CentOS 上升级 OpenSSH 的版本选择与总体策略
升级前准备与风险控制
setenforce 0),并在完成后恢复;或确保策略与 PAM 配置兼容。两种常见升级路径
ssh -Vyum update openssh-server openssh-clients -ysystemctl restart sshdssh -V 与 systemctl status sshd,并新开终端测试登录。yum install -y gcc make zlib-devel openssl-devel pam-develwget https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-8.6p1.tar.gzmv /etc/ssh /etc/ssh_bak && tar xzf openssh-8.6p1.tar.gz && cd openssh-8.6p1./configure --with-zlib --with-ssl-dir --with-pam --bindir=/usr/bin --sbindir=/usr/sbin --sysconfdir=/etc/sshmake && make installln -sf /usr/local/sbin/sshd /usr/sbin/sshd/usr/lib/systemd/system/sshd.service 中的 ExecStart 指向 /usr/sbin/sshdsystemctl daemon-reload && systemctl restart sshdcp contrib/redhat/sshd.init /etc/init.d/sshdcp contrib/redhat/sshd.pam /etc/pam.d/sshd.pam/etc/init.d/sshd 将 SSHD=/usr/local/sbin/sshdchmod +x /etc/init.d/sshd && systemctl daemon-reloadsystemctl disable sshd,再用 service sshd restart 启动新服务ssh -V、sshd -t、systemctl status sshd,并新开终端测试登录。常见故障与修复要点
sshd -t 定位错误行。常见为 Ciphers/MACs 与系统支持不一致。
ssh -Q cipher、ssh -Q mac/etc/ssh/sshd_config 中显式设置兼容算法,例如:
Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.comMACs hmac-sha2-256,hmac-sha2-512,hmac-sha1setenforce 0 验证,或恢复正确的 SELinux 策略/布尔值后再 setenforce 1。/etc/ssh/sshd_config 中 PermitRootLogin 与 PasswordAuthentication 设置,并重启服务后测试。升级后验证与回退方案
ssh -V、sshd -t、systemctl status sshd,确认无报错且监听 22/TCP。systemctl stop sshdyum reinstall openssh-server openssh-clientsmv /etc/ssh_bak /etc/sshsystemctl start sshd 并测试