How do I download, install, or upgrade OpenSSL and OpenSSH on AIX?

野性酷女 2023-10-06 12:57 23阅读 0赞

1.  Download the OpenSSL package to your workstation or host computer.
    
    1.  To get the package, go to the [AIX® Web Download Pack Programs][AIX_ Web Download Pack Programs] website.
    2.  If you are registered to download the packages, sign in and accept the license agreement.
    3.  If you are not registered to download the packages, complete the registration process and accept the license agreement. After registering, you are redirected to the download page.
    4.  Select the package for download: openSSL and click Continue.
    5.  Select any version of the package and click Download now.
2.  Download the OpenSSH software by completing the following steps:
    
    NoteAlternatively, you can install the software from the AIX Expansion Pack.
    
    1.  From your workstation (or host computer), go to the [SourceFORGE.net][] Web site.
    2.  Click Download OpenSSH on AIX to view the latest file releases.
    3.  Select the appropriate download package and click Download.
    4.  Click the openssh package (tar.Z file) to continue with the download.

**1) Download the latest available "OpenSSL or OpenSSH n.n.n" for your AIX version from the following download link:**

[https://www-01.ibm.com/marketing/iwm/platform/mrs/assets?source=aixbp][https_www-01.ibm.com_marketing_iwm_platform_mrs_assets_source_aixbp]

*- Register for a user ID [at the site][] if you do not have an account*

NOTE: This download site is not managed by AIX Support. If you have problems accessing or registering at the site, please send an email to [mktsystm@us.ibm.com][mktsystm_us.ibm.com] describing the errors.>

The following example is the latest version at the time of publishing. Always check the download site, and corresponding readme files for information pertaining to your AIX oslevel.

<table> 
 <tbody> 
  <tr> 
   <td> <p><strong>openssl</strong></p> 
    <ul> 
     <li><strong>VRMF: 1.0.2.1801 (1.0.2r)</strong> 
      <ul> 
       <li>openssl-1.0.2.1801.tar.Z&nbsp;&nbsp;(34779877)</li> 
      </ul></li> 
    </ul><p><strong>openssh</strong></p> 
    <ul> 
     <li><strong>VRMF: 7.5.102.1801</strong> 
      <ul> 
       <li>OpenSSH_7.5.102.1801.tar.Z&nbsp; (11765639)</li> 
      </ul></li> 
    </ul><p>***<strong>NOTE:&nbsp;</strong>OpenSSL must be installed first.</p> </td> 
  </tr> 
 </tbody> 
</table>

**2) Create directory to hold openssl and openssh.**

Example:

<table> 
 <tbody> 
  <tr> 
   <td> <p>% mkdir /tmp/newopenssl</p> <p>% mkdir /tmp/newopenssh</p> </td> 
  </tr> 
 </tbody> 
</table>

Transfer the compressed OpenSSL tar file to the /tmp/newopenssl directory.

Transfer the compressed OpenSSH tar file to the /tmp/newopenssh directory  
  
**3) If /etc/ssh exists before the upgrade of OpenSSH or AIX, make a back up of the directory. Skip steps 3 and 9-10 if OpenSSH is not installed.**

<table> 
 <tbody> 
  <tr> 
   <td><strong>Important Notes</strong></td> 
  </tr> 
  <tr> 
   <td> <p><strong>A) If you have an existing ssh configuration, make a copy of the /etc/ssh directory before installing the new ssh to preserve the ssh host keys. If this is a new installation of ssh there will not be an /etc/ssh directory.</strong></p> <p><br> &nbsp;&nbsp;% cp -pr /etc/ssh /etc/ssh_backup</p> &nbsp; <p><strong><strong>B) Read&nbsp;the following technote for details about changes in OpenSSH Version 7.&nbsp;</strong></strong></p> <p><strong><a href="https://www.ibm.com/support/pages/ibm-aix-various-ssh-problems-after-upgrading-openssh-7x" rel="nofollow">https://www.ibm.com/support/pages/ibm-aix-various-ssh-problems-after-upgrading-openssh-7x</a></strong></p> </td> 
  </tr> 
 </tbody> 
</table>

**4) Prepare the openssl software for installation.**

<table> 
 <tbody> 
  <tr> 
   <td> <p>% cd /tmp/newopenssl</p> <p>% uncompressopenssl-1.0.2.1801.tar.Z&nbsp;</p> <p>% tar -xvfopenssl-1.0.2.1801.tar</p> <p>% cd &lt;newly created openssl directory if one was created&gt;</p> </td> 
  </tr> 
 </tbody> 
</table>

**5) Install the openssl software.**

<table> 
 <tbody> 
  <tr> 
   <td> <p>% smitty install_all&nbsp;<em>INPUT device / directory for software [.]</em></p> <p><strong>&lt;enter&gt;</strong><em>&nbsp;* INPUT device / directory for software . * SOFTWARE to install []</em></p> <p><em>&lt;....&gt;</em></p> <p><strong>Select F4 or esc+4 to list the openssl software.</strong></p> <p><strong>Select with F7:&nbsp;</strong><em>openssl.base openssl.license openssl.man.en_US</em></p> <p><strong>&lt;enter&gt;</strong><em>&nbsp;ACCEPT new license agreements? yes</em></p> <p><strong>&lt;enter&gt;</strong></p> </td> 
  </tr> 
 </tbody> 
</table>

**6) Prepare the openssh software for installation.**

<table> 
 <tbody> 
  <tr> 
   <td> <p>% cd /tmp/newopenssh</p> <p>% uncompress OpenSSH_7.5.102.1801.tar.Z</p> <p>% tar -xvf OpenSSH_7.5.102.1801.tar</p> </td> 
  </tr> 
 </tbody> 
</table>

**7) Install the openssh software.**

<table> 
 <tbody> 
  <tr> 
   <td> <p>% cd &lt;newly created openssh directory if one was created&gt;</p> <p>% smitty install_all&nbsp;<em>INPUT device / directory for software [.]</em></p> <p><strong>&lt;enter&gt;</strong></p> <p><em>* INPUT device / directory for software .</em></p> <p><em>* SOFTWARE to install []</em></p> <p><em>&lt;....&gt;</em></p> <p><strong>Select F4 or esc+4 to list the openssl software.</strong></p> <p><strong>Select with F7:</strong>&nbsp;<em>openssh.base openssh.license openssh.man.en_US openssh.msg.EN_US openssh.msg.en_US</em></p> <p><strong>&lt;enter&gt;</strong>&nbsp;<em>ACCEPT new license agreements? yes</em></p> <p><strong>&lt;enter&gt;</strong></p> </td> 
  </tr> 
 </tbody> 
</table>

**8) If the installation was successful, sshd is now active.**

<table> 
 <tbody> 
  <tr> 
   <td>% lssrc -g sshd</td> 
  </tr> 
 </tbody> 
</table>

This should result in an "active" status, indicating it is ready to accept ssh connections  
  
NOTE: SSHD is called from /etc/rc.d/rc2.d/Ssshd script at boot up. The Ssshd script is called from the l2 entry in /etc/inittab  
 *--> l2:2:wait:/etc/rc.d/rc2.d*

**9) Update the virtual AIX-rpm package.**

Since many Open Source packages rely on OpenSSL, it recommended to run the following command, which will update your virtual AIX-rpm package so the rpm installer will be aware of the new or updated libraries:

<table> 
 <tbody> 
  <tr> 
   <td>% /usr/sbin/updtvpkg</td> 
  </tr> 
 </tbody> 
</table>

**\*\*\* Skip steps 10 and 11 if this is a new SSH installation.**

**10) Restore or update ssh host keys and config files.**

Backup the newly installed ssh\_config and sshd\_config files.

<table> 
 <tbody> 
  <tr> 
   <td> <p>% cp -p ssh_config ssh_config.orig_&lt;today's_date&gt;</p> <p>% cp -p sshd_config sshd_config.orig_&lt;today's_date&gt;</p> </td> 
  </tr> 
 </tbody> 
</table>

Restore the /etc/ssh\_backup host keys directory

<table> 
 <tbody> 
  <tr> 
   <td> <p>% cd /etc/ssh_backup</p> <p>% cp -pr cp ssh_host_*_key*&nbsp; /etc/ssh</p> </td> 
  </tr> 
 </tbody> 
</table>

Update (or restore previous) sshd\_config and ssh\_config files

\*\*It is recommended that you use the newly installed ssh\_config and sshd\_config files, and if there was any customization of the old files, you should manually add those changes to the new files.

Alternatively **(not recommended),** you can restore the previous config files:

<table> 
 <tbody> 
  <tr> 
   <td> <p>% cd /etc/ssh_backup</p> <p>% cp -pr sshd_config ssh_config /etc/ssh</p> </td> 
  </tr> 
 </tbody> 
</table>

**11) Stop and restart sshd to read the updated config files.**

To stop sshd from the command line:

<table> 
 <tbody> 
  <tr> 
   <td>% stopsrc -s sshd</td> 
  </tr> 
 </tbody> 
</table>

To start sshd from the command line:

<table> 
 <tbody> 
  <tr> 
   <td>% startsrc -s sshd<br> % lssrc -g sshd</td> 
  </tr> 
 </tbody> 
</table>

This should result in an "active" status, indicating the system is ready to accept ssh connections.

[AIX_ Web Download Pack Programs]: https://www-01.ibm.com/marketing/iwm/iwm/web/pickUrxNew.do?source=aixbp
[SourceFORGE.net]: https://www.ibm.com/links?url=https%3A%2F%2Fsourceforge.net%2Fprojects%2Fopenssh-aix
[https_www-01.ibm.com_marketing_iwm_platform_mrs_assets_source_aixbp]: https://www-01.ibm.com/marketing/iwm/mrs/mrs_landing_page?source=aixbp
[at the site]: https://www-01.ibm.com/marketing/iwm/mrs/signup
[mktsystm_us.ibm.com]: mailto:mktsystm@us.ibm.com?subject=AIX%20Web%20Download%20Issue