运维杂项

1.Centos7安装docker

BASH

$ cat <<EOF >  /etc/sysctl.d/docker.conf
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
net.ipv4.ip_forward=1
EOF
 
$ sysctl -p /etc/sysctl.d/docker.conf
 
## 下载阿里源repo文件
$ curl -o /etc/yum.repos.d/Centos-7.repo http://mirrors.aliyun.com/repo/Centos-7.repo
$ curl -o /etc/yum.repos.d/docker-ce.repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
 
$ yum clean all && yum makecache
## yum安装
$ yum install docker-ce-20.10.18 -y
## 查看源中可用版本
$ yum list docker-ce --showduplicates | sort -r
## 安装旧版本

2.Centos7升级内核版本

BASH

3.Centos7升级sudo

BASH

4.Centos7升级bash

BASH

5.Centos7升级openssl和openssh

当前组件版本

BASH

SHELL

OpenSSL升级步骤

SHELL

OpenSSH升级步骤

SHELL

以上组件最新版本

SHELL

wget https://github.com/openssl/openssl/releases/download/openssl-3.6.0/openssl-3.6.0.tar.gz

wget http://193.49.22.109/elrepo/kernel/el7/x86_64/RPMS/kernel-lt-5.4.278-1.el7.elrepo.x86_64.rpm
wget http://193.49.22.109/elrepo/kernel/el7/x86_64/RPMS/kernel-lt-devel-5.4.278-1.el7.elrepo.x86_64.rpm
rpm -ivh kernel-lt-5.4.278-1.el7.elrepo.x86_64.rpm 
rpm -ivh kernel-lt-devel-5.4.278-1.el7.elrepo.x86_64.rpm 
rpm -qa | grep kernel
awk -F\' '$1=="menuentry " {print $2}' /etc/grub2.cfg
grubby --default-kernel
grub2-set-default  0 && grub2-mkconfig -o /etc/grub2.cfg
grubby --args="user_namespace.enable=1" --update-kernel="$(grubby --default-kernel)"
grubby --default-kernel
reboot

tar -zxvf sudo-1.9.16.tar.gz 
cp -r /usr/bin/sudo /usr/bin/sudo.bak
cp -r /etc/sudoers /etc/sudoers.bak
tar -zxvf sudo-1.9.16.tar.gz
cd sudo-1.9.16
./configure --prefix=/usr  --libexecdir=/usr/lib  --with-secure-path  --with-all-insults  --with-env-editor  --docdir=/usr/share/doc/sudo-1.9.16 --with-passprompt="[sudo] password for %p: " 
make
make install
ln -sfv libsudo_util.so.0.0.0 /usr/lib/sudo/libsudo_util.so.0
sudo -V

/bin/bash --version
wget -v http://ftp.gnu.org/gnu/bash/bash-5.1.16.tar.gz
tar zxvf bash-5.1.16.tar.gz
cd bash-5.1.16/
./configure
make
make install
mv /bin/bash /bin/bash.bak && ln -s /usr/local/bin/bash /bin/bash
/bin/bash --version

[root@tamkems-yy ~]# ssh -V
OpenSSH_7.4p1, OpenSSL 1.0.2k-fips  26 Jan 2017
[root@tamkems-yy ~]# openssl version
OpenSSL 1.0.2k-fips  26 Jan 2017

1.创建备份目录
 
mkdir -p /root/ssh*backup*$(date +%Y%m%d)
 
2.备份当前配置
cp -r /etc/ssh/* /root/sshbackup$(date +%Y%m%d)/
cp /etc/sysconfig/sshd /root/sshbackup$(date +%Y%m%d)/
 
3. 安装必要的编译工具
```bash
# 安装开发工具组
yum groupinstall -y "Development Tools"
# 安装依赖包
yum install -y zlib-devel openssl-devel perl perl-devel pam-devel

1. 下载和解压
cd /usr/local/src
wget https://www.openssl.org/source/openssl-1.1.1w.tar.gz
tar -zxf openssl-1.1.1w.tar.gz
cd openssl-1.1.1w
2. 编译安装
# 配置
./config --prefix=/usr/local/openssl shared zlib 
或者
./config --prefix=/usr/local/openssl CFLAGS="-std=gnu99 -O3" LDFLAGS="-lpthread"
# 编译和测试
make
make test
 
# 安装
make install
3. 配置环境
# 配置动态链接库
echo "/usr/local/openssl/lib" > /etc/ld.so.conf.d/openssl.conf
或者
echo "/usr/local/openssl/lib64" > /etc/ld.so.conf.d/openssl-3.6.0.conf
ldconfig
 
# 替换原有的OpenSSL
mv /usr/bin/openssl /usr/bin/openssl.old
ln -s /usr/local/openssl/bin/openssl /usr/bin/openssl

1. 下载和解压
cd /usr/local/src
wget https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-9.6p1.tar.gz
tar -zxf openssh-9.6p1.tar.gz
cd openssh-9.6p1
2. 编译安装
# 配置
./configure \
    --prefix=/usr \
    --sysconfdir=/etc/ssh \
    --with-ssl-dir=/usr/local/openssl \
    --with-zlib \
    --with-pam \
    --with-md5-passwords \
    --with-tcp-wrappers
 
# 编译和安装
make
make install
3. 创建systemd服务配置
# 创建 systemd 服务文件
cat > /usr/lib/systemd/system/sshd.service << 'EOF'
[Unit]
Description=OpenSSH server daemon
Documentation=man:sshd(8) man:sshd_config(5)
After=network.target
 
[Service]
Type=exec
ExecStart=/usr/sbin/sshd -D -e
ExecReload=/bin/kill -HUP $MAINPID
KillMode=process
Restart=on-failure
RestartSec=3s
 
[Install]
WantedBy=multi-user.target
EOF
4. 更新SSH配置文件
# 创建新的 sshd_config 配置文件
cat > /etc/ssh/sshd_config << 'EOF'
# 基本配置
Port 22
AddressFamily any
ListenAddress 0.0.0.0
ListenAddress ::
 
# 协议版本
Protocol 2
 
# 主机密钥
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key
 
# 日志级别
SyslogFacility AUTHPRIV
LogLevel INFO
 
# 认证配置
PermitRootLogin yes
PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys
PasswordAuthentication yes
PermitEmptyPasswords no
ChallengeResponseAuthentication no
 
# 其他设置
X11Forwarding yes
PrintMotd no
UsePAM yes
UseDNS no
Subsystem sftp /usr/libexec/openssh/sftp-server
EOF
5. 设置正确的文件权限
# 设置关键文件权限
chmod 755 /usr/sbin/sshd
chmod 755 /etc/ssh
chmod 644 /etc/ssh/sshd_config
chmod 600 /etc/ssh/ssh_host_*_key
chmod 644 /etc/ssh/ssh_host_*_key.pub
6. 重启服务
# 重新加载 systemd 配置
systemctl daemon-reload
 
# 重启 sshd 服务
systemctl restart sshd
 
# 检查服务状态
systemctl status sshd
7. 验证升级
# 检查 SSH 版本
ssh -V
 
# 尝试本地连接测试
ssh -v localhost