参考链接： - https://blog.csdn.net/Y94639997/article/details/141057481

下载地址

升级 OpenSSH 到 9.8p1 通常需要同时升级 OpenSSL

OpenSSL： - https://ftp.openssl.org/source/old/1.1.1/ - https://www.openssl.org/source/old/1.1.1/openssl-1.1.1w.tar.gz - https://www.openssl.org/source/old/3.3.1/openssl-3.3.1.tar.gz - https://ghproxy.cn/https://github.com/openssl/openssl/releases/download/openssl-3.3.1/openssl-3.3.1.tar.gz

OpenSSH： - https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/ - https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-9.8p1.tar.gz - https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-9.9p2.tar.gz

准备工作（建议）

• 建议在控制台/带外环境中操作，避免 SSH 断开造成不可恢复。
• 将 OpenSSL 与 OpenSSH 源码包放到 /opt/ 目录（示例：openssl-1.1.1w.tar.gz、openssh-9.8p1.tar.gz）。

Ubuntu 升级脚本（示例）

#!/bin/bash

# 1. 安装依赖

> **适用环境**：CentOS 7（2024-06 EOL）；CentOS 8（2021-12 EOL）；yum（CentOS 8+ 应用 dnf）。文中命令按当时环境记录，新系统上请对照官方文档调整。
> ⚠️ **安全提示**：本文包含「SSH 密码登录、允许 root 直接 SSH 登录」等操作，属于内网/测试环境做法。**公网机器请勿直接照搬** —— 正确做法是保留 SELinux 与防火墙，按需放行具体端口。

echo -e "\n \033[33m 安装依赖中... \033[0m \n"
apt-get update && apt-get -y install gcc make perl zlib zlib-devel pam pam-devel

# 2. 备份旧 OpenSSL
echo -e "\n \033[33m 备份旧 OpenSSL... \033[0m \n"
mv /usr/bin/openssl /usr/bin/openssl.bak
mv /usr/lib64/openssl /usr/lib64/openssl.bak
mv /usr/include/openssl /usr/include/openssl.bak

# 3. 编译安装 OpenSSL
echo -e "\n \033[33m 编译安装 OpenSSL... \033[0m \n"
cd /opt/openssl
tar -zxvf openssl-1.1.1w.tar.gz
cd openssl-1.1.1w/
mkdir -p /usr/local/openssl

./config --prefix=/usr/local/openssl --shared
make && make install

if [ $? -ne 0 ]; then
    echo -e "\n \033[30m OpenSSL 编译安装失败!!! \033[0m \n"
    exit 1
else
    echo -e "\n \033[33m OpenSSL 编译安装完成... \033[0m \n"
fi

# 4. 设置运行库路径
echo -e "\n \033[33m 设置运行库路径... \033[0m \n"
export LD_LIBRARY_PATH=/usr/local/openssl/lib:$LD_LIBRARY_PATH

# 5. 软链与库配置
echo -e "\n \033[33m 配置 OpenSSL 软链与库路径... \033[0m \n"
ln -s /usr/local/openssl/bin/openssl /usr/bin/openssl
ln -s /usr/local/openssl/include/openssl /usr/include/openssl

echo "/usr/local/openssl/lib" >> /etc/ld.so.conf
ldconfig

# 6. 验证 OpenSSL
echo -e "\n \033[33m 验证 OpenSSL... \033[0m \n"
openssl version
openssl version -a

# 7. 是否升级 OpenSSH
echo -e "\n \033[33m 是否升级 OpenSSH? (yes/no): \033[0m \n"
read user_input

if [[ "$user_input" == "yes" ]]; then
    # 备份旧 OpenSSH
    echo -e "\n \033[33m 备份旧 OpenSSH... \033[0m \n"
    mv /etc/ssh/ /etc/ssh.bak
    mv /usr/bin/ssh /usr/bin/ssh.bak
    mv /usr/sbin/sshd /usr/sbin/sshd.bak
    mv /etc/init.d/sshd /etc/init.d/sshd.bak

    # 编译安装 OpenSSH
    echo -e "\n \033[33m 编译安装 OpenSSH... \033[0m \n"
    cd /opt/
    tar -zxf openssh-9.8p1.tar.gz
    cd openssh-9.8p1/

    ./configure --prefix=/usr \
      --sysconfdir=/etc/ssh \
      --with-md5-passwords \
      --with-pam \
      --with-tcp-wrappers \
      --with-ssl-dir=/usr/local/openssl \
      --with-privsep-path=/var/lib/sshd \
      --without-hardening

    make && make install

    if [ $? -ne 0 ]; then
        echo -e "\n \033[30m OpenSSH 编译安装失败!!! \033[0m \n"
        exit 1
    else
        echo -e "\n \033[33m OpenSSH 编译安装完成... \033[0m \n"
    fi

    # 配置 sshd
    echo -e "\n \033[33m 配置 sshd... \033[0m \n"
    chmod 600 /etc/ssh/ssh_host_rsa_key /etc/ssh/ssh_host_ecdsa_key /etc/ssh/ssh_host_ed25519_key
    echo "PasswordAuthentication yes" >> /etc/ssh/sshd_config
    echo "PermitRootLogin yes" >> /etc/ssh/sshd_config
    echo "UsePAM yes" >> /etc/ssh/sshd_config

    cp -pf /opt/openssh-9.8p1/contrib/redhat/sshd.init /etc/init.d/sshd
    chmod +x /etc/init.d/sshd
    chkconfig --add sshd
    chkconfig sshd on
    systemctl restart sshd

    # 验证 OpenSSH
    echo -e "\n \033[33m 验证 OpenSSH... \033[0m \n"
    ssh -V
    systemctl status sshd
else
    echo -e "\n \033[31m 已取消升级 OpenSSH。 \033[0m \n"
    exit 0
fi

一键脚本 （Alibaba Cloud Linux 3/centos8）

#!/bin/bash
set -euo pipefail

# ========================
# OpenSSH 9.8p1 升级脚本（Alibaba Cloud Linux 3）
# 作者：Qwen / Alibaba Cloud
# 前提：当前目录或指定路径存在 openssh-9.8p1.tar.gz
# ========================

SSH_SRC_TAR="/tmp/kylin_setup/openssh-9.8p1.tar.gz"
if [ ! -f "$SSH_SRC_TAR" ]; then
    echo "❌ 错误：OpenSSH 源码包未找到: $SSH_SRC_TAR"
    exit 1
fi

echo "🚀 开始升级 OpenSSH 到 9.8p1..."

# --- 1. 备份 ---
BAK_DIR="/opt/backup/ssh-$(date +%Y%m%d-%H%M%S)"
mkdir -p "$BAK_DIR"
cp -a /etc/ssh "$BAK_DIR/"
cp -a /etc/pam.d/sshd "$BAK_DIR/" 2>/dev/null || true
echo "✅ 配置已备份到: $BAK_DIR"

# --- 2. 安装依赖 ---
echo "🔧 安装编译依赖..."
yum -y install gcc make perl pam-devel zlib-devel openssl-devel libselinux-devel systemd-devel &>/dev/null

# --- 3. 卸载旧版 OpenSSH (RPM) ---
echo "🗑️ 卸载旧版 OpenSSH RPM 包..."
rpm -e --nodeps $(rpm -qa | grep openssh) 2>/dev/null || true

# --- 4. 解压并编译 ---
echo "📦 解压并编译 OpenSSH 9.8p1..."
WORK_DIR="/tmp/openssh-upgrade-$"
mkdir -p "$WORK_DIR"
tar -zxf "$SSH_SRC_TAR" -C "$WORK_DIR" --strip-components=1
cd "$WORK_DIR"

./configure \
  --prefix=/usr \
  --sysconfdir=/etc/ssh \
  --with-pam \
  --with-zlib \
  --with-md5-passwords \
  --with-selinux \
  --with-privsep-path=/var/empty/sshd \
  --with-default-path=/usr/bin:/bin:/usr/sbin:/sbin \
  --with-superuser-path=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin \
  --with-systemd

make -j$(nproc)
make install
echo "✅ OpenSSH 9.8p1 安装完成"

# --- 5. 修复权限 ---
chmod 600 /etc/ssh/ssh_host_*_key 2>/dev/null || true
chmod 644 /etc/ssh/ssh_host_*_key.pub 2>/dev/null || true

# --- 6. 恢复配置 + 兼容性 ---
cp "$BAK_DIR/ssh/sshd_config" /etc/ssh/
grep -q "PubkeyAcceptedAlgorithms.*ssh-rsa" /etc/ssh/sshd_config || \
  echo "PubkeyAcceptedAlgorithms +ssh-rsa" >> /etc/ssh/sshd_config
grep -q "HostkeyAlgorithms.*ssh-rsa" /etc/ssh/sshd_config || \
  echo "HostkeyAlgorithms +ssh-rsa" >> /etc/ssh/sshd_config

# --- 7. 恢复 PAM ---
if [ -f "$BAK_DIR/sshd" ]; then
    cp "$BAK_DIR/sshd" /etc/pam.d/
fi

# --- 8. 创建 systemd service 文件 ---
cat > /usr/lib/systemd/system/sshd.service << 'EOF'
[Unit]
Description=OpenSSH server daemon
Documentation=man:sshd(8) man:sshd_config(5)
After=network.target sshd-keygen.target
Wants=sshd-keygen.target

[Service]
Type=notify
EnvironmentFile=-/etc/sysconfig/sshd
ExecStart=/usr/sbin/sshd -D $OPTIONS
ExecReload=/bin/kill -HUP $MAINPID
KillMode=process
Restart=on-failure
RestartSec=42s
RuntimeDirectory=sshd
RuntimeDirectoryMode=0755
StandardOutput=journal
StandardError=journal

[Install]
WantedBy=multi-user.target
EOF

touch /etc/sysconfig/sshd  # 避免 warning

# --- 9. 启动服务 ---
systemctl daemon-reload
systemctl enable --now sshd

# --- 10. 验证 ---
if systemctl is-active --quiet sshd; then
    echo "✅ SSH 服务已成功启动！"
    echo "🔍 当前版本: $(ssh -V 2>&1)"
    echo ""
    echo "⚠️  请在新终端测试 SSH 登录！"
    echo "🔄 如需回滚，请使用备份目录: $BAK_DIR"
else
    echo "❌ SSH 服务启动失败！"
    systemctl status sshd --no-pager
    exit 1
fi

# --- 清理 ---
rm -rf "$WORK_DIR"
echo "🧹 临时文件已清理。"

一键脚本（kylin/centos7）

#!/bin/bash
set -e

# ========== [0] 配置 ==========
BUILD_DIR="/tmp/kylin_setup" 

OPENSSL_VERSION="1.1.1w"
OPENSSH_VERSION="9.8p1"
OPENSSL_URL="https://gh.llkk.cc/https://github.com/openssl/openssl/releases/download/OpenSSL_1_1_1w/openssl-${OPENSSL_VERSION}.tar.gz"
OPENSSH_URL="https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${OPENSSH_VERSION}.tar.gz"

OPENSSL_TAR="openssl-${OPENSSL_VERSION}.tar.gz"
OPENSSH_TAR="openssh-${OPENSSH_VERSION}.tar.gz"
OPENSSL_DIR="openssl-${OPENSSL_VERSION}"
OPENSSH_DIR="openssh-${OPENSSH_VERSION}"
OPENSSL_PREFIX="/usr/local/openssl"

# ========== [1] 安装依赖 ==========
echo -e "\n\033[33m[1/7] 安装依赖中...\033[0m"
yum install -y gcc make perl zlib zlib-devel pam pam-devel perl-IPC-Cmd wget tcp_wrappers-devel

# ========== [2] 备份旧版本 ==========
echo -e "\n\033[33m[2/7] 备份旧 OpenSSL...\033[0m"
mv /usr/bin/openssl /usr/bin/openssl.bak 2>/dev/null || true
mv /usr/include/openssl /usr/include/openssl.bak 2>/dev/null || true
mv /usr/lib64/openssl /usr/lib64/openssl.bak 2>/dev/null || true

echo -e "\n\033[33m备份旧 OpenSSH...\033[0m"
mv /etc/ssh /etc/ssh.bak 2>/dev/null || true
mv /usr/bin/ssh /usr/bin/ssh.bak 2>/dev/null || true
mv /usr/sbin/sshd /usr/sbin/sshd.bak 2>/dev/null || true
mv /etc/init.d/sshd /etc/init.d/sshd.bak 2>/dev/null || true

# ========== [3] 编译安装 OpenSSL ==========
echo -e "\n\033[33m[3/7] 编译安装 OpenSSL ${OPENSSL_VERSION}...\033[0m"
cd "$BUILD_DIR"
if [ ! -f "$OPENSSL_TAR" ]; then
    echo "未找到本地 OpenSSL 包 ($BUILD_DIR/$OPENSSL_TAR)，正在下载..."
    wget "$OPENSSL_URL"
else
    echo "使用本地 OpenSSL 包: $BUILD_DIR/$OPENSSL_TAR"
fi
rm -rf "$OPENSSL_DIR" && tar -zxf "$OPENSSL_TAR"
cd "$OPENSSL_DIR"
./config --prefix="$OPENSSL_PREFIX" --shared zlib
make -j$(nproc)
make install

echo "$OPENSSL_PREFIX/lib" > /etc/ld.so.conf.d/openssl-${OPENSSL_VERSION}.conf
ldconfig

ln -sf "$OPENSSL_PREFIX/bin/openssl" /usr/bin/openssl
ln -sf "$OPENSSL_PREFIX/include/openssl" /usr/include/openssl

# ========== [4] 编译安装 OpenSSH ==========
echo -e "\n\033[33m[4/7] 编译安装 OpenSSH ${OPENSSH_VERSION}...\033[0m"
cd "$BUILD_DIR"
if [ ! -f "$OPENSSH_TAR" ]; then
    echo "未找到本地 OpenSSH 包 ($BUILD_DIR/$OPENSSH_TAR)，正在下载..."
    wget "$OPENSSH_URL"
else
    echo "使用本地 OpenSSH 包: $BUILD_DIR/$OPENSSH_TAR"
fi
rm -rf "$OPENSSH_DIR" && tar -zxf "$OPENSSH_TAR"
cd "$OPENSSH_DIR"

./configure --prefix=/usr \
  --sysconfdir=/etc/ssh \
  --with-md5-passwords \
  --with-pam \
  --with-tcp-wrappers \
  --with-ssl-dir="$OPENSSL_PREFIX" \
  --with-privsep-path=/var/lib/sshd \
  --without-hardening

make -j$(nproc)
make install

# ========== [5] 配置 SSHD ==========
echo -e "\n\033[33m[5/7] 配置 SSHD...\033[0m"
ssh-keygen -A
sed -i 's/#\?PasswordAuthentication.*/PasswordAuthentication yes/' /etc/ssh/sshd_config
sed -i 's/#\?PermitRootLogin.*/PermitRootLogin yes/' /etc/ssh/sshd_config
echo "UsePAM yes" >> /etc/ssh/sshd_config

cp -pf contrib/redhat/sshd.init /etc/init.d/sshd
chmod +x /etc/init.d/sshd
chkconfig --add sshd
chkconfig sshd on

# ========== [6] 重启 SSHD ==========
echo -e "\n\033[33m[6/7] 重启 SSHD...\033[0m"
systemctl daemon-reexec || true
systemctl restart sshd || service sshd restart || /etc/init.d/sshd restart

# ========== [7] 验证 ==========
echo -e "\n\033[32m[7/7] 验证版本与依赖...\033[0m"
ssh -V
"$OPENSSL_PREFIX/bin/openssl" version
ldd /usr/sbin/sshd | grep ssl

echo -e "\n\033[32m完成：OpenSSL ${OPENSSL_VERSION} + OpenSSH ${OPENSSH_VERSION}\033[0m"

版本对比与排查

示例环境：CentOS 7.5 - 旧版本：OpenSSH_7.4p1，OpenSSL 1.0.2k-fips（2017-01-26） - 新版本：OpenSSH_9.8p1，OpenSSL 1.1.1w（2023-09-11）

检查 PAM：

grep UsePAM /etc/ssh/sshd_config

常见 PAM 配置示例：

# /etc/pam.d/sshd
# PAM configuration for the Secure Shell service
auth       required     pam_unix.so
account    required     pam_unix.so
password   required     pam_unix.so
session    required     pam_unix.so

# /etc/pam.d/sshd（CentOS 7.5 示例）
#%PAM-1.0
auth       required     pam_sepermit.so
auth       substack     password-auth
auth       include      postlogin
# Used with polkit to reauthorize users in remote sessions
-auth      optional     pam_reauthorize.so prepare
account    required     pam_nologin.so
account    include      password-auth
password   include      password-auth
# pam_selinux.so close should be the first session rule
session    required     pam_selinux.so close
session    required     pam_loginuid.so
# pam_selinux.so open should only be followed by sessions to be executed in the user context
session    required     pam_selinux.so open env_params
session    required     pam_namespace.so
session    optional     pam_keyinit.so force revoke
session    include      password-auth
session    include      postlogin
# Used with polkit to reauthorize users in remote sessions
-session   optional     pam_reauthorize.so prepare