CentOS 6.9 升级OpenSSH版本 关闭ssh服务后门

# 查看系统版本,最小化安装可能会没有centos-release的软件包,可以用下面的命令查看
[[email protected] ~]# rpm -q centos-release
centos-release-6-9.el6.12.3.x86_64
[[email protected] ~]# cat /etc/centos-release 
CentOS release 6.9 (Final)
[[email protected] ~]# cat /etc/issue
CentOS release 6.9 (Final)
Kernel \r on an \m

# 查看SSH版本 
[@L_502_3@ ~]# ssh -V
OpenSSH_5.3p1,OpenSSL 1.0.1e-fips 11 Feb 2013
[[email protected] ~]# ssh -V
OpenSSH_5.3p1,OpenSSL 1.0.1e-fips 11 Feb 2013
[[email protected] ~]# openssl version -a
OpenSSL 1.0.1e-fips 11 Feb 2013
built on: Wed Mar 22 21:43:28 UTC 2017
platform: linux-x86_64
options:  bn(64,64) md2(int) rc4(16x,int) des(idx,cisc,16,int) idea(int) blowfish(idX) 
compiler: gcc -fPIC -dopENSSL_PIC -DZLIB -dopENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DKRB5_MIT -m64 -DL_ENDIAN -DTERMIO -Wall -O2 -g -pipe -Wall -Wp,-D_FORTIFY_sourcE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic -Wa,--noexecstack -DPURIFY -dopENSSL_IA32_SSE2 -dopENSSL_BN_ASM_MONT -dopENSSL_BN_ASM_MONT5 -dopENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM
OPENSSLDIR: "/etc/pki/tls"
ENGInes:  rdrand dynamic 

[[email protected] ~]# cp -rf /etc/ssh{,.bak}

[[email protected] ~]# yum -y install telnet-server
[[email protected] ~]# vim /etc/xinetd.d/telnet
# default: on
# description: The telnet server serves telnet sessions; it uses #       unencrypted username/password pairs for authentication.
service telnet
{
        flags           = REUSE
        socket_type     = stream
        wait            = no
        user            = root
        server          = /usr/sbin/in.telnetd
        log_on_failure  += USERID
        disable         = no    # 将默认的yes改为no,否则telnet启动后，23端口就会起不来
}

[[email protected] ~]# /etc/init.d/xinetd restart
停止 xinetd：                                              [确定]
正在启动 xinetd：                                          [确定]
# 查看服务是否开启
[[email protected] ~]# netstat -antup|grep 23
tcp        0      0 :::23                       :::*                        LISTEN      2293/xinetd       

[[email protected] ~]# iptables -I INPUT -p tcp --dport 23 -j ACCEPT
[[email protected] ~]# iptables -I INPUT -p udp --dport 23 -j ACCEPT
# 临时关闭SElinux
[[email protected] ~]# getenforce 
Enforcing
[[email protected] ~]# setenforce 0

# 修改securetty文件 增加pts配置 如果登录用户较多，需要更多的pts/* [[email protected] ~]# vim /etc/securetty # 或者直接删除或修改文件名,避开验证规则实现root用户远程登录 [[email protected] ~]# rm -f /etc/securetty 

[[email protected] ~]# hostname -I
192.168.94.11 
[[email protected] ~]# telnet 192.168.94.66
Trying 192.168.94.66...
Connected to 192.168.94.66.
Escape character is ‘^]‘.
CentOS release 6.9 (Final)
Kernel 2.6.32-696.el6.x86_64 on an x86_64
DaMoWang.localdomain login: root
password: 
Last login: Mon Jun  4 22:52:19 from 192.168.94.1
[[email protected] ~]# hostname -I
192.168.94.66

[[email protected] ~]# cat /etc/centos-release
CentOS Linux release 7.5.1804 (CorE) 
[[email protected] ~]# vim /opt/restart-ssh.sh
#/bin/bash
ps -ef|grep "systemctl restart sshd"|awk ‘{print $2}‘|xargs kill -9
nohup systemctl restart sshd &
# 服务启动超时,杀掉ssh进程,再重启ssh服务
# 加到计划任务中 10秒执行一次