OpenSSH 소스 설치 [2]

실습> OpenSSH 소스 설치하기

다른 리눅스 서버에 구현한다.

-- 조건 --
1. 각자 구현하기 
2. 최신 버전의 OpenSSH 서버 설치
- 2021.12.8 버전 : OpenSSH 8.8 released September 26, 2021
-- 조건 --

1. 소스 다운로드
Server1 ~# mkdir openssh; cd openssh
Server1 openssh# yum -y install wget
Server1 openssh# wget https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-8.8p1.tar.gz

2. 압축 해제
Server1 openssh# tar xzf openssh-8.8p1.tar.gz
Server1 openssh# cd openssh-8.8p1

환경설정 옵션은 아래와 같다.
Server1 openssh# ./configure --help

--prefix : 설치 디렉터리
--with-ssl-dir : openssl 디렉터리 
--with-privsep-user : 사용자 
--with-zlib : 압축 라이브러리
--with-pam  : pam 인증 모듈
--with-md5-passwords :  MD5 passwords

3. 라이브러리 설치
컴파일에 필요한 개발 라이브러리들을 설치한다.
Server1 openssh-8.8p1# yum -y install gcc make pam-devel zlib-devel openssl-devel

4. 환경설정
--help 옵션을 주고 옵션들을 확인한다.
Server1 openssh-8.8p1# ./configure --help

Server1 openssh-8.8p1# ./configure \
--prefix=/usr/local/openssh \
--with-ssl-dir \
--with-privsep-user=sshd \
--with-zlib \
--with-pam \
--with-md5-passwords
  :
  :
OpenSSH has been configured with the following options:
                     User binaries: /usr/local/openssh/bin
                   System binaries: /usr/local/openssh/sbin
               Configuration files: /usr/local/openssh/etc
                   Askpass program: /usr/local/openssh/libexec/ssh-askpass
                      Manual pages: /usr/local/openssh/share/man/manX
                          PID file: /var/run
  Privilege separation chroot path: /var/empty
            sshd default user PATH: /usr/bin:/bin:/usr/sbin:/sbin:/usr/local/openssh/bin
                    Manpage format: doc
                       PAM support: yes
                   OSF SIA support: no
                 KerberosV support: no
                   SELinux support: no
              MD5 password support: yes
                   libedit support: no
                   libldns support: no
  Solaris process contract support: no
           Solaris project support: no
         Solaris privilege support: no
       IP address in $DISPLAY hack: no
           Translate v4 in v6 hack: yes
                  BSD Auth support: no
              Random number source: OpenSSL internal ONLY
             Privsep sandbox style: seccomp_filter
                   PKCS#11 support: yes
                  U2F/FIDO support: yes

              Host: x86_64-pc-linux-gnu
          Compiler: cc
    Compiler flags: -g -O2 -pipe -Wall -Wextra -Wpointer-arith -Wuninitialized -Wsign-compare -Wformat-security -Wsizeof-pointer-memaccess -Wno-pointer-sign -Wno-unused-parameter -Wno-unused-result -fno-strict-aliasing -D_FORTIFY_SOURCE=2 -ftrapv -fno-builtin-memset -fstack-protector-strong -fPIE  
Preprocessor flags: -Iyes  -D_XOPEN_SOURCE=600 -D_BSD_SOURCE -D_DEFAULT_SOURCE
      Linker flags: -Lyes  -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -fstack-protector-strong -pie 
         Libraries: -lcrypto -ldl -lutil -lz  -lcrypt -lresolv
         +for sshd:  -lpam

PAM is enabled. You may need to install a PAM control file 
for sshd, otherwise password authentication may fail. 
Example PAM control files can be found in the contrib/ 
subdirectory

5. 컴파일

cc : gcc 의 심볼릭 링크
-D : define
-L : 라이브러리 디렉터리 위치 지정
-l : 라이브러리명 지정
-o : 실행파일
-I : 헤더파일 디렉터리 위치 지정

소스 파일들을 make(Makefile 참고)를 이용해서 컴파일한다.
Server1 openssh-8.8p1# make

6. 설치
컴파일된 바이너리 파일들을 시스템에 설치한다.
설치 디렉터리는 --prefix 옵션에 설정한 /usr/local/openssh에 설치된다.
Server1 openssh-8.8p1# make install
Server1 openssh-8.8p1# yum -y install tree
Server1 openssh-8.8p1# tree /usr/local/openssh
/usr/local/openssh/
├── bin
│   ├── scp
│   ├── sftp
│   ├── ssh
│   ├── ssh-add
│   ├── ssh-agent
│   ├── ssh-keygen
│   └── ssh-keyscan
├── etc
│   ├── moduli
│   ├── ssh_config
│   ├── ssh_host_dsa_key
│   ├── ssh_host_dsa_key.pub
│   ├── ssh_host_ecdsa_key
│   ├── ssh_host_ecdsa_key.pub
│   ├── ssh_host_ed25519_key
│   ├── ssh_host_ed25519_key.pub
│   ├── ssh_host_rsa_key
│   ├── ssh_host_rsa_key.pub
│   └── sshd_config
├── libexec
│   ├── sftp-server
│   ├── ssh-keysign
│   ├── ssh-pkcs11-helper
│   └── ssh-sk-helper
├── sbin
│   └── sshd
└── share
    └── man
        ├── man1
        │   ├── scp.1
        │   ├── sftp.1
        │   ├── ssh-add.1
        │   ├── ssh-agent.1
        │   ├── ssh-keygen.1
        │   ├── ssh-keyscan.1
        │   └── ssh.1
        ├── man5
        │   ├── moduli.5
        │   ├── ssh_config.5
        │   └── sshd_config.5
        └── man8
            ├── sftp-server.8
            ├── ssh-keysign.8
            ├── ssh-pkcs11-helper.8
            ├── ssh-sk-helper.8
            └── sshd.8

9 directories, 38 files


리눅스를 설치할 때 설치되어 있는 openssh* 패키지들을 삭제한다.
Server1 openssh-8.8p1# systemctl stop sshd
Server1 openssh-8.8p1# yum -y remove openssh openssh-server openssh-clients
Server1 openssh-8.8p1# rpm -qa | grep openssh
  <-- 아무것도 나오지 않으면 openssh* 패키지들이 잘 삭제된 것이다.
Server1 redhat# rm -rf /etc/ssh

7. 세팅
Server1 openssh-8.8p1# cd contrib/redhat
Server1 redhat# cp sshd.pam /etc/pam.d/sshd
Server1 redhat# cp sshd.init /etc/init.d/sshd
Server1 redhat# chkconfig --add sshd
Server1 redhat# chkconfig --list sshd
Server1 redhat# ln -s /usr/local/openssh/etc /etc/ssh
Server1 redhat# ln -s /usr/local/openssh/bin/* /usr/bin
Server1 redhat# ln -s /usr/local/openssh/sbin/* /usr/sbin
Server1 redhat# ln -s /usr/local/openssh/libexec/* /usr/sbin

8. 데몬 실행
Server1 redhat# vi /etc/ssh/sshd_config
Port 2021
Port 22
PermitRootLogin no

Server1 redhat# cd

semanage를 사용하기 위해서 policycoreutils-python 패키지를 설치한다.
Server1 ~# yum -y install policycoreutils-python

ssh_port_t 가 사용하는 포트를 확인한다.
Server1 ~# semanage port -l | grep ssh_port
ssh_port_t                     tcp      22

포트 등록
SELinux가 활성화된 상태에서는 포트번호를 변경하기 위해서는 semanage 명령어를 사용해서 
ssh_port_t 의 포트를 등록하고 sshd 데몬을 재시작해야 한다.
형식 : semanage port -a -t ssh_port_t -p tcp 포트번호

Server1 ~# semanage port -a -t ssh_port_t -p tcp 2021
Server1 ~# semanage port -l | grep ssh_port
ssh_port_t                     tcp      2021, 22

ssh 서비스를 시작한다.
Server1 ~# /etc/init.d/sshd start
Starting sshd (via systemctl):                             [  OK  ]

Server1 ~# ssh -V
OpenSSH_8.4p1, OpenSSL 1.0.2k-fips  26 Jan 2017

9. 서버 접속
Server1 ~# useradd -G wheel limanet
Server1 ~# passwd limanet

putty로 접속해서 ssh가 잘 동작하는지 확인한다.
login as: limanet
limanet@192.168.8.20's password:
Last login: Thu Jan 28 06:47:22 2021 from 192.168.8.1

Server1 ~$ su -
암호:
마지막 로그인: 수 12월  8 07:15:01 KST 2021 일시 pts/0
Server1 ~# yum -y install telnet
Server1 ~# telnet localhost 2021
Trying ::1...
Connected to localhost.
Escape character is '^]'.
SSH-2.0-OpenSSH_8.8       <-- 버전이 8.8이 나오면 설치가 성공!!!