Linux vulnerability Scan patch fix

Pro-Test 5.9 32-bit-6.5 64 bits are available without removing the old version of SSH compilation installation.

1. Establish a standby connection. Telnet

Yum Install Telnet telnet-server

Vi/etc/xinetd.d/telnet//change disable = Yes to No, or comment out directly;

Service xinetd Restart

Chkconfig--list|grep Telnet

------5.9

Chkconfig krb5-telnet on

Chkconfig--list|grep Telnet

echo "PTS/1" >>/etc/securetty

echo "PTS/2" >>/etc/securetty

echo "PTS/3" >>/etc/securetty

Service xinetd Restart

-------------------------

2. Start upgrading OpenSSL vulnerability patches

Upgrade OpenSSL

1. Check the compilation library

Rpm-qa |grep zlib*

Rpm-qa |grep GCC

Rpm-qa |grep Make

OpenSSL version-a

Cd/root/soft

Tar zxvf openssl-1.0.2h.tar.gz

CD OPENSSL-1.0.2H

./config--PREFIX=/USR--shared

Make

Make Test

Make install

Viewing the Listening port

Netstat-antup

Check the currently installed version

Rpm-qa | grep OpenSSL

OpenSSL version-a

——————————————————————

Upgrade OpenSSH Vulnerability Patch, this version is OpenSSH 7.2P2

Three OpenSSH installation

Cd..

Tar zxvf openssh-7.2p2.tar.gz

CD OPENSSH-7.2P2

Execute the following command at the command line, noting that the following is a whole command

Install-v-m700-d/var/lib/sshd &&

Chown-v root:sys/var/lib/sshd &&

Groupadd-g sshd &&

Useradd-c ' sshd privsep ' \

-D/VAR/LIB/SSHD \

-G sshd \

-s/bin/false \

-U-sshd

--------------------------------------------

Go to the Unzip directory, execute the following command at the command line, and note that the following is a whole command

./configure--prefix=/usr \

--SYSCONFDIR=/ETC/SSH \

--with-md5-passwords \

--with-privsep-path=/var/lib/sshd &&

Make

------------------------------------------

After the above execution, and no error, then execute the following command: Note that the following is a whole command

File name NOTE!!!!!!

Make install &&

Install-v-m755 Contrib/ssh-copy-id/usr/bin &&

Install-v-m644 Contrib/ssh-copy-id.1 \

/usr/share/man/man1 &&

Install-v-m755-d/usr/share/doc/openssh-7.2p2 &&

Install-v-m644 INSTALL LICENCE overview readme* \

/usr/share/doc/openssh-7.2p2

5, after the execution, no error, you can verify the installation information

Whereis SSH

Ssh-v

Cd/etc/ssh

CP Sshd_config Sshd_config_bak

VI sshd_config

Remove the # number in front of the Permitrootlogin Yes

Comment out the following configuration:

# GSSAPI Options

#GSSAPIAuthentication Yes

#GSSAPICleanupCredentials Yes

#UsePAM Yes

At the end of the file, add the following content (overall copy below) to affect the SFTP transfer

Ciphers aes128-cbc,aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr,3des-cbc,arcfour128,arcfour256, Arcfour,blowfish-cbc,cast128-cbc

MACs Hmac-md5,hmac-sha1,[email protected],hmac-ripemd160,hmac-sha1-96,hmac-md5-96

Kexalgorithms DIFFIE-HELLMAN-GROUP1-SHA1,DIFFIE-HELLMAN-GROUP14-SHA1,DIFFIE-HELLMAN-GROUP-EXCHANGE-SHA1, diffie-hellman-group-exchange-sha256,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521, Diffie-hellman-group1-sha1,[email protected]

Service sshd Restart

This article is from the "7987021" blog, please be sure to keep this source http://7997021.blog.51cto.com/7987021/1863915

Linux vulnerability Scan patch fix