.so.conf
10ldconfig -v
11# 配置openssl库
12cp /usr/local/ssl/lib/libssl.so.1.0.0 /usr/lib64
13cp /usr/local/ssl/lib/libcrypto.so.1.0.0 /usr/lib64
14chmod 555 /usr/lib64/libssl.so.1.0.0
15chmod 555 /usr/lib64/libcrypto.so.1.0.0
16ln -s /usr/lib64/libcrypto.so.1.0.0 /usr/lib64/libcrypto.so.10
17ln -s /usr/lib64/libssl.so.1.0.0 /usr/lib64/libssl.so.10
18ln -s /usr/lib64/libcrypto.so.1.0.0 /usr/lib64/libcrypto.so
19ln -s /usr/lib64/libssl.so.1.0.0 /usr/lib64/libssl.so
20ln -s /usr/local/ssl/bin/openssl /usr/bin/openssl
21ln -s /usr/local/ssl/include/openssl /usr/include/openssl
22# 查看openssl版本
23openssl version -a

5.安装openssh-7.6p1

1# 下载 http://mirror.internode.on.net/pub/OpenBSD/OpenSSH/portable/openssh-7.6p1.tar.gz
2# 解压openssh-7.6p1.tar.gz
3tar xvf openssh-7.6p1.tar.gz 
4# 进入openssh-7.6p1目录
5cd openssh-7.6p1
6# 编译安装，编译后在其他机器安装只需执行make install即可
7./configure --prefix=/usr --sysconfdir=/etc/ssh --with-md5-passwords --with-zlib --with-ssl-dir=/usr/local/ssl --without-hardening --with-pam && make && make install

5.1编辑/etc/ssh/sshd_config

1# 修改配置文件
2vi /etc/ssh/sshd_config

将以下内容全部复制到/etc/ssh/sshd_config

1#       $OpenBSD: sshd_config,v 1.93 2014/01/10 05:59:19 djm Exp $
2
3# This is the sshd server system-wide configuration file.  See
4# sshd_config(5) for more information.
5
6# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin
7
8# The strategy used for options in the default sshd_config shipped with
9# OpenSSH is to specify options with their default value where
10# possible, but leave them commented.  Uncommented options override the
11# default value.
12
13#Port 22
14#AddressFamily any
15#ListenAddress 0.0.0.0
16#ListenAddress ::
17
18# The default requires explicit activation of protocol 1
19Protocol 2
20
21# HostKey for protocol version 1
22#HostKey /etc/ssh/ssh_host_key
23# HostKeys for protocol version 2
24#HostKey /etc/ssh/ssh_host_rsa_key
25#HostKey /etc/ssh/ssh_host_dsa_key
26#HostKey /etc/ssh/ssh_host_ecdsa_key
27#HostKey /etc/ssh/ssh_host_ed25519_key
28
29# Lifetime and size of ephemeral version 1 server key
30#KeyRegenerationInterval 1h
31#ServerKeyBits 1024
32
33# Ciphers and keying
34#RekeyLimit default none
35
36# Logging
37# obsoletes QuietMode and FascistLogging
38#SyslogFacility AUTH
39SyslogFacility AUTHPRIV
40#LogLevel INFO
41
42# Authentication:
43
44#LoginGraceTime 2m
45PermitRootLogin no
46#StrictModes yes
47#MaxAuthTries 6
48#MaxSessions 10
49
50#RSAAuthentication yes
51#PubkeyAuthentication yes
52
53# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
54# but this is overridden so installations will only check .ssh/authorized_keys
55AuthorizedKeysFile      .ssh/authorized_keys
56
57#AuthorizedPrincipalsFile none
58
59#AuthorizedKeysCommand none
60#AuthorizedKeysCommandUser nobody
61
62# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
63#RhostsRSAAuthentication no
64# similar for protocol version 2
65#HostbasedAuthentication no
66# Change to yes if you don't trust ~/.ssh/known_hosts for
67# RhostsRSAAuthentication and HostbasedAuthentication
68#IgnoreUserKnownHosts no
69# Don't read the user's ~/.rhosts and ~/.shosts files
70#IgnoreRhosts yes
71
72# To disable tunneled clear text passwords, change to no here!
73#PasswordAuthentication yes
74#PermitEmptyPasswords no
75PasswordAuthentication yes
76
77# Change to no to disable s/key passwords
78#ChallengeResponseAuthentication yes
79ChallengeResponseAuthentication no
80
81# Kerberos options
82#KerberosAuthentication no
83#KerberosOrLocalPasswd yes
84#KerberosTicketCleanup yes
85#KerberosGetAFSToken no
86
87# GSSAPI options
88#GSSAPIAuthentication no
89#GSSAPICleanupCredentials yes
90
91# Set this to 'yes' to enable PAM authentication, account processing,
92# and session processing. If this is enabled, PAM authentication will
93# be allowed through the ChallengeResponseAuthentication and
94# PasswordAuthentication.  Depending on your PAM configuration,
95# PAM authentication via ChallengeResponseAuthentication may bypass
96# the setting of "PermitRootLogin without-password".
97# If you just want the PAM account and session checks to run without
98# PAM authentication, then enable this but set PasswordAuthentication
99# and ChallengeResponseAuthentication to 'no'.
100UsePAM yes
101
102#AllowAgentForwarding yes
103#AllowTcpForwarding yes
104#GatewayPorts no
105#X11Forwarding no
106#X11DisplayOffset 10
107#X11UseLocalhost yes
108#PermitTTY yes
109#PrintMotd yes
110#PrintLastLog yes
111#TCPKeepAlive yes
112#UseLogin no
113#PermitUserEnvironment no
114#Compression delayed
115#ClientAliveInterval 0
116#ClientAliveCountMax 3
117UseDNS no
118#PidFile /var/run/sshd.pid
119#MaxStartups 10:30:100
120#PermitTunnel no
121#ChrootDirectory none
122#VersionAddendum none
123
124# no default banner path
125#Banner none
126
127# override default of no subsystems
128Subsystem       sftp    /usr/libexec/sftp-server
129
130# Example of overriding settings on a per-user basis
131#Match User anoncvs
132#       X11Forwarding no
133#       AllowTcpForwarding no
134#       PermitTTY no
135#       ForceCommand cvs server
136KexAlgorithms diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1
137Banner /etc/sshbanner

5.2编辑/etc/init.d/sshd

1cd openssh-7.6p1/contrib/redhat
2cp sshd.init /etc/init.d/sshd

5.3编辑/etc/pam.d/sshd

vi /etc/pam.d/sshd

将以下内容全部复制到/etc/pam.d/sshd

1#%PAM-1.0
2auth       required pam_sepermit.so
3auth       include      password-auth
4account    required     pam_nologin.so
5account    include      password-auth
6password   include      password-auth
7# pam_selinux.so close should be the first session rule
8session    required     pam_selinux.so close
9session    required     pam_loginuid.so
10# pam_selinux.so open should only be followed by sessions to be executed in the user context
11session    required     pam_selinux.so open env_params
12session    optional     pam_keyinit.so force revoke
13session    include      password-auth

 5.4服务配置

1# 赋权限
2chmod u+x /etc/init.d/sshd
3# 服务设置自启动
4chkconfig --add sshd
5chkconfig sshd on
6chkconfig --list|grep sshd
7# 重启服务
8service sshd restart
9# 查看版本
10ssh -V

6.测试ssh服务是否正常

测试ssh服务正常后将Telnet服务卸载

rpm -e telnet-server-0.17-48.el6.x86_64 xinetd-2.3.14-40.el6.x86_64

7.安装ntp服务

，由于升级完openssl会导致ntpd服务无法启动，报错原因为：ntpd: OpenSSL version mismatch. Built against 10000003, you have 100020bf，所以需要重新编译ntpd。

7.1编译安装

1#卸载老版本
2rpm -qa|grep ntpdate
3rpm -e xxx --nodeps
4rpm -qa|grep ntp-
5rpm -e xxx --nodeps
6#安装所需库文件
7rpm -qa|grep libcap
8rpm -ivh libcap-2.16-5.5.el6.x86_64.rpm
9rpm -ivh libcap-devel-2.16-5.5.el6.x86_64.rpm
10find / -name libcap*
11/usr/local/ssl/lib/engines/libcapi.so
12ln -s /usr/local/ssl/lib/engines/libcapi.so /lib64/libcap.so
13
14#下载 http://www.eecis.udel.edu/~ntp/ntp_spool/ntp4/ntp-4.2/ntp-4.2.8p10.tar.gz
15
16tar xvf ntp-4.2.8p10.tar.gz
17cd ntp-4.2.8p10
18./configure --prefix=/usr --enable-all-clocks --enable-parse-clocks --enable-linuxcaps --disable-ipv6 --without-ntpsnmpd
19make
20make install

7.2修改配置文件

vi /etc/init.d/ntpd

1#!/bin/sh
2
3NTPD=/usr/bin/ntpd
4PIDFILE=/var/run/ntpd.pid
5USER=ntp
6GROUP=ntp
7NTPD_OPTS="-g -u $USER:$GROUP -p $PIDFILE"
8
9ntpd_start() {
10    if [ -r $PIDFILE ]; then
11        echo "ntpd seems to be already running under pid `cat $PIDFILE`."
12        echo "Delete $PIDFILE if this is not the case.";
13        return 1;
14    fi
15    echo -n "Starting NTP daemon... "
16
17    $NTPD $NTPD_OPTS
18
19    # You can't always rely on the ntpd exit code, see Bug #2420
20    # case "$?" in
21    #     0) echo "OK!"
22    #         return 0;;
23    #     *) echo "FAILED!"
24    #         return 1;;
25    # esac
26
27    sleep 1
28
29    if ps -Ao args|grep -q "^$NTPD $NTPD_OPTS"; then
30        echo "OK!"
31        return 0
32    else
33        echo "FAILED!"
34        [ -e $PIDFILE ] && rm $PIDFILE
35        return 1
36    fi
37}
38
39ntpd_stop() {
40    if [ ! -r $PIDFILE ]; then
41        echo "ntpd doesn't seem to be running, cannot read the pid file."
42        return 1;
43    fi
44    echo -n "Stopping NTP daemon...";
45    PID=`cat $PIDFILE`
46
47    if kill -TERM $PID 2> /dev/null;then
48        # Give ntp 15 seconds to exit
49        for i in `seq 1 15`; do
50            if [ -n "`ps -p $PID|grep -v PID`" ]; then
51                echo -n .
52                sleep 1
53            else
54                echo " OK!"
55                rm $PIDFILE
56                return 0
57            fi
58        done
59    fi
60
61    echo " FAILED! ntpd is still running";
62    return 1
63}
64
65ntpd_status() {
66    if [ -r $PIDFILE ]; then
67        echo "NTP daemon is running as `cat $PIDFILE`"
68    else
69        echo "NTP daemon is not running"
70    fi
71}
72
73case "$1" in
74    'start')
75        ntpd_start
76        ;;
77    'stop')
78        ntpd_stop
79        ;;
80    'restart')
81        ntpd_stop && ntpd_start
82        ;;
83    'status')
84        ntpd_status
85        ;;
86    *)
87        echo "Usage: $0 (start|stop|restart|status)"
88esac

/etc/ntp.conf

1restrict default ignore   #默认不允许修改或者查询ntp,并且不接收特殊封包
2restrict 127.0.0.1        #给于本机所有权限
3restrict 192.168.1.0 mask 255.255.255.0 notrap nomodify  #给于局域网机的机器有同步时间的权限
4server 192.168.26.11 prefer   #设置时间服务器，加prefer表示优先
5server  127.127.1.0     # local clock
6fudge   127.127.1.0 stratum 10
7driftfile /var/lib/ntp/drift
8keys /etc/ntp/keys

7.3启动服务

1chmod 755 /etc/init.d/ntpd
2service ntpd restart
3chkconfig ntpd on