CentOS 6.9 升级OpenSSH版本 关闭ssh服务后门

# 查看系统版本 , 最小化安装可能会没有centos-release的软件包 , 可以用下面的命令查看
[root@DaMoWang ~]# rpm -q centos-release
centos-release-6-9.el6.12.3.x86_64
[root@DaMoWang ~]# cat /etc/centos-release 
CentOS release 6.9 (Final)
[root@DaMoWang ~]# cat /etc/issue
CentOS release 6.9 (Final)
Kernel \r on an \m

# 查看SSH版本 
[root@DaMoWang ~]# ssh -V
OpenSSH_5.3p1, OpenSSL 1.0.1e-fips 11 Feb 2013
[root@DaMoWang ~]# ssh -V
OpenSSH_5.3p1, OpenSSL 1.0.1e-fips 11 Feb 2013
[root@DaMoWang ~]# openssl version -a
OpenSSL 1.0.1e-fips 11 Feb 2013
built on: Wed Mar 22 21:43:28 UTC 2017
platform: linux-x86_64
options:  bn(64,64) md2(int) rc4(16x,int) des(idx,cisc,16,int) idea(int) blowfish(idx) 
compiler: gcc -fPIC -DOPENSSL_PIC -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DKRB5_MIT -m64 -DL_ENDIAN -DTERMIO -Wall -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic -Wa,--noexecstack -DPURIFY -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM
OPENSSLDIR: "/etc/pki/tls"
engines:  rdrand dynamic 

[root@DaMoWang ~]# cp -rf /etc/ssh{,.bak}

[root@DaMoWang ~]# yum -y install telnet-server
[root@DaMoWang ~]# vim /etc/xinetd.d/telnet
# default: on
# description: The telnet server serves telnet sessions; it uses #       unencrypted username/password pairs for authentication.
service telnet
{
        flags           = REUSE
        socket_type     = stream
        wait            = no
        user            = root
        server          = /usr/sbin/in.telnetd
        log_on_failure  += USERID
        disable         = no    # 将默认的yes改为no , 否则telnet启动后，23端口就会起不来
}

[root@DaMoWang ~]# /etc/init.d/xinetd restart
停止 xinetd：                                              [确定]
正在启动 xinetd：                                          [确定]
# 查看服务是否开启
[root@DaMoWang ~]# netstat -antup|grep 23
tcp        0      0 :::23                       :::*                        LISTEN      2293/xinetd       

[root@DaMoWang ~]# iptables -I INPUT -p tcp --dport 23 -j ACCEPT
[root@DaMoWang ~]# iptables -I INPUT -p udp --dport 23 -j ACCEPT
# 临时关闭SElinux
[root@DaMoWang ~]# getenforce 
Enforcing
[root@DaMoWang ~]# setenforce 0

# 修改securetty文件 增加pts配置 如果登录用户较多，需要更多的pts/*
[root@DaMoWang ~]# vim /etc/securetty 

# 或者直接删除或修改文件名 , 避开验证规则实现root用户远程登录
[root@DaMoWang ~]# rm -f /etc/securetty 

[root@test ~]# hostname -I
192.168.94.11 
[root@test ~]# telnet 192.168.94.66
Trying 192.168.94.66...
Connected to 192.168.94.66.
Escape character is ‘^]‘.
CentOS release 6.9 (Final)
Kernel 2.6.32-696.el6.x86_64 on an x86_64
DaMoWang.localdomain login: root
Password: 
Last login: Mon Jun  4 22:52:19 from 192.168.94.1
[root@DaMoWang ~]# hostname -I
192.168.94.66

[root@test ~]# ssh -p22 192.168.94.66
The authenticity of host ‘192.168.94.66 (192.168.94.66)‘ can‘t be established.
ECDSA key fingerprint is SHA256:/r5E0VYms6owRZhRXVckaVAgrT5eytIEUO7+D80rfbU.
ECDSA key fingerprint is MD5:1a:0e:a2:82:a5:08:bc:ed:23:7b:f7:c3:47:f0:dd:3b.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added ‘192.168.94.66‘ (ECDSA) to the list of known hosts.
root@192.168.94.66‘s password: 
Last login: Sat Aug 25 01:12:57 2018 from 192.168.94.66
[root@DaMoWang ~]# hostname -I
192.168.94.66