1、ansible宿主机准备好环境，并写好hosts文件
[root@oxidized ansible]# cat hosts
[all]
10.10.200.33
10.10.200.34
10.10.200.35跑playbook之前记得提前发送秘钥
ssh-copy-id 10.10.200.33/34/35
2、下载好安装包，然后编写yml
[root@oxidized ansible]# cat loudongBD.yml
- name: 漏洞修复hosts: alltasks:- name: copy opensslcopy:src: /openssh_upgrade_9.7/openssl-3.1.5.tar.gzdest: /usr/local/src/openssl-3.1.5.tar.gz- name: copy opensshcopy:src: /openssh_upgrade_9.7/openssh-9.7p1.tar.gzdest: /usr/local/src/openssh-9.7p1.tar.gz- name: copy upgrade脚本copy:src: /etc/ansible/loudongBD_ssh.shdest: /usr/local/src/loudongBD_ssh.sh- name:copy:src: /etc/ansible/loudongBD_ssl.shdest: /usr/local/src/loudongBD_ssl.sh- name: openssl升级shell: sh /usr/local/src/loudongBD_ssl.sh- name: openssh升级shell: sh /usr/local/src/loudongBD_ssh.sh
3、两个shell脚本内容如下
openssl升级脚本：
[root@oxidized ansible]# cat loudongBD_ssl.sh
#!/bin/bash
cd /etc/yum.repos.d/ && mkdir bak
mv *.repo bak/
cat >>/etc/yum.repos.d/local.repo <<EOF
[base]
name=Nexus
baseurl=http://10.10.200.20:8081/repository/yumHosted/
enabled=1
gpgcheck=0
EOFyum makecache fastyum install gcc gcc-c++ openssl-devel libstdc++* libcap* pam-devel zlib-devel perl perl-IPC-Cmd -ycd /usr/local/src/mv /usr/lib64/openssl /usr/lib64/openssl.oldyum -y remove openssltar xf openssl-3.1.5.tar.gzcd /usr/local/src/openssl-3.1.5./config --prefix=/usrmake && make install
openssh升级脚本：
[root@oxidized ansible]# cat loudongBD_ssh.sh#!/bin/bashcd /usr/local/src/tar xf openssh-9.7p1.tar.gzmkdir /etc/ssh.bakmv /etc/ssh/ /etc/ssh.bakcd /usr/local/src/openssh-9.7p1./configure --prefix=/usr --sysconfdir=/etc/ssh --with-ssl-dir=/usr/local/openssl --with-md5-passwordsmake && make installcp /usr/local/src/openssh-9.7p1/contrib/redhat/sshd.init /etc/init.d/sshdmv /usr/lib/systemd/system/sshd.service /usr/lib/systemd/system/sshd.service.bakcp /etc/ssh/sshd_config{,.bak}sed -i 's/^PermitRootLogin/#&/' /etc/ssh/sshd_configsed -i '32i PermitRootLogin yes' /etc/ssh/sshd_configchkconfig --add sshdsystemctl daemon-reloadsystemctl restart sshd
4、环境准备好后，直接运行剧本即可
[root@oxidized ansible]# ansible-playbook loudongBD.yml
5、升级后检查ssh版本
[root@oxidized ansible]# ssh -V
OpenSSH_9.7p1, OpenSSL 3.1.5 30 Jan 2024
