CentOS openssh升级到openssh-7.2版本

CentOS openssh升级到openssh-7.2版本
查看现在的版本SSH -V

一、准备
备份ssh目录(重要)
cp -rf /etc/ssh /etc/ssh.bak

【可以现场处理的，不用设置
安装telnet，避免ssh升级出现问题，导致无法远程管理
yum install telnet-server

vi /etc/xinetd.d/telnet
service telnet
{
        flags           = REUSE
        socket_type     = stream
        wait            = no
        user            = root
        server          = /usr/sbin/in.telnetd
        log_on_failure += USERID
        disable         = no
}

默认不允许root登录

vi /etc/securetty
增加
pts/0
pts/1
pts/2
如果登录用户较多，需要更多的pts/*
service xinetd restart
这样root可以telnet登录了

二、安装
升级需要几个组件
yum install -y gcc openssl-devel pam-devel rpm-build

现在新版本，目前是openssh-7.3最新，但刚刚出来，为保险，我选用7.2版本
wget http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-7.3p1.tar.gz
wget http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-7.2p1.tar.gz
wget http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-7.1p1.tar.gz

解压升级包，并安装
tar -zxvf openssh-7.2p1.tar.gz
cd openssh-7.2p1
./configure --prefix=/usr --sysconfdir=/etc/ssh --with-pam --with-zlib --with-md5-passwords --with-tcp-wrappers
make && make install

安装后提示：
/etc/ssh/ssh_config already exists, install will not overwrite
/etc/ssh/sshd_config already exists, install will not overwrite
/etc/ssh/moduli already exists, install will not overwrite
ssh-keygen: generating new host keys: ECDSA ED25519
/usr/sbin/sshd -t -f /etc/ssh/sshd_config
/etc/ssh/sshd_config line 81: Unsupported option GSSAPIAuthentication
/etc/ssh/sshd_config line 83: Unsupported option GSSAPICleanupCredentials

修改配置文件,允许root登录

vi /etc/ssh/sshd_config
#PermitRootLogin yes
修改为
PermitRootLogin yes

命令：
sed -i '/^#PermitRootLogin/s/#PermitRootLogin yes/PermitRootLogin yes/' /etc/ssh/sshd_config

重启openSSH
service sshd restart

升级后版本
ssh -V
OpenSSH_7.2p1, OpenSSL 1.0.1e-fips 11 Feb 2013

【
如果之前你将原ssh目录修改名字
mv /etc/ssh /etc/ssh_bak

需要修改下配置：
修改配置文件,禁止root登录
sed -i '/^#PermitRootLogin/s/#PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config

可以不操作，禁止dns解析
sed -i '/^#UseDNS yes/s/#UseDNS yes/UseDNS no/' /etc/ssh/sshd_config

可以不操作默认是22，修改ssh端口至6022
echo "Port 6022" >> /etc/ssh/sshd_config
】

注:在升级SSH时你的SSH是不会因为升级或重启服务而断掉的.

问题1：
[root@testserver2 tmp]# service sshd restart
Stopping sshd:                                             [ OK ]
Starting sshd: /etc/ssh/sshd_config line 81: Unsupported option GSSAPIAuthentication
/etc/ssh/sshd_config line 83: Unsupported option GSSAPICleanupCredentials [ OK ]

解决：
将/etc/ssh/sshd_config文件中以上行数内容注释下即可

sed -i '/^GSSAPICleanupCredentials/s/GSSAPICleanupCredentials yes/#GSSAPICleanupCredentials yes/' /etc/ssh/sshd_config
sed -i '/^GSSAPIAuthentication/s/GSSAPIAuthentication yes/#GSSAPIAuthentication yes/' /etc/ssh/sshd_config
sed -i '/^GSSAPIAuthentication/s/GSSAPIAuthentication no/#GSSAPIAuthentication no/' /etc/ssh/sshd_config

问题2：
更新后ssh有如下提示，但不影响使用：
[root@testserver2 tmp]# ssh 10.111.32.51
/etc/ssh/ssh_config line 50: Unsupported option "gssapiauthentication"

解决：
可以注释/etc/ssh/ssh_config的gssapiauthentication内容

------------------------------------------------------------------------------------------

CentOS7升级openssh参考这里的内容

本次使用源码安装（系统需要gcc），各软件版本如下：

zlib-1.2.8
openssl-1.0.2h
openssh-7.3p1

安装步骤如下：

1、安装zlib
[root@CentOS7test ~]# cd zlib-1.2.8/
[root@CentOS7test zlib-1.2.8]# ./configure
[root@CentOS7test zlib-1.2.8]# make
[root@CentOS7test zlib-1.2.8]# make install

2、安装openssl
[root@CentOS7test ~]# cd openssl-1.0.2h/
[root@CentOS7test openssl-1.0.2h]# ./config --prefix=/usr/ --shared
[root@CentOS7test openssl-1.0.2h]# make
[root@CentOS7test openssl-1.0.2h]# make install

3、安装openssh
[root@CentOS7test ~]# cd openssh-7.3p1/
[root@CentOS7test openssh-7.3p1]# ./configure --prefix=/usr/local --sysconfdir=/etc/ssh --with-pam --with-zlib --with-md5-passwords --with-tcp-wrappers
[root@CentOS7test openssh-7.3p1]# make
[root@CentOS7test openssh-7.3p1]# make install

4、查看版本是否已更新
[root@CentOS7test openssh-7.3p1]# ssh -V
OpenSSH_7.3p1, OpenSSL 1.0.2h 3 May 2016

5、新介质替换原有内容
[root@CentOS7test openssh-7.3p1]# mv /usr/bin/ssh /usr/bin/ssh_bak
[root@CentOS7test openssh-7.3p1]# cp /usr/local/bin/ssh /usr/bin/ssh
[root@CentOS7test openssh-7.3p1]# mv /usr/sbin/sshd /usr/sbin/sshd_bak
[root@CentOS7test openssh-7.3p1]# cp /usr/local/sbin/sshd /usr/sbin/sshd

6-加载ssh配置重启ssh服务
[root@CentOS7test ~]# systemctl daemon-reload
[root@CentOS7test ~]# systemctl restart sshd.service

7、遇到的问题解决

问题1：
安装完成后，telnet 22端口不通，通过systemctl status sshd.service查看发现有警告信息
部分信息如Permissions 0640 for '/etc/ssh/ssh_host_ecdsa_key' are too open

修正：
修改相关提示文件的权限为600，并重启sshd服务（systemctl restart sshd.service）
查看服务状态（systemctl status sshd.service）
例：chmod 600 /etc/ssh/ssh_host_ecdsa_key

问题2：
安装完成后，如需root直接登录

修正：
修改/etc/ssh/sshd_config文件，将文件中#PermitRootLogin yes改为PermitRootLogin yes
并重启sshd服务
升级后验证

问题3：

如果你使用了jenkins进行部署，升级后会影响jenkins部署，测试连接web端会报错 Algorithm negotiation fail

修正：

在web端修改sshd_config文件最后一行增加以下内容

KexAlgorithms diffie-hellman-group1-sha1,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1

参考：http://stackoverflow.com/questions/32627998/algorithm-negotiation-fail-in-jenkins

--------------------------------------------------------------

【临时修改版本号，运行很久的线上环境升级存在风险，如果可以的话只修改版本号吧（后期经过验证，这种修改版本号的方法无效，ssh -v IP可以查看版本）
查询
ssh -V
sshd -V

备份

cp /usr/bin/ssh /usr/bin/ssh.bak.version_edit
cp /usr/sbin/sshd /usr/sbin/sshd.bak.version_edit

修改

sed -i 's#OpenSSH_5.3p1#OpenSSH_7.2p1#g' /usr/bin/ssh
sed -i 's#OpenSSH_5.3p1#OpenSSH_7.2p1#g' /usr/sbin/sshd

】

补充汇总下：

centos7.X主机升级ssh
cp /usr/bin/ssh /usr/bin/ssh.bak.20161124
cp /usr/sbin/sshd /usr/bin/sshd.bak.20161124
mv /etc/ssh /etc/ssh.bak
---下载包、安装gcc 、编译等中间步骤参上边内容---
make && make install
/usr/sbin/sshd -t -f /etc/ssh/sshd_config
echo 'PermitRootLogin yes' >> /etc/ssh/sshd_config

cp /etc/ssh.bak/sshd_config /etc/ssh/sshd_config 将原来的文件覆盖下这个新生成的内容

/bin/systemctl restart sshd.service

centos6.X升级ssh
cp /usr/bin/ssh /usr/bin/ssh.bak.20161124
cp /usr/sbin/sshd /usr/bin/sshd.bak.20161124
cp -rf /etc/ssh /etc/ssh.bak
---下载包、安装gcc 、编译等中间步骤参上边内容---
make && make install
sed -i '/^#PermitRootLogin/s/#PermitRootLogin yes/PermitRootLogin yes/' /etc/ssh/sshd_config
sed -i '/^GSSAPICleanupCredentials/s/GSSAPICleanupCredentials yes/#GSSAPICleanupCredentials yes/' /etc/ssh/sshd_config
sed -i '/^UsePAM/s/UsePAM yes/#UsePAM yes/' /etc/ssh/sshd_config
sed -i '/^GSSAPIAuthentication/s/GSSAPIAuthentication yes/#GSSAPIAuthentication yes/' /etc/ssh/sshd_config
sed -i '/^GSSAPIAuthentication/s/GSSAPIAuthentication no/#GSSAPIAuthentication no/' /etc/ssh/sshd_config
service sshd restart

附录：

CentOS7 sshd_config配置内容
[python] view plain copy
1. # $OpenBSD: sshd_config,v 1.93 2014/01/10 05:59:19 djm Exp $
3. # This is the sshd server system-wide configuration file. See
4. # sshd_config(5) for more information.
6. # This sshd was compiled with PATH=/usr/local/bin:/usr/bin
8. # The strategy used for options in the default sshd_config shipped with
9. # OpenSSH is to specify options with their default value where
10. # possible, but leave them commented. Uncommented options override the
11. # default value.
13. # If you want to change the port on a SELinux system, you have to tell
14. # SELinux about this change.
15. # semanage port -a -t ssh_port_t -p tcp #PORTNUMBER
16. #
17. #Port 22
18. #AddressFamily any
19. #ListenAddress 0.0.0.0
20. #ListenAddress ::
22. # The default requires explicit activation of protocol 1
23. #Protocol 2
25. # HostKey for protocol version 1
26. #HostKey /etc/ssh/ssh_host_key
27. # HostKeys for protocol version 2
28. HostKey /etc/ssh/ssh_host_rsa_key
29. #HostKey /etc/ssh/ssh_host_dsa_key
30. HostKey /etc/ssh/ssh_host_ecdsa_key
31. HostKey /etc/ssh/ssh_host_ed25519_key
33. # Lifetime and size of ephemeral version 1 server key
34. #KeyRegenerationInterval 1h
35. #ServerKeyBits 1024
37. # Ciphers and keying
38. #RekeyLimit default none
40. # Logging
41. # obsoletes QuietMode and FascistLogging
42. #SyslogFacility AUTH
43. SyslogFacility AUTHPRIV
44. #LogLevel INFO
46. # Authentication:
48. #LoginGraceTime 2m
49. PermitRootLogin yes
50. #StrictModes yes
51. #MaxAuthTries 6
52. #MaxSessions 10
54. #RSAAuthentication yes
55. #PubkeyAuthentication yes
57. # The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
58. # but this is overridden so installations will only check .ssh/authorized_keys
59. AuthorizedKeysFile .ssh/authorized_keys
61. #AuthorizedPrincipalsFile none
63. #AuthorizedKeysCommand none
64. #AuthorizedKeysCommandUser nobody
66. # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
67. #RhostsRSAAuthentication no
68. # similar for protocol version 2
69. #HostbasedAuthentication no
70. # Change to yes if you don't trust ~/.ssh/known_hosts for
71. # RhostsRSAAuthentication and HostbasedAuthentication
72. #IgnoreUserKnownHosts no
73. # Don't read the user's ~/.rhosts and ~/.shosts files
74. #IgnoreRhosts yes
76. # To disable tunneled clear text passwords, change to no here!
77. #PasswordAuthentication yes
78. #PermitEmptyPasswords no
79. PasswordAuthentication yes
81. # Change to no to disable s/key passwords
82. #ChallengeResponseAuthentication yes
83. ChallengeResponseAuthentication no
85. # Kerberos options
86. #KerberosAuthentication no
87. #KerberosOrLocalPasswd yes
88. #KerberosTicketCleanup yes
89. #KerberosGetAFSToken no
90. #KerberosUseKuserok yes
92. # GSSAPI options
93. GSSAPIAuthentication yes
94. GSSAPICleanupCredentials no
95. #GSSAPIStrictAcceptorCheck yes
96. #GSSAPIKeyExchange no
97. #GSSAPIEnablek5users no
99. # Set this to 'yes' to enable PAM authentication, account processing,
100. # and session processing. If this is enabled, PAM authentication will
101. # be allowed through the ChallengeResponseAuthentication and
102. # PasswordAuthentication. Depending on your PAM configuration,
103. # PAM authentication via ChallengeResponseAuthentication may bypass
104. # the setting of "PermitRootLogin without-password".
105. # If you just want the PAM account and session checks to run without
106. # PAM authentication, then enable this but set PasswordAuthentication
107. # and ChallengeResponseAuthentication to 'no'.
108. # WARNING: 'UsePAM no' is not supported in Red Hat Enterprise Linux and may cause several
109. # problems.
110. UsePAM yes
112. #AllowAgentForwarding yes
113. #AllowTcpForwarding yes
114. #GatewayPorts no
115. X11Forwarding yes
116. #X11DisplayOffset 10
117. #X11UseLocalhost yes
118. #PermitTTY yes
119. #PrintMotd yes
120. #PrintLastLog yes
121. #TCPKeepAlive yes
122. #UseLogin no
123. UsePrivilegeSeparation sandbox # Default for new installations.
124. #PermitUserEnvironment no
125. #Compression delayed
126. #ClientAliveInterval 0
127. #ClientAliveCountMax 3
128. #ShowPatchLevel no
129. #UseDNS yes
130. UseDNS no
131. #PidFile /var/run/sshd.pid
132. #MaxStartups 10:30:100
133. #PermitTunnel no
134. #ChrootDirectory none
135. #VersionAddendum none
137. # no default banner path
138. #Banner none
140. # Accept locale-related environment variables
141. AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
142. AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
143. AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
144. AcceptEnv XMODIFIERS
146. # override default of no subsystems
147. Subsystem sftp /usr/libexec/openssh/sftp-server
149. # Example of overriding settings on a per-user basis
150. #Match User anoncvs
151. # X11Forwarding no
152. # AllowTcpForwarding no
153. # PermitTTY no
154. # ForceCommand cvs server
CentOS6 sshd_config配置内容
[python] view plain copy
1. # $OpenBSD: sshd_config,v 1.80 2008/07/02 02:24:18 djm Exp $
3. # This is the sshd server system-wide configuration file. See
4. # sshd_config(5) for more information.
6. # This sshd was compiled with PATH=/usr/local/bin:/bin:/usr/bin
8. # The strategy used for options in the default sshd_config shipped with
9. # OpenSSH is to specify options with their default value where
10. # possible, but leave them commented. Uncommented options change a
11. # default value.
13. #Port 22
14. #AddressFamily any
15. #ListenAddress 0.0.0.0
16. #ListenAddress ::
18. # Disable legacy (protocol version 1) support in the server for new
19. # installations. In future the default will change to require explicit
20. # activation of protocol 1
21. Protocol 2
23. # HostKey for protocol version 1
24. #HostKey /etc/ssh/ssh_host_key
25. # HostKeys for protocol version 2
26. #HostKey /etc/ssh/ssh_host_rsa_key
27. #HostKey /etc/ssh/ssh_host_dsa_key
29. # Lifetime and size of ephemeral version 1 server key
30. #KeyRegenerationInterval 1h
31. #ServerKeyBits 1024
33. # Logging
34. # obsoletes QuietMode and FascistLogging
35. #SyslogFacility AUTH
36. SyslogFacility AUTHPRIV
37. #LogLevel INFO
39. # Authentication:
41. #LoginGraceTime 2m
42. PermitRootLogin yes
43. #StrictModes yes
44. #MaxAuthTries 6
45. #MaxSessions 10
47. #RSAAuthentication yes
48. #PubkeyAuthentication yes
49. #AuthorizedKeysFile .ssh/authorized_keys
50. #AuthorizedKeysCommand none
51. #AuthorizedKeysCommandRunAs nobody
53. # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
54. #RhostsRSAAuthentication no
55. # similar for protocol version 2
56. #HostbasedAuthentication no
57. # Change to yes if you don't trust ~/.ssh/known_hosts for
58. # RhostsRSAAuthentication and HostbasedAuthentication
59. #IgnoreUserKnownHosts no
60. # Don't read the user's ~/.rhosts and ~/.shosts files
61. #IgnoreRhosts yes
63. # To disable tunneled clear text passwords, change to no here!
64. #PasswordAuthentication yes
65. #PermitEmptyPasswords no
66. PasswordAuthentication yes
68. # Change to no to disable s/key passwords
69. #ChallengeResponseAuthentication yes
70. ChallengeResponseAuthentication no
72. # Kerberos options
73. #KerberosAuthentication no
74. #KerberosOrLocalPasswd yes
75. #KerberosTicketCleanup yes
76. #KerberosGetAFSToken no
77. #KerberosUseKuserok yes
79. # GSSAPI options
80. #GSSAPICleanupCredentials yes
81. #GSSAPICleanupCredentials yes
82. #GSSAPIStrictAcceptorCheck yes
83. #GSSAPIKeyExchange no
85. # Set this to 'yes' to enable PAM authentication, account processing,
86. # and session processing. If this is enabled, PAM authentication will
87. # be allowed through the ChallengeResponseAuthentication and
88. # PasswordAuthentication. Depending on your PAM configuration,
89. # PAM authentication via ChallengeResponseAuthentication may bypass
90. # the setting of "PermitRootLogin without-password".
91. # If you just want the PAM account and session checks to run without
92. # PAM authentication, then enable this but set PasswordAuthentication
93. # and ChallengeResponseAuthentication to 'no'.
94. #UsePAM no
95. UsePAM yes
97. # Accept locale-related environment variables
98. AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
99. AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
100. AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
101. AcceptEnv XMODIFIERS
103. #AllowAgentForwarding yes
104. #AllowTcpForwarding yes
105. #GatewayPorts no
106. #X11Forwarding no
107. X11Forwarding yes
108. #X11DisplayOffset 10
109. #X11UseLocalhost yes
110. #PrintMotd yes
111. #PrintLastLog yes
112. #TCPKeepAlive yes
113. #UseLogin no
114. UseLogin no
115. #UsePrivilegeSeparation yes
116. #PermitUserEnvironment no
117. #Compression delayed
118. #ClientAliveInterval 0
119. #ClientAliveCountMax 3
120. #ShowPatchLevel no
121. #PidFile /var/run/sshd.pid
122. #MaxStartups 10
123. #PermitTunnel no
124. #ChrootDirectory none
126. # no default banner path
127. #Banner none
129. # override default of no subsystems
130. Subsystem sftp /usr/libexec/openssh/sftp-server
132. # Example of overriding settings on a per-user basis
133. #Match User anoncvs
134. # X11Forwarding no
135. # AllowTcpForwarding no
136. # ForceCommand cvs server
137. UseDNS no
138. #GSSAPIAuthentication no
139. #GSSAPIAuthentication yes
20161205补充：

实际使用中发现ansible和jenkins使用时有些问题，网上查询了下，需要在/etc/ssh/sshd_config文件中最后增加两行：
[python] view plain copy
1. Ciphers aes128-cbc,aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr,3des-cbc,arcfour128,arcfour256,arcfour,blowfish-cbc,cast128-cbc
3. KexAlgorithms diffie-hellman-group1-sha1,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1
因为升级了openssh太新导致通信时加密算法出现问题，加上后重启就可以了。

20170428补充：

升级openssh版本脚本
[plain] view plain copy
1. cp /usr/bin/ssh /usr/bin/ssh.bak.20161124
2. cp /usr/sbin/sshd /usr/bin/sshd.bak.20161124
3. cp -rf /etc/ssh /etc/ssh.bak
4. yum install -y gcc openssl-devel pam-devel rpm-build
5. wget http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-7.2p1.tar.gz
6. tar -zxvf openssh-7.2p1.tar.gz && cd openssh-7.2p1 && ./configure --prefix=/usr --sysconfdir=/etc/ssh --with-pam --with-zlib --with-md5-passwords --with-tcp-wrappers && make && make install
7. sed -i '/^#PermitRootLogin/s/#PermitRootLogin yes/PermitRootLogin yes/' /etc/ssh/sshd_config
8. sed -i 's/GSSAPIAuthentication yes/#GSSAPIAuthentication yes/' /etc/ssh/ssh_config
9. sed -i '/^GSSAPICleanupCredentials/s/GSSAPICleanupCredentials yes/#GSSAPICleanupCredentials yes/' /etc/ssh/sshd_config
10. sed -i '/^GSSAPIAuthentication/s/GSSAPIAuthentication yes/#GSSAPIAuthentication yes/' /etc/ssh/sshd_config
11. sed -i '/^GSSAPIAuthentication/s/GSSAPIAuthentication no/#GSSAPIAuthentication no/' /etc/ssh/sshd_config
12. #sed -i '/^#UsePAM/s/#UsePAM yes/UsePAM yes/' /etc/ssh/sshd_config 如果内网使用ldap需要设置这项
14. echo "
15. #ansible support" >>/etc/ssh/sshd_config
16. echo "Ciphers aes128-cbc,aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr,3des-cbc,arcfour128,arcfour256,arcfour,blowfish-cbc,cast128-cbc" >>/etc/ssh/sshd_config
17. echo "
19. service sshd restart
重要提示：最近发现，在升级完ssh版本后，如果你进行了系统update或者升级用到ssh包的相关软件包，会导致ssh的版本回退到原来的版本。

20170504补充：

对于linux执行update，会导致升级后的ssh恢复到之前版本问题，处理方式（新版本ssh安装到不用的目录中，系统启动使用新目录的ssh）

一、备份文件
cp /usr/bin/ssh /usr/bin/ssh.bak.20171124
cp /usr/sbin/sshd /usr/bin/sshd.bak.20171124
cp -rf /etc/ssh /etc/ssh.bak.20171124

二、安装（/usr/local/ssh7为新目录，/usr/local/ssh7/ssh放置配置文件）
yum install -y gcc openssl-devel pam-devel rpm-build
wget http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-7.2p1.tar.gz
tar -zxvf openssh-7.2p1.tar.gz && cd openssh-7.2p1 && ./configure --prefix=/usr/local/ssh7 --sysconfdir=/usr/local/ssh7/ssh --with-pam --with-zlib --with-md5-passwords

--with-tcp-wrappers && make && make install

三、修改sshd_config内容
vi /usr/local/ssh7/ssh/sshd_config文件内容：

Port 22
Protocol 2
PermitRootLogin yes
AuthorizedKeysFile .ssh/authorized_keys
ChallengeResponseAuthentication no
UsePAM yes
AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
AcceptEnv XMODIFIERS
X11Forwarding yes
Subsystem sftp /usr/local/ssh7/libexec/sftp-server
UseDNS no
#ansible支持加入
Ciphers aes128-cbc,aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr,3des-cbc,arcfour128,arcfour256,arcfour,blowfish-cbc,cast128-cbc
#jenkins支持加入
KexAlgorithms diffie-hellman-group1-sha1,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-

sha256,diffie-hellman-group14-sha1

四、修改启动文件
cp /etc/init.d/sshd /etc/init.d/sshd7
mv /etc/init.d/sshd /etc/init.d/sshd.bak.20171124

vi /etc/init.d/sshd7
修改：
#SSHD=/usr/sbin/sshd 为
SSHD=/usr/local/ssh7/sbin/sshd

修改：
#[ -f /etc/ssh/sshd_config ] || exit 6 为
[ -f /usr/local/ssh7/ssh/sshd_config ] || exit 6

五、root下修改环境变量
# vi /etc/profile.d/ssh7.sh
export SSH_7=/usr/local/ssh7
export PATH=${SSH_7}/bin:${SSH_7}/sbin:$PATH

六、重启ssh
service sshd7 restart
以后需要这样重启ssh服务
相关阅读:
外部程序启动App
简单修改文件名python脚本
 监听软键盘的显示
 ActionBar 笔记
 ActionBar 笔记
 Android Lock Pattern 图案解锁
 通过反射实现圆角ImageView
android 通过命令行启动Apk
ubuntu svn rabbitvcs 安装
 Android 两个界面间快速切换时，会发现有短暂黑屏
原文地址：https://www.cnblogs.com/lic1005/p/8205344.html