Byl vyd\u00e1n OpenSSH 8.8, otev\u0159en\u00e1 implementace klienta a serveru pro pr\u00e1ci s protokoly SSH 2.0 a SFTP. Vyd\u00e1n\u00ed se vyzna\u010duje t\u00edm, \u017ee v\u00fdchoz\u00ed nastaven\u00ed deaktivuje pou\u017e\u00edv\u00e1n\u00ed digit\u00e1ln\u00edch podpis\u016f zalo\u017een\u00fdch na RSA kl\u00ed\u010d\u00edch s hashovac\u00ed funkc\u00ed SHA-1 («ssh-rsa»). <\/p>\n
Ukon\u010den\u00ed podpory podpis\u016f «ssh-rsa» je zp\u016fsobeno zvy\u0161uj\u00edc\u00ed se \u00fa\u010dinnost\u00ed kolizn\u00edch \u00fatok\u016f s p\u0159edem definovan\u00fdm prefixem (n\u00e1klady na zisk kolize se odhaduj\u00ed na p\u0159ibli\u017en\u011b 50 tis\u00edc dolar\u016f). Chcete-li ov\u011b\u0159it pou\u017eit\u00ed ssh-rsa ve sv\u00fdch syst\u00e9mech, m\u016f\u017eete se pokusit p\u0159ipojit p\u0159es ssh s mo\u017enost\u00ed «-oHostKeyAlgorithms=-ssh-rsa». Podpora podpis\u016f RSA s hashovac\u00edmi funkcemi SHA-256 a SHA-512 (rsa-sha2-256\/512), kter\u00e9 byly podporov\u00e1ny od OpenSSH 7.2, z\u016fst\u00e1v\u00e1 beze zm\u011bn. <\/p>\n
V v\u011bt\u0161in\u011b p\u0159\u00edpad\u016f ukon\u010den\u00ed podpory «ssh-rsa» nebude vy\u017eadovat od u\u017eivatel\u016f \u017e\u00e1dn\u00e9 ru\u010dn\u00ed akce, nebo\u0165 v OpenSSH byla d\u0159\u00edve ve v\u00fdchoz\u00edm nastaven\u00ed aktivov\u00e1na konfigurace UpdateHostKeys, kter\u00e1 prov\u00e1d\u00ed automatick\u00fd p\u0159echod klient\u016f na bezpe\u010dn\u011bj\u0161\u00ed algoritmy. Pro migraci se pou\u017e\u00edv\u00e1 roz\u0161\u00ed\u0159en\u00ed protokolu «hostkeys@openssh.com», kter\u00e9 umo\u017e\u0148uje serveru<\/a> po \u00fasp\u011b\u0161n\u00e9 autentizaci informovat klienta o v\u0161ech dostupn\u00fdch kl\u00ed\u010d\u00edch hostitele. V p\u0159\u00edpad\u011b p\u0159ipojen\u00ed k hostitel\u016fm se star\u0161\u00edmi verzemi OpenSSH na stran\u011b klienta je mo\u017en\u00e9 selektivn\u011b obnovit mo\u017enost pou\u017e\u00edv\u00e1n\u00ed podpis\u016f «ssh-rsa», p\u0159id\u00e1n\u00edm do ~\/.ssh\/config: Host star\u00fd_host HostkeyAlgorithms +ssh-rsa \tPubkeyAcceptedAlgorithms +ssh-rsa <\/p>\n V nov\u00e9 verzi byla rovn\u011b\u017e odstran\u011bna bezpe\u010dnostn\u00ed chyba, kter\u00e1 vznikla t\u00edm, \u017ee v sshd, po\u010d\u00ednaje verz\u00ed OpenSSH 6.2, doch\u00e1zelo k nespr\u00e1vn\u00e9 inicializaci u\u017eivatelsk\u00e9 skupiny p\u0159i vykon\u00e1v\u00e1n\u00ed p\u0159\u00edkaz\u016f zadan\u00fdch v direktiv\u00e1ch AuthorizedKeysCommand a AuthorizedPrincipalsCommand. Tyto direktivy by m\u011bly zajistit spu\u0161t\u011bn\u00ed p\u0159\u00edkaz\u016f pod jin\u00fdm u\u017eivatelem, ale ve skute\u010dnosti zd\u011bdily seznam skupin pou\u017e\u00edvan\u00fdch p\u0159i spu\u0161t\u011bn\u00ed sshd. Potenci\u00e1ln\u011b takov\u00e9 chov\u00e1n\u00ed, p\u0159i ur\u010dit\u00fdch syst\u00e9mov\u00fdch nastaven\u00edch, umo\u017enilo spu\u0161t\u011bn\u00e9mu zpracovateli z\u00edskat dal\u0161\u00ed privilegium v syst\u00e9mu. <\/p>\n V pozn\u00e1mce k nov\u00e9mu vyd\u00e1n\u00ed byla tak\u00e9 zve\u0159ejn\u011bna v\u00fdstraha o \u00famyslu p\u0159ej\u00edt na v\u00fdchoz\u00ed pou\u017eit\u00ed n\u00e1stroje scp s protokolem SFTP m\u00edsto zastaral\u00e9ho protokolu SCP\/RCP. V SFTP se pou\u017e\u00edvaj\u00ed p\u0159edv\u00eddateln\u011bj\u0161\u00ed metody zpracov\u00e1n\u00ed jmen a nezpracov\u00e1vaj\u00ed se glob-\u0161ablony v n\u00e1zvech soubor\u016f pomoc\u00ed shellu na stran\u011b druh\u00e9ho hostitele, co\u017e vytv\u00e1\u0159\u00ed bezpe\u010dnostn\u00ed probl\u00e9my. Zvl\u00e1\u0161t\u011b p\u0159i pou\u017eit\u00ed SCP a RCP server<\/a> rozhoduje, kter\u00e9 soubory a adres\u00e1\u0159e poslat klientovi, a klient pouze kontroluje spr\u00e1vnost vr\u00e1cen\u00fdch n\u00e1zv\u016f objekt\u016f, co\u017e v p\u0159\u00edpad\u011b absence po\u017eadovan\u00fdch kontrol na stran\u011b klienta umo\u017e\u0148uje serveru poslat jin\u00e1 jm\u00e9na soubor\u016f, odli\u0161n\u00e1 od po\u017eadovan\u00fdch. Protokol SFTP je zbaven t\u011bchto probl\u00e9m\u016f, ale nepodporuje odkryt\u00ed speci\u00e1ln\u00edch cest, jako je «~». Aby se odstranil tento rozd\u00edl, bylo v posledn\u00edm vyd\u00e1n\u00ed OpenSSH implementov\u00e1no nov\u00e9 roz\u0161\u00ed\u0159en\u00ed protokolu SFTP pro odkryt\u00ed cest ~ a ~user. \u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 OpenSSH 8.8, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430\u043c SSH 2.0 \u0438 SFTP. \u0412\u044b\u043f\u0443\u0441\u043a \u043f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u0435\u043d \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435\u043c \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0446\u0438\u0444\u0440\u043e\u0432\u044b\u0445 \u043f\u043e\u0434\u043f\u0438\u0441\u0435\u0439 \u043d\u0430 \u0431\u0430\u0437\u0435 RSA-\u043a\u043b\u044e\u0447\u0435\u0439 \u0441 \u0445\u044d\u0448\u0435\u043c SHA-1 («ssh-rsa»). \u041f\u0440\u0435\u043a\u0440\u0430\u0449\u0435\u043d\u0438\u0435 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u043f\u043e\u0434\u043f\u0438\u0441\u0435\u0439 «ssh-rsa» \u043e\u0431\u0443\u0441\u043b\u043e\u0432\u043b\u0435\u043d\u043e \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435\u043c \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u043a\u043e\u043b\u043b\u0438\u0437\u0438\u043e\u043d\u043d\u044b\u0445 \u0430\u0442\u0430\u043a \u0441 \u0437\u0430\u0434\u0430\u043d\u043d\u044b\u043c \u043f\u0440\u0435\u0444\u0438\u043a\u0441\u043e\u043c (\u0441\u0442\u043e\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0434\u0431\u043e\u0440\u0430 \u043a\u043e\u043b\u043b\u0438\u0437\u0438\u0438 \u043e\u0446\u0435\u043d\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e \u0432 50 \u0442\u044b\u0441\u044f\u0447 \u0434\u043e\u043b\u043b\u0430\u0440\u043e\u0432). \u0414\u043b\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101430","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vyd\u00e1n\u00ed OpenSSH 8.8 s vypnut\u00edm podpory digit\u00e1ln\u00edch podpis\u016f rsa-sha | ProHoster","description":"Bylo vyd\u00e1no OpenSSH 8.8, otev\u0159en\u00e1 implementace klienta a serveru pro pr\u00e1ci s protokoly SSH 2.0 a SFTP.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/reliz-openssh-8-8-s-otklyucheniem-podderzhki-czifrovyh-podpisej-rsa-sha","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 OpenSSH 8.8 \u0441 \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435\u043c \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u0446\u0438\u0444\u0440\u043e\u0432\u044b\u0445 \u043f\u043e\u0434\u043f\u0438\u0441\u0435\u0439 rsa-sha | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 OpenSSH 8.8, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430\u043c SSH 2.0 \u0438 SFTP.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/reliz-openssh-8-8-s-otklyucheniem-podderzhki-czifrovyh-podpisej-rsa-sha","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-09-26T20:22:36+00:00","article:modified_time":"2021-09-26T20:22:36+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101430","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-09-26 20:28:50","updated":"2026-02-09 21:42:00","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/101430","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=101430"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/101430\/revisions"}],"predecessor-version":[{"id":172943,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/101430\/revisions\/172943"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=101430"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=101430"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=101430"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"