{"id":101355,"date":"2021-09-21T16:22:37","date_gmt":"2021-09-21T14:22:38","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/google-opublikoval-hiba-nadstrojku-nad-openssh-dlya-avtorizaczii-na-osnove-sertifikatov"},"modified":"2021-09-21T16:22:37","modified_gmt":"2021-09-21T14:22:38","slug":"google-opublikoval-hiba-nadstrojku-nad-openssh-dlya-avtorizaczii-na-osnove-sertifikatov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/google-opublikoval-hiba-nadstrojku-nad-openssh-dlya-avtorizaczii-na-osnove-sertifikatov","title":{"rendered":"Google publikoval HIBA, nadstavbu nad OpenSSH pro autorizaci na z\u00e1klad\u011b certifik\u00e1t\u016f.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Spole\u010dnost Google zve\u0159ejnila zdrojov\u00e9 k\u00f3dy projektu HIBA (Host Identity Based Authorization), kter\u00fd nab\u00edz\u00ed implementaci dal\u0161\u00edho mechanismu autorizace pro \u0159\u00edzen\u00ed p\u0159\u00edstupu u\u017eivatel\u016f p\u0159es SSH v z\u00e1vislosti na hostitel\u00edch (kontrola, zda je povolen p\u0159\u00edstup k konkr\u00e9tn\u00edmu zdroji p\u0159i autentizaci pomoc\u00ed ve\u0159ejn\u00fdch kl\u00ed\u010d\u016f). Integrace s OpenSSH je zaji\u0161t\u011bna prost\u0159ednictv\u00edm ur\u010den\u00ed HIBA handleru v direktiv\u011b AuthorizedPrincipalsCommand v \/etc\/ssh\/sshd_config. K\u00f3d projektu je naps\u00e1n v jazyce C a je distribuov\u00e1n pod licenc\u00ed BSD. <\/p>\n

HIBA vyu\u017e\u00edv\u00e1 standardn\u00ed mechanismy autentizace na z\u00e1klad\u011b certifik\u00e1t\u016f OpenSSH pro flexibiln\u00ed a centralizovan\u00e9 \u0159\u00edzen\u00ed autorizace u\u017eivatel\u016f ve vazb\u011b na hostitele, ale nevy\u017eaduje pravidelnou zm\u011bnu soubor\u016f authorized_keys a authorized_users na stran\u011b hostitel\u016f, ke kter\u00fdm se p\u0159ipojuj\u00ed. Nam\u00edsto uchov\u00e1v\u00e1n\u00ed seznamu povolen\u00fdch ve\u0159ejn\u00fdch kl\u00ed\u010d\u016f a podm\u00ednek p\u0159\u00edstupu v souborech authorized_(keys|users) integruje HIBA informace o vazb\u011b u\u017eivatel\u016f na hostitele p\u0159\u00edmo do samotn\u00fdch certifik\u00e1t\u016f. Konkr\u00e9tn\u011b jsou navr\u017eeny roz\u0161\u00ed\u0159en\u00ed pro certifik\u00e1ty hostitel\u016f a certifik\u00e1ty u\u017eivatel\u016f, ve kter\u00fdch jsou uchov\u00e1v\u00e1ny parametry hostitel\u016f a podm\u00ednky pro poskytov\u00e1n\u00ed p\u0159\u00edstupu u\u017eivatel\u016fm. <\/p>\n

Kontrola na stran\u011b hostitele je iniciov\u00e1na vol\u00e1n\u00edm handleru hiba-chk, uveden\u00e9ho v direktiv\u011b AuthorizedPrincipalsCommand. Tento handler dek\u00f3duje roz\u0161\u00ed\u0159en\u00ed integrov\u00e1na do certifik\u00e1t\u016f a na jejich z\u00e1klad\u011b p\u0159ij\u00edm\u00e1 rozhodnut\u00ed o poskytnut\u00ed nebo zablokov\u00e1n\u00ed p\u0159\u00edstupu. Pravidla p\u0159\u00edstupu jsou ur\u010dena centr\u00e1ln\u011b na \u00farovni certifika\u010dn\u00ed autority (CA) a integruj\u00ed se do certifik\u00e1t\u016f b\u011bhem jejich generov\u00e1n\u00ed. <\/p>\n

Na stran\u011b certifika\u010dn\u00ed autority se vede spole\u010dn\u00fd seznam dostupn\u00fdch opr\u00e1vn\u011bn\u00ed (hostitel\u016f, ke kter\u00fdm je povolen p\u0159\u00edstup) a seznam u\u017eivatel\u016f, kter\u00fdm je povoleno vyu\u017e\u00edvat tato opr\u00e1vn\u011bn\u00ed. Pro generaci ov\u011b\u0159en\u00fdch certifik\u00e1t\u016f s integrovan\u00fdmi informacemi o opr\u00e1vn\u011bn\u00edch byla navr\u017eena utilita hiba-gen, a funk\u010dnost pot\u0159ebn\u00e1 k vytvo\u0159en\u00ed certifika\u010dn\u00ed autority byla p\u0159esunuta do skriptu iba-ca.sh. <\/p>\n

P\u0159i p\u0159ipojen\u00ed u\u017eivatele se opr\u00e1vn\u011bn\u00ed uveden\u00e1 v certifik\u00e1tu potvrzuj\u00ed digit\u00e1ln\u00edm podpisem certifika\u010dn\u00ed autority, co\u017e umo\u017e\u0148uje prov\u00e1d\u011bt v\u0161echny kontroly zcela na stran\u011b c\u00edlov\u00e9ho hostitele, ke kter\u00e9mu se p\u0159ipojujeme, bez nutnosti kontaktovat extern\u00ed slu\u017eby. Seznam otev\u0159en\u00fdch kl\u00ed\u010d\u016f certifika\u010dn\u00ed autority, kter\u00e1 podepisuje SSH certifik\u00e1ty, se uv\u00e1d\u00ed prost\u0159ednictv\u00edm direktivy TrustedUserCAKeys. <\/p>\n

Krom\u011b p\u0159\u00edm\u00e9ho propojen\u00ed u\u017eivatel\u016f s hostiteli, HIBA umo\u017e\u0148uje definovat flexibiln\u011bj\u0161\u00ed pravidla p\u0159\u00edstupu. Nap\u0159\u00edklad k hostitel\u016fm je mo\u017en\u00e9 p\u0159i\u0159adit informace jako um\u00edst\u011bn\u00ed a typ slu\u017eby, a p\u0159i definov\u00e1n\u00ed pravidel p\u0159\u00edstupu u\u017eivatel\u016f povolit p\u0159ipojen\u00ed ke v\u0161em hostitel\u016fm se zadan\u00fdm typem slu\u017eby nebo k hostitel\u016fm na specifikovan\u00e9m m\u00edst\u011b.

\"Google<\/center>
\"Google<\/center>
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0435 \u0442\u0435\u043a\u0441\u0442\u044b \u043f\u0440\u043e\u0435\u043a\u0442\u0430 HIBA (Host Identity Based Authorization), \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u044e\u0449\u0435\u0433\u043e \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044e \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043f\u043e SSH \u0432 \u043f\u0440\u0438\u0432\u044f\u0437\u043a\u0435 \u043a \u0445\u043e\u0441\u0442\u0430\u043c (\u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438, \u0440\u0430\u0437\u0440\u0435\u0448\u0451\u043d \u0438\u043b\u0438 \u043d\u0435\u0442 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u043c\u0443 \u0440\u0435\u0441\u0443\u0440\u0441\u0443 \u043f\u0440\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u043e \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c \u043a\u043b\u044e\u0447\u0430\u043c). \u0418\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u044f \u0441 OpenSSH \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 \u0443\u043a\u0430\u0437\u0430\u043d\u0438\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430 HIBA \u0432 \u0434\u0438\u0440\u0435\u043a\u0442\u0438\u0432\u0435 AuthorizedPrincipalsCommand \u0432 \/etc\/ssh\/sshd_config. \u041a\u043e\u0434 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u043d\u0430\u043f\u0438\u0441\u0430\u043d […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":101356,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101355","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Google zve\u0159ejnil HIBA, nadstavbu nad OpenSSH pro autorizaci na z\u00e1klad\u011b certifik\u00e1t\u016f | ProHoster","description":"Spole\u010dnost Google zve\u0159ejnila zdrojov\u00e9 k\u00f3dy projektu HIBA (Host Identity Based Authorization), kter\u00fd navrhuje zaveden\u00ed dodate\u010dn\u00e9ho mechanismu autorizace pro organizaci p\u0159\u00edstupu u\u017eivatel\u016f p\u0159es SSH v\u00e1zan\u00e9ho k.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/google-opublikoval-hiba-nadstrojku-nad-openssh-dlya-avtorizaczii-na-osnove-sertifikatov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Google \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b HIBA, \u043d\u0430\u0434\u0441\u0442\u0440\u043e\u0439\u043a\u0443 \u043d\u0430\u0434 OpenSSH \u0434\u043b\u044f \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0435 \u0442\u0435\u043a\u0441\u0442\u044b \u043f\u0440\u043e\u0435\u043a\u0442\u0430 HIBA (Host Identity Based Authorization), \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u044e\u0449\u0435\u0433\u043e \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044e \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043f\u043e SSH \u0432 \u043f\u0440\u0438\u0432\u044f\u0437\u043a\u0435 \u043a.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/google-opublikoval-hiba-nadstrojku-nad-openssh-dlya-avtorizaczii-na-osnove-sertifikatov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-09-21T14:22:38+00:00","article:modified_time":"2021-09-21T14:22:38+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101355","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-09-21 14:52:03","updated":"2022-10-02 02:36:14","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/101355","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=101355"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/101355\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/101356"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=101355"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=101355"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=101355"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}