由于管理着两百多台Linux服务器，一个人搞这么多机器的安全加固比较累，因此在学习了shell脚本之后果断的写了一些常用脚本做一些系统日常维护，本文OPENSSH的升级是博主本人几乎每两三个月就要做一次升级的，没办法绿盟安全扫描系统总是扫描到相关的高危漏洞，再就是OPENSSH版本更新的也比较频繁，因此不偷懒几乎没法活了。废话不说了，在这里贴下脚本，已经在线上服务器上执行了上百次了，应该不会有什么问题。
#!/bin/bash
#################################################################
###### update openssl openssh scirpt #########
##### Author:kl #####
###### Date:2014/07/13 #####
###### LastModified:2016/06/02 #######
#### Warning:start telnet service before use the script #####
#################################################################
####################################################################################
# update openssh and openssl
#########
#####
##
####################################################################################
#Determine whether the current system installed gcc compiler tools
zlib_version="zlib-1.2.8"
openssl_version="openssl-1.0.2g"
openssh_version="openssh-7.2p2"
gcc_path=`which gcc`
#gcc_name=`basename $gcc_path`
DATE=$(date +%Y%m%d)
# OS TYPE
#Distributor_ID=$(lsb_release -i)
Distributor=`lsb_release -i|cut -c 17-`
# Determine whether the root user
userid=`id -u`
if [ "$userid" -ne 0 ]; then
echo "sorry,only root can execute the script. "
exit
fi
# SET SELINUX=disabled
if [ "$Distributor" != "SUSE LINUX" ]; then
sed -i '/SELINUX/s/enforcing/disabled/' /etc/selinux/config
setenforce 0
fi
# pam-devel,tcp_wrappers-devel need be installed, Otherwise, the software will install failure
# Support for tcpwrappers/libwrap has been removed in openssh6.7
if ! rpm -qa|grep pam-devel &>/dev/null; then
echo "pam-devel is not installed" && exit
fi
#if ! rpm -qa|grep tcp_wrappers-devel &>/dev/null; then
# echo "tcp_wrappers-devel not installed" && exit
#fi
# Check whether to open the telnet service
netstat -tnlp | grep -w 23
RETVAL3=$?
if [ $RETVAL3 -eq 0 ]; then
echo "telnet service is running------------[yes]"
else
echo "telnet service is not running--------[no]"
exit
fi
# Determine whether to install gcc package
if [ -e "$gcc_path" ]; then
echo "gcc is installed----------------[yes]"
else
echo "gcc is not installed------------[no]"
exit
fi
# stop sshd service
netstat -tnlp | grep -w 22
RETVAL4=$?
if [ $RETVAL4 -eq 0 ]; then
service sshd stop
echo "stop sshd service --------------[yes]"
fi
if [ -e /etc/init.d/sshd ]; then
cp /etc/init.d/sshd /root
fi
# remove openssh*.rpm if exists
if rpm -qa | grep openssh &> /dev/null; then
rpm -qa | grep openssh > openssh_list.txt
while read line
do
rpm -e $line --nodeps
echo "remove $line success------------[yes]"
done < openssh_list.txt
fi
###########install zlib ##################
tar -zxvf "${zlib_version}.tar.gz" > /dev/null
cd $zlib_version
./configure
RETVAL5=$?
if [ $RETVAL5 -ne 0 ]; then
echo "Configure zlib has encountered an error"
exit
fi
make
RETVAL6=$?
if [ $RETVAL6 -ne 0 ]; then
echo "make zlib has encountered an error"
exit
fi
make install
cd ..
echo "#########################################################"
echo "################ #################"
echo "################ zlib install success #################"
echo "################ #################"
echo "#########################################################"
sleep 2
########## install openssl #############
tar -zxvf "${openssl_version}.tar.gz" > /dev/null
cd $openssl_version
./config shared zlib
RETVAL7=$?
if [ $RETVAL7 -ne 0 ]; then
echo "Configure openssl has encountered an error"
exit
fi
make
RETVAL8=$?
if [ $RETVAL8 -ne 0 ]; then
echo "make openssl has encountered an error"
exit
fi
make install
if [ -e /usr/bin/openssl ]; then
mv /usr/bin/openssl /usr/bin/openssl.OFF && ln -s /usr/local/ssl/bin/openssl /usr/bin/openssl
else
ln -s /usr/local/ssl/bin/openssl /usr/bin/openssl
fi
if [ -e /usr/include/openssl ]; then
mv /usr/include/openssl /usr/include/openssl.OFF && ln -s /usr/local/ssl/include/openssl /usr/include/openssl
else
ln -s /usr/local/ssl/include/openssl /usr/include/openssl
fi
## Add "/usr/local/ssl/lib" to /etc/ld.so.conf
ssl_lib=`grep -w "/usr/local/ssl/lib" /etc/ld.so.conf`
if [ ! -e "$ssl_lib" ]; then
echo "/usr/local/ssl/lib" >> /etc/ld.so.conf
fi
ldconfig -v
cd ..
echo "#########################################################"
echo "################ #################"
echo "################ openssl install sucess ################"
echo "################ #################"
echo "#########################################################"
sleep 2
############# install openssh ##############
if [ -e /etc/ssh ]; then
mv /etc/ssh /etc/ssh_$DATE
fi
tar -zxvf "${openssh_version}.tar.gz" > /dev/null
cd $openssh_version
./configure --prefix=/usr --sysconfdir=/etc/ssh --with-zlib --with-pam --with-ssl-dir=/usr/local/ssl --with-md5-passwords
RETVAL9=$?
if [ $RETVAL9 -ne 0 ]; then
echo "Configure openssh has encountered an error"
exit
fi
make
RETVAL10=$?
if [ $RETVAL10 -ne 0 -a $RETVAL10 -ne 0 ]; then
echo "make openssh has encountered an error"
exit
fi
make install
if [ "$Distributor" == "SUSE LINUX" ]; then
cd contrib/suse
cp rc.sshd /etc/init.d/sshd
chmod +x /etc/init.d/sshd
chkconfig --add sshd
else
cd contrib/redhat
cp sshd.init /etc/init.d/sshd
chmod +x /etc/init.d/sshd
chkconfig --add sshd
fi
#A generic PAM configuration is included as "contrib/sshd.pam.generic",
#you may need to edit it before using it on your system.
cd ..
cp sshd.pam.generic /etc/pam.d/sshd
sed -i 's/\/lib\/security\///g' /etc/pam.d/sshd
# Modify /etc/ssh/sshd_config
# Backup /etc/ssh/sshd_config
cp -p /etc/ssh/sshd_config /etc/ssh/sshd_config_bak
# The default set of ciphers and MACs has been altered to
# remove unsafe algorithms. In particular, CBC ciphers and arcfour*
# are disabled by default.
# Changes since OpenSSH 6.6
echo "KexAlgorithms diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,curve25519-sha256@libssh.org" >> /etc/ssh/sshd_config
echo "Ciphers aes128-cbc,aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr,3des-cbc,arcfour128,arcfour256,arcfour,blowfish-cbc,cast128-cbc" >> /etc/ssh/sshd_config
echo "MACs hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160,hmac-sha1-96,hmac-md5-96" >> /etc/ssh/sshd_config
# Disable root access via ssh to server
#* The default for the sshd_config(5) PermitRootLogin option has changed from "yes" to "prohibit-password".
#* PermitRootLogin=without-password/prohibit-password now bans all
#interactive authentication methods, allowing only public-key,
#hostbased and GSSAPI authentication (previously it permitted
#keyboard-interactive and password-less authentication if those
#were enabled).
#PermitRootLogin prohibit-password is the default since version 7.0p1
sed -i 's/^#PermitRootLogin/PermitRootLogin/' /etc/ssh/sshd_config
#sed -i '/PermitRootLogin/s/yes/no/' /etc/ssh/sshd_config
sed -i '/PermitRootLogin/s/prohibit-password/no/' /etc/ssh/sshd_config
# Set 'UsePAM no' to 'UsePAM yes' to enable PAM authentication, account processing,
# and session processing
sed -i '/^#UsePAM no/a UsePAM yes' /etc/ssh/sshd_config
# Start sshd process
service sshd start
# Disable telnet service
if netstat -tnlp | grep -w 22 &> /dev/null; then
sed -i '/disable/s/no/yes/' /etc/xinetd.d/telnet
service xinetd restart
fi
echo "#########################################################"
echo "################ #################"
echo "################ openssh install sucess ################"
echo "################ #################"
echo "#########################################################"
echo "############### ssh version ################################################# "
echo "################################################################################### "
sshd -v
echo "#################################################################################### "
echo "#################################################################################### "
