Upgrade Environment
The system is CentOS 7.9, and the OpenSSH version is the default 7.4 version.
Package Preparation
Prepare a CentOS 7.9 virtual machine that can access the internet, and download the telnet-related rpm packages for offline use.
yum install --downloadonly --downloaddir=. xinetd telnet telnet-server
The rpm package for the new version of OpenSSH can be packaged using an open-source script on GitHub.
https://github.com/boypt/openssh-rpms
Enable Telnet Before Upgrading OpenSSH (Optional)#
Install the telnet service offline, using the rpm command to install telnet.
The telnet service requires the installation of both the telnet-server and xinetd packages; telnet is the client tool.
Start the xinetd.service and telnet.socket services.
systemctl restart xinetd.service telnet.socket
To log in as root, you need to add pts terminals to the end of the /etc/securetty file.
[root@localhost ~]# echo pts/0 >> /etc/securetty
[root@localhost ~]# echo pts/1 >> /etc/securetty
If the server has a firewall enabled, you need to allow telnet.
[root@localhost ~]# firewall-cmd --add-service=telnet
At this point, you can use telnet to log in to the server.
Upgrade OpenSSH#
Since it has been packaged into an rpm package, it is much simpler than compiling from source; you can use the rpm command to upgrade.
Use the yum command to uninstall openssh.
[root@localhost ~]# yum remove openssh openssh-clients openssh-server
Extract and install the rpm package; it is best to back up the original ssh configuration before installation.
[root@localhost ~]# tar xf openssh-9.9p1-1.el7.tar.gz
[root@localhost ~]# mv /etc/ssh /etc/ssh.bak
[root@localhost ~]# rpm -ivh openssh*.rpm
After installing the new version of openssh, restart sshd and set it to start on boot.
The sshd service starts normally, but there is an error message; OpenSSH version 9.9 disables DSA by default.
/sbin/restorecon: lstat(/etc/ssh/ssh_host_dsa_key.pub) failed: No such...
Modify the configuration file to disable loading dsa_key.
After modification, reload the configuration and restart the sshd service; the error message disappears.
The OpenSSH upgrade is complete.