CentOS7.10（CentOS-7-x86_64-Everything-1810.iso）升级系统默认OpenSSH至8.0p1
使用安装包如下：
zlib-1.2.11.tar.gz
openssl-1.1.1c.tar.gz
openssh-8.0p1.tar.gz

升级后发现TCP Wrappers功能失效，在Redhat6.10（rhel-server-6.10-x86_64-dvd.iso）
上情况相同。

OpenSSH8.0p1在 ./configure时已经没有“--with-tcp-wrappers”参数

[root@ZQ-CentOS7 openssh-8.0p1]# ./configure --help | grep wrapper
[root@ZQ-CentOS7 openssh-8.0p1]#

经查OpenSSH 6.7/6.7p1 (2014-10-06)起不再支持TCP Wrappers
http://www.openssh.com/releasenotes.html
“ * sshd(8): Support for tcpwrappers/libwrap has been removed.”

但是 CentOS7.6 自带的 OpenSSH7.4p1 版本是可以支持 tcp-wrappers
[root@RHEL openssh-6.6p1]# ./configure --help | grep with-tcp-wrappers --with-tcp-wrappers[=PATH] Enable tcpwrappers support (optionally in PATH)

[root@RHEL openssh-7.9p1]# ./configure --help | grep with-tcp-wrappers
[root@RHEL openssh-7.9p1]#

但生产系统下不能启用Firewall / iptables的情况下，使用TCP Wrappers机制对sshd进行安全加固配合sshd_config下的AllowUsers和DenyUsers进一步控制SSH登陆账户权限。现在升级到OpenSSH8.0p1后TCP Wrappers就没指望了。 不知道有什么其它办法？

网上很多OpenSSH8.0p1升级文档./configure都带了以下参数 --prefix=/usr --sysconfdir=/etc/ssh --with-md5-passwords --with-pam --with-tcp-wrappers --with-ssl-dir=/usr/local/ssl --without-hardening

但实际执行中configure: WARNING: unrecognized options: --with-tcp-wrappers的报错没有关注。

其中升级OpenSSH执行以下操作时有提示
./configure --prefix=/usr --sysconfdir=/etc/ssh --with-md5-passwords--with-pam --with-tcp-wrappers  --with-ssl-dir=/usr/local/ssl --without-hardening

config.status: creating opensshd.init
config.status: creating openssh.xml
config.status: creating openbsd-compat/Makefile
config.status: creating openbsd-compat/regress/Makefile
config.status: creating survey.sh
config.status: creating config.h
configure: WARNING: unrecognized options: --with-tcp-wrappers

OpenSSH has been configured with the following options:
                     User binaries: /usr/bin
                   System binaries: /usr/sbin
               Configuration files: /etc/ssh
                   Askpass program: /usr/libexec/ssh-askpass
                      Manual pages: /usr/share/man/manX
                          PID file: /var/run
  Privilege separation chroot path: /var/empty
            sshd default user PATH: /usr/bin:/bin:/usr/sbin:/sbin
                    Manpage format: doc

升级前libwrap信息
[root@ZQ-CentOS7 yum.repos.d]# ldd /usr/sbin/sshd | grep libwrap
        libwrap.so.0 => /lib64/libwrap.so.0 (0x00007fa84e1a0000)

升级前OpenSSH、OpenSSL版本信息
[root@ZQ-CentOS7 yum.repos.d]# openssl version -a
OpenSSL 1.0.2k-fips  26 Jan 2017
built on: reproducible build, date unspecified
platform: linux-x86_64
options:  bn(64,64) md2(int) rc4(16x,int) des(idx,cisc,16,int) idea(int) blowfish(idx)
compiler: gcc -I. -I.. -I../include  -fPIC -DOPENSSL_PIC -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DKRB5_MIT -m64 -DL_ENDIAN -Wall -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches   -m64 -mtune=generic -Wa,--noexecstack -DPURIFY -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DRC4_ASM -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM
OPENSSLDIR: "/etc/pki/tls"
engines:  rdrand dynamic

[root@ZQ-CentOS7 yum.repos.d]# ssh -V
OpenSSH_7.4p1, OpenSSL 1.0.2k-fips  26 Jan 2017

升级后sshd的lib信息，没有libwrap
[root@ZQ-CentOS7 itc]# ldd /usr/sbin/sshd
        linux-vdso.so.1 =>  (0x00007fff1d561000)
        libpam.so.0 => /lib64/libpam.so.0 (0x00007fba6d8e9000)
        libcrypto.so.1.1 => /lib64/libcrypto.so.1.1 (0x00007fba6d3ff000)
        libdl.so.2 => /lib64/libdl.so.2 (0x00007fba6d1fb000)
        libutil.so.1 => /lib64/libutil.so.1 (0x00007fba6cff8000)
        libz.so.1 => /lib64/libz.so.1 (0x00007fba6cde2000)
        libcrypt.so.1 => /lib64/libcrypt.so.1 (0x00007fba6cbab000)
        libresolv.so.2 => /lib64/libresolv.so.2 (0x00007fba6c992000)
        libc.so.6 => /lib64/libc.so.6 (0x00007fba6c5c5000)
        libaudit.so.1 => /lib64/libaudit.so.1 (0x00007fba6c39c000)
        libpthread.so.0 => /lib64/libpthread.so.0 (0x00007fba6c180000)
        /lib64/ld-linux-x86-64.so.2 (0x00007fba6daf8000)
        libfreebl3.so => /lib64/libfreebl3.so (0x00007fba6bf7d000)
        libcap-ng.so.0 => /lib64/libcap-ng.so.0 (0x00007fba6bd77000)

升级后OpenSSH、OpenSSL版本信息
[root@ZQ-CentOS7 openssl-1.1.1c]# openssl version -a
OpenSSL 1.1.1c  28 May 2019
built on: Mon Sep 16 07:04:13 2019 UTC
platform: linux-x86_64
options:  bn(64,64) rc4(16x,int) des(int) idea(int) blowfish(ptr)
compiler: gcc -fPIC -pthread -m64 -Wa,--noexecstack -Wall -O3 -DOPENSSL_USE_NODELETE -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM -DZLIB -DNDEBUG
OPENSSLDIR: "/usr/local/ssl/ssl"
ENGINESDIR: "/usr/local/ssl/lib/engines-1.1"
Seeding source: os-specific

[root@ZQ-CentOS7 itc]# ssh -V
OpenSSH_8.0p1, OpenSSL 1.1.1c  28 May 2019

升级步骤如下：
yum install -y gcc pam-devel tcp_wrappers-devel

当前SSH备份与卸载

mv /etc/ssh /etc/ssh.BAK
for i in $(rpm -qa |grep openssh);do rpm -e $i --nodeps;done
rpm -qa |grep  openssh

zlib编译与安装

cd /tmp/openssh8
tar -zvxf zlib-1.2.11.tar.gz
cd zlib-1.2.11
./configure

make
make install
ll /usr/local/lib

OpenSSL编译与安装

cd ..
tar -zvxf openssl-1.1.1c.tar.gz
cd openssl-1.1.1c
./config shared zlib  --prefix=/usr/local/ssl

make
make install
mv /usr/bin/openssl /usr/bin/openssl.BAK

echo "/usr/local/ssl/lib" >> /etc/ld.so.conf

ldconfig

ln -s /usr/local/ssl/bin/openssl /usr/bin/openssl
ln -s /usr/local/ssl/lib/libssl.so.1.1 /usr/lib64/libssl.so.1.1
ln -s /usr/local/ssl/lib/libcrypto.so.1.1 /usr/lib64/libcrypto.so.1.1

openssl version -a

OpenSSH编译与安装

cd ..
tar -xvf openssh-8.0p1.tar.gz
cd openssh-8.0p1

./configure --prefix=/usr --sysconfdir=/etc/ssh --with-md5-passwords --with-pam --with-tcp-wrappers  --with-ssl-dir=/usr/local/ssl --without-hardening

make

make install &&
install -v -m755    contrib/ssh-copy-id /usr/bin     &&

install -v -m644    contrib/ssh-copy-id.1
                    /usr/share/man/man1              &&
install -v -m755 -d /usr/share/doc/openssh-8.0p1     &&
install -v -m644    INSTALL LICENCE OVERVIEW README*
                    /usr/share/doc/openssh-8.0p1

cp ./contrib/redhat/sshd.init /etc/init.d/sshd
chmod u+x /etc/init.d/sshd

chkconfig --add sshd
chkconfig sshd on
chkconfig --list|grep sshd
sed -i "32a PermitRootLogin yes" /etc/ssh/sshd_config