[20210917]ssh: error while loading shared libraries: libcrypto.so.1.0.0.txt

[20210917]ssh: error while loading shared libraries: libcrypto.so.1.0.0.txt

–//以后写一些特殊文章,一定记录在那台服务器执行的命令,特别涉及多台服务器的情况.

–//一台服务器(192.168.xx.yyy)使用普通用户无法使用ssh登录别的机器.提示如下:
–//在192.168.xx.yyy 上执行,以grid,oracle用户:
$ which ssh
/usr/bin/ssh

$ ls -l /usr/bin/ssh
-rwxr-xr-x 1 root root 736616 2020-07-01 16:53:23 /usr/bin/ssh

$ ssh 192.168.100.78
ssh: error while loading shared libraries: libcrypto.so.1.0.0: cannot open shared object file: No such file or directory
–//实际上暴露做等保一些运维人员不熟悉oracle rac,至少没有严格测试,如果以后升级或者打patch,两台机器无法通过ssh相互认证,问
–//题马上暴露,给运维埋一个很大的坑,到时候再来解决这个问题,会手忙脚乱的.

$ ldd $(which ssh)
linux-vdso.so.1 => (0x00007fff22710000)
libcrypto.so.1.0.0 => not found
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
librt.so.1 => /lib64/librt.so.1 (0x00007fc76035f000)
libdl.so.2 => /lib64/libdl.so.2 (0x00007fc76015b000)
libutil.so.1 => /lib64/libutil.so.1 (0x00007fc75ff58000)
libz.so.1 => /usr/local/lib/libz.so.1 (0x00007fc75fd40000)
libcrypt.so.1 => /lib64/libcrypt.so.1 (0x00007fc75fb08000)
libresolv.so.2 => /lib64/libresolv.so.2 (0x00007fc75f8f3000)
libc.so.6 => /lib64/libc.so.6 (0x00007fc75f59a000)
libpthread.so.0 => /lib64/libpthread.so.0 (0x00007fc75f37e000)
/lib64/ld-linux-x86-64.so.2 (0x00007fc76082c000)
–//注意看下划线,libcrypto.so.1.0.0无法找到.

–//在192.168.xx.yyy 上执行,以root用户:
which ssh
/usr/bin/ssh

ldd $(which ssh)
linux-vdso.so.1 => (0x00007fff1f1af000)
libcrypto.so.1.0.0 => /usr/local/openssl/lib/libcrypto.so.1.0.0 (0x00007f28497e9000)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
librt.so.1 => /lib64/librt.so.1 (0x00007f28495df000)
libdl.so.2 => /lib64/libdl.so.2 (0x00007f28493db000)
libutil.so.1 => /lib64/libutil.so.1 (0x00007f28491d8000)
libz.so.1 => /usr/local/lib/libz.so.1 (0x00007f2848fc1000)
libcrypt.so.1 => /lib64/libcrypt.so.1 (0x00007f2848d88000)
libresolv.so.2 => /lib64/libresolv.so.2 (0x00007f2848b73000)
libc.so.6 => /lib64/libc.so.6 (0x00007f284881b000)
libpthread.so.0 => /lib64/libpthread.so.0 (0x00007f28485fe000)
/lib64/ld-linux-x86-64.so.2 (0x00007f2849f36000)

–//以grid用户执行:
$ ls -ld /usr/local/openssl/
drwxr-x— 8 root root 4096 2020-07-01 16:49:14 /usr/local/openssl/
–//其他组没有任何权限,这样既不能读也无法进入对应目录.

$ cd /usr/local/openssl/
-bash: cd: /usr/local/openssl/: Permission denied

stat /usr/local/openssl/lib/libcrypto.so.1.0.0
File: /usr/local/openssl/lib/libcrypto.so.1.0.0' Size: 3028344 Blocks: 5928 IO Block: 4096 regular file Device: fc00h/64512d Inode: 200386 Links: 1 Access: (0750/-rwxr-x---) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2021-09-17 11:08:33.000000000 +0800 Modify: 2020-07-01 16:50:34.000000000 +0800 Change: 2021-09-17 11:08:26.000000000 +0800 --//其他组对/usr/local/openssl/lib/libcrypto.so.1.0.0文件也没有任何权限,自然普通用户是无法访问打开这个文件.</p> <p>--//有几种解决方法,第一种建立软链接在/lib64目录下.</p> <p>cd /lib64 ln -s /usr/local/openssl/lib/libcrypto.so.1.0.0 chmod 755 /usr/local/openssl/lib/libcrypto.so.1.0.0</p> <p>--//第二种直接拷贝文件/usr/local/openssl/lib/libcrypto.so.1.0.0到/lib64目录:</p> <p>cd /lib64 cp /usr/local/openssl/lib/libcrypto.so.1.0.0 . chmod 755 libcrypto.so.1.0.0</p> <p>--//我选择第2种,主要原因我不想改动/usr/local/openssl/lib/libcrypto.so.1.0.0文件权限.</p> <p>--//测试通过,这样普通用户也可以使用ssh,我记忆里以前肯定没有问题的,不然oracle rac安装不可能完成.</p> <p>--//我估计是等保做了某些处理,具体看看一些细节.</p> <p>cd /lib64 mv libcrypto.so.1.0.0 libcrypto.so.1.0.0_xxx $ ls -l /lib64/libcrypto* -rwxr-xr-x 1 root root 1365136 2013-03-05 05:52:53 /lib64/libcrypto.so.0.9.8e -rwxr-xr-x 1 root root 3028344 2021-09-17 11:02:34 /lib64/libcrypto.so.1.0.0_xxx lrwxrwxrwx 1 root root 19 2014-05-16 23:11:39 /lib64/libcrypto.so.6 -> libcrypto.so.0.9.8e --//我估计原来的版本是0.9.8e,估计等保做了升级,版本是1.0.0.</p> <p>rpm -qif /lib64/libcrypto.so.0.9.8e Name : openssl Relocations: (not relocatable) Version : 0.9.8e Vendor: Oracle America Release : 26.el5_9.1 Build Date: Tue 05 Mar 2013 05:52:53 AM CST Install Date: Fri 16 May 2014 11:11:39 PM CST Build Host: ca-build56.us.oracle.com Group : System Environment/Libraries Source RPM: openssl-0.9.8e-26.el5_9.1.src.rpm Size : 3649954 License: BSDish Signature : DSA/SHA1, Tue 05 Mar 2013 05:55:45 AM CST, Key ID 66ced3de1e5e0159 URL : http://www.openssl.org/ Summary : The OpenSSL toolkit Description : The OpenSSL toolkit provides support for secure communications between machines. OpenSSL includes a certificate management tool and shared libraries which provide various cryptographic algorithms and protocols.</p> <p>rpm -qilf /usr/local/openssl/lib/libcrypto.so file /usr/local/openssl/lib/libcrypto.so is not owned by any package</p> <p>rpm -qilf /usr/local/openssl/lib/libcrypto.so.1.0.0 file /usr/local/openssl/lib/libcrypto.so.1.0.0 is not owned by any package</p> <p>ls -ld /usr/local/openssl drwxr-x--- 8 root root 4096 2020-07-01 16:49:14 /usr/local/openssl --//日期也暴露了等保安装升级留下的痕迹,该目录下的文件都是2020-07-01 16:4X.而且还可以看出升级不是采用rpm包的形式升级,我估 --//计使用tar的方式拷贝升级的.</p> <p>stat /usr/local/openssl File: /usr/local/openssl’
Size: 4096 Blocks: 8 IO Block: 4096 directory
Device: fc00h/64512d Inode: 184243 Links: 8
Access: (0750/drwxr-x—) Uid: ( 0/ root) Gid: ( 0/ root)
Access: 2021-09-17 11:14:15.000000000 +0800
Modify: 2020-07-01 16:49:14.000000000 +0800
Change: 2020-07-01 16:49:14.000000000 +0800

stat /usr/local/openssl/lib/libcrypto.so.1.0.0
File: `/usr/local/openssl/lib/libcrypto.so.1.0.0′
Size: 3028344 Blocks: 5928 IO Block: 4096 regular file
Device: fc00h/64512d Inode: 200386 Links: 1
Access: (0750/-rwxr-x—) Uid: ( 0/ root) Gid: ( 0/ root)
Access: 2021-09-17 11:08:33.000000000 +0800
Modify: 2020-07-01 16:50:34.000000000 +0800
Change: 2021-09-17 11:08:26.000000000 +0800

ls -l $(which ssh)
-rwxr-xr-x 1 root root 736616 2020-07-01 16:53:23 /usr/bin/ssh
–//日期暴露了做了升级的动作,执行ssh文件实际上被覆盖了,从另外的侧面可以看出不是rpm包的形式升级,这样旧的rpm相关文件还在.

rpm -qif $(which ssh)
Name : openssh-clients Relocations: (not relocatable)
Version : 4.3p2 Vendor: Oracle America
Release : 82.el5 Build Date: Thu 23 Feb 2012 07:01:22 AM CST
Install Date: Fri 16 May 2014 11:25:12 PM CST Build Host: ca-build10.us.oracle.com
Group : Applications/Internet Source RPM: openssh-4.3p2-82.el5.src.rpm
Size : 865836 License: BSD
Signature : DSA/SHA1, Fri 24 Feb 2012 07:44:57 AM CST, Key ID 66ced3de1e5e0159
URL : http://www.openssh.com/portable.html
Summary : The OpenSSH client applications
Description :
OpenSSH is a free version of SSH (Secure SHell), a program for logging
into and executing commands on a remote machine. This package includes
the clients necessary to make encrypted connections to SSH servers.

You’ll also need to install the openssh package on OpenSSH clients.

ssh -V
OpenSSH_7.9p1, OpenSSL 1.0.2r-fips 26 Feb 2019

–//对比我的测试环境的情况(192.168.100.78):
$ ldd $(which ssh)
linux-vdso.so.1 => (0x00007fff648e9000)
libfipscheck.so.1 => /usr/lib64/libfipscheck.so.1 (0x00007ffdb4f45000)
libcrypto.so.6 => /lib64/libcrypto.so.6 (0x00007ffdb4bf3000)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
libutil.so.1 => /lib64/libutil.so.1 (0x00007ffdb49f0000)
libz.so.1 => /lib64/libz.so.1 (0x00007ffdb47dc000)
libnsl.so.1 => /lib64/libnsl.so.1 (0x00007ffdb45c3000)
libcrypt.so.1 => /lib64/libcrypt.so.1 (0x00007ffdb438b000)
libresolv.so.2 => /lib64/libresolv.so.2 (0x00007ffdb4176000)
libgssapi_krb5.so.2 => /usr/lib64/libgssapi_krb5.so.2 (0x00007ffdb3f47000)
libkrb5.so.3 => /usr/lib64/libkrb5.so.3 (0x00007ffdb3cb2000)
libk5crypto.so.3 => /usr/lib64/libk5crypto.so.3 (0x00007ffdb3a8d000)
libcom_err.so.2 => /lib64/libcom_err.so.2 (0x00007ffdb388a000)
libnss3.so => /usr/lib64/libnss3.so (0x00007ffdb355c000)
libc.so.6 => /lib64/libc.so.6 (0x00007ffdb3203000)
libplc4.so => /usr/lib64/libplc4.so (0x00007ffdb2ffe000)
libdl.so.2 => /lib64/libdl.so.2 (0x00007ffdb2dfa000)
libkrb5support.so.0 => /usr/lib64/libkrb5support.so.0 (0x00007ffdb2bf2000)
libkeyutils.so.1 => /lib64/libkeyutils.so.1 (0x00007ffdb29ef000)
libnssutil3.so => /usr/lib64/libnssutil3.so (0x00007ffdb27ca000)
libplds4.so => /usr/lib64/libplds4.so (0x00007ffdb25c7000)
libnspr4.so => /usr/lib64/libnspr4.so (0x00007ffdb238b000)
libpthread.so.0 => /lib64/libpthread.so.0 (0x00007ffdb216f000)
/lib64/ld-linux-x86-64.so.2 (0x0000003798c00000)
libselinux.so.1 => /lib64/libselinux.so.1 (0x00007ffdb1f57000)
libsepol.so.1 => /lib64/libsepol.so.1 (0x00007ffdb1d10000)

$ ls -l /lib64/libcrypto.so.6
lrwxrwxrwx 1 root root 19 2014-08-29 21:28:41 /lib64/libcrypto.so.6 -> libcrypto.so.0.9.8e

–//指向libcrypto.so.0.9.8e,也证明对方做了一些升级.

$ ls -l /lib64/libcrypto.so.*
-rwxr-xr-x 1 root root 1367232 2012-05-30 01:55:15 /lib64/libcrypto.so.0.9.8e
lrwxrwxrwx 1 root root 19 2014-08-29 21:28:41 /lib64/libcrypto.so.6 -> libcrypto.so.0.9.8e
–//原来的版本是0.9.8e.

$ ls -l $(which ssh)
-rwxr-xr-x 1 root root 306064 2012-02-23 07:01:22 /usr/bin/ssh

$ rpm -qif $(which ssh)
Name : openssh-clients Relocations: (not relocatable)
Version : 4.3p2 Vendor: Oracle America
Release : 82.el5 Build Date: Thu 23 Feb 2012 07:01:22 AM CST
Install Date: Fri 29 Aug 2014 09:30:48 PM CST Build Host: ca-build10.us.oracle.com
Group : Applications/Internet Source RPM: openssh-4.3p2-82.el5.src.rpm
Size : 865836 License: BSD
Signature : DSA/SHA1, Fri 24 Feb 2012 07:44:57 AM CST, Key ID 66ced3de1e5e0159
URL : http://www.openssh.com/portable.html
Summary : The OpenSSH client applications
Description :
OpenSSH is a free version of SSH (Secure SHell), a program for logging
into and executing commands on a remote machine. This package includes
the clients necessary to make encrypted connections to SSH servers.

You’ll also need to install the openssh package on OpenSSH clients.

–//与上面的一样,我估计不是使用rpm包安装的,而是拷贝或者tar包安装的.

$ ssh -V
OpenSSH_4.3p2, OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008
–//对比前面版本完全不一致.

–//一旦生产系统上线,我个人很少在服务器安装升级软件包,除非存在安全漏洞,这台服务器我升级bash,即使升级我也选择rpm包模式,
–//也不会选择生产服务器安装编译软件,总而言之,做运维工作一定要小心再小心..

Original: https://www.cnblogs.com/lfree/p/15322692.html
Author: lfree
Title: [20210917]ssh: error while loading shared libraries: libcrypto.so.1.0.0.txt