linux - OpenSSH 7.3p1 构建 : configure only finds an old version of OpenSSL libraries

Question

我正在尝试在安装了旧 OpenSSL 版本的 Linux 机器中构建 OpenSSH 7.3p1。

首先我已经成功编译了OpenSSL 1.0.2h并安装在/opt/openssh-1.0.2h，而不是/usr 旧 OpenSSL 版本所在的位置。

tar xzf openssl-1.0.2h.tar.gz
cd openssl-1.0.2h
./config --prefix=/opt/openssl-1.0.2h shared
make depend
make
make test
make install

然后我继续使用 OpenSSH:

tar xzf openssh-7.3p1.tar.gz
cd openssh-7.3p1
./configure --prefix=/opt/openssh-7.3p1 --with-openssl=/opt/openssl-1.0.2h

但是 configure 脚本失败并显示以下错误消息:

checking OpenSSL header version... 0090802f (OpenSSL 0.9.8e-rhel5 01 Jul 2008)
checking OpenSSL library version... configure: error: OpenSSL >= 0.9.8f required (have "0090802f (OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008)")

如果我使用 --with-ssl-dir=/opt/openssl-1.0.2h/ssl 会显示相同的消息

工具findssl.sh(位于contrib 子目录中)可以正确找到所有OpenSSL 版本。它里面的注释(注释)建议使用 CFLAGS 来指出所需的库——我引用:

# Now run findssl.sh. This should identify the headers and libraries
# present  and  their  versions.  You  should  be  able  to identify the
# libraries  and headers used and adjust your CFLAGS or remove incorrect
# versions.  The  output will show OpenSSL's internal version identifier
# and should look something like:

然后我试了一下

./configure CFLAGS="-I/opt/openssl-1.0.2h/include" --prefix=/opt/openssh-7.3p1  --with-openssl=/opt/openssl-1.0.2h

这似乎有效，因为它找到了新的 OpenSSL header 版本:

checking OpenSSL header version... 1000208f (OpenSSL 1.0.2h  3 May 2016)
checking OpenSSL library version... configure: error: OpenSSL >= 0.9.8f required (have "0090802f (OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008)")

下一步是提供额外的选项来定位库文件。但是，如果我添加 LDFLAGS='-L/opt/openssl-1.0.2h/lib' 或 --with-ldflags='-L/opt/openssl-1.0.2h/lib '，这是我得到的:

checking OpenSSL header version... not found
configure: error: OpenSSL version header not found.

总而言之，我不知道如何配置使用新的 OpenSSL 库。

更新1:如果使用--with-ldflags='-L/opt/openssl-1.0.2h/ssl'代替·· ·openssl-1.0.2h/lib 然后 header 版本检查正常(见上面几行)，库版本检查仍然失败。

更新2:我追查了问题，发现它与共享库有关。从 config.log 文件中，我得到了源代码文件 conftest.c 和 confdef.h 以及用于构建可运行的 的选项> session :

#include "confdefs.h"
#include <stdio.h>
#include <string.h>
#include <openssl/opensslv.h>
#include <openssl/crypto.h>
#define DATA "conftest.ssllibver"

int
main ()
{

  FILE *fd;
  int rc;

  fd = fopen(DATA,"w");
  if (fd == NULL)
     exit(1);

  if ((rc = fprintf(fd, "%08lx (%s)\n", (unsigned long)SSLeay(),
                    SSLeay_version(SSLEAY_VERSION))) < 0)
     exit(1);

  exit(0);
}

此程序将 OpenSSL 版本作为文本存储在文件 conftest.ssllibver 中。出于调试目的，我将 fprint(fd, 转换为 print( 以将数据打印到终端。

用于构建conftest 程序的命令行是:

# gcc -o conftest -I/opt/openssl-1.0.2h/include -Wall \
-Wpointer-arith -Wsign-compare -Wformat-security -Wno-pointer-sign \
-fno-strict-aliasing -D_FORTIFY_SOURCE=2 -ftrapv -fno-builtin-memset \
-fstack-protector-all -std=gnu99 -fPIE -Wl,-z,relro -Wl,-z,now \ 
-Wl,-z,noexecstack -fstack-protector-all -pie conftest.c \
-lcrypto -lrt -ldl -lutil -lz

# ldd conftest |grep libcrypto
       libcrypto.so.6 => /lib64/libcrypto.so.6 (0x00002b5fc6c3e000)

使用旧的 OpenSSL 库。

当 -L/opt/openssl-1.0.2h/lib 作为参数添加时，conftest 无法运行，因为 dynamic loader (ld.so) 找不到 libcrypto.so.1.0.0:

# ./conftest
./conftest: error while loading shared libraries: libcrypto.so.1.0.0: cannot open shared object file: No such file or directory
# ldd conftest | grep libcrypto
        libcrypto.so.1.0.0 => not found

但是当我将 LD_LIBRARY_PATH 环境变量指向 /opt/openssl-1.0.2h/lib 时，动态加载器会找到库文件 libcrypto. so.1.0.0，因此可执行文件 conftest 正常工作——它使用新的 OpenSSL 库:

# export LD_LIBRARY_PATH=/opt/openssl-1.0.2h/lib
# ./conftest
1000208f (OpenSSL 1.0.2h  3 May 2016)
# ldd conftest
        libcrypto.so.1.0.0 => /opt/openssl-1.0.2h/lib/libcrypto.so.1.0.0 (0x00002b450bf97000)

Answer 1

导出 LD_LIBRARY_PATH 环境变量，它必须包含新 OpenSSL 库文件所在的目录，然后运行 ​​configure脚本:

# export LD_LIBRARY_PATH=/opt/openssl-1.0.2h/lib
# ./configure CFLAGS="-I/opt/openssl-1.0.2h/include" \
--prefix=/opt/openssh-7.3p1 \
--with-ldflags="-L/opt/openssl-1.0.2h/lib"

两个命令也可以合并为一个:

# LD_LIBRARY_PATH=/opt/openssl-1.0.2h/lib ./configure \
CFLAGS="-I/opt/openssl-1.0.2h/include" \
--prefix=/opt/openssh-7.3p1 \
--with-ldflags="-L/opt/openssl-1.0.2h/lib"

这是结果:

OpenSSH has been configured with the following options:
                     User binaries: /opt/openssh-7.3p1/bin
                   System binaries: /opt/openssh-7.3p1/sbin
               Configuration files: /opt/openssh-7.3p1/etc
                   Askpass program: /opt/openssh-7.3p1/libexec/ssh-askpass
                      Manual pages: /opt/openssh-7.3p1/share/man/manX
                          PID file: /var/run
  Privilege separation chroot path: /var/empty
            sshd default user PATH: /usr/bin:/bin:/usr/sbin:/sbin:/opt/openssh-7.3p1/bin
                    Manpage format: doc
                       PAM support: no
                   OSF SIA support: no
                 KerberosV support: no
                   SELinux support: no
                 Smartcard support: 
                     S/KEY support: no
              MD5 password support: no
                   libedit support: no
  Solaris process contract support: no
           Solaris project support: no
         Solaris privilege support: no
       IP address in $DISPLAY hack: no
           Translate v4 in v6 hack: yes
                  BSD Auth support: no
              Random number source: OpenSSL internal ONLY
             Privsep sandbox style: rlimit

              Host: x86_64-unknown-linux-gnu
          Compiler: gcc
    Compiler flags: -I/opt/openssl-1.0.2h/include -Wall -Wpointer-arith -Wsign-compare \
                    -Wformat-security -Wno-pointer-sign -fno-strict-aliasing \
                    -D_FORTIFY_SOURCE=2 -ftrapv -fno-builtin-memset -fstack-protector-all \
                    -std=gnu99 -fPIE 
Preprocessor flags: 
      Linker flags:  -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -fstack-protector-all \
                     -L/opt/openssl-1.0.2h/lib -pie
         Libraries: -lcrypto -lrt -ldl -lutil -lz  -lcrypt -lresolv

强烈建议在接下来的步骤 make 和 make install 中使用 LD_LIBRARY_PATH；否则 make install 将失败，因为运行 ssh-keygen 命令以生成新的主机 key 并且它不会找到新的 OpenSSH 库文件:

mkdir /opt/openssh-7.3p1/etc
./ssh-keygen: error while loading shared libraries: libcrypto.so.1.0.0: cannot open shared object file: No such file or directory
make: *** [host-key] Error 127