{"id":112279,"date":"2023-12-17T15:10:15","date_gmt":"2023-12-17T13:10:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/predstavlen-ssh3-variant-protokola-ssh-ispolzuyushhij-http-3"},"modified":"2023-12-17T15:10:15","modified_gmt":"2023-12-17T13:10:16","slug":"predstavlen-ssh3-variant-protokola-ssh-ispolzuyushhij-http-3","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/predstavlen-ssh3-variant-protokola-ssh-ispolzuyushhij-http-3","title":{"rendered":"Byl p\u0159edstaven SSH3, varianta protokolu SSH, vyu\u017e\u00edvaj\u00edc\u00ed HTTP\/3","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Byla vyd\u00e1na prvn\u00ed ofici\u00e1ln\u00ed verze experiment\u00e1ln\u00ed implementace serveru a klienta pro protokol SSH3, kter\u00e1 je navr\u017eena jako nadstavba nad protokolem HTTP\/3, pou\u017e\u00edvaj\u00edc\u00ed QUIC (na b\u00e1zi UDP) a TLS 1.3 k vytvo\u0159en\u00ed zabezpe\u010den\u00e9ho komunika\u010dn\u00edho kan\u00e1lu a mechanism\u016f HTTP pro autentizaci u\u017eivatel\u016f. Projekt vyv\u00edj\u00ed Fran\u00e7ois Michel, doktorand Katolick\u00e9 univerzity v Leuven (Belgie), ve spolupr\u00e1ci s Olivierem Bonaventurem, profesorem t\u00e9\u017ee univerzity, zn\u00e1m\u00fdm sv\u00fdm v\u00fdvojem pod syst\u00e9mu Multipath TCP a k\u00f3du segmentov\u00e9ho sm\u011brov\u00e1n\u00ed IPv6 pro j\u00e1dro Linuxu, a tak\u00e9 spoluautorem 10 RFC a koncept\u016f v\u00edce ne\u017e 60 s\u00ed\u0165ov\u00fdch specifikac\u00ed. K\u00f3d referen\u010dn\u00ed implementace klienta a serveru je naps\u00e1n v jazyce Go a je distribuov\u00e1n pod licenc\u00ed Apache 2.0. <\/p>\n

V\u00fdvoj SSH3 byl v\u00fdsledkem komplexn\u00edho p\u0159ehodnocen\u00ed protokolu SSH, proveden\u00e9ho skupinou v\u00fdzkumn\u00edk\u016f nez\u00e1visle na OpenSSH a dal\u0161\u00edch projektech, kter\u00e9 rozv\u00edjej\u00ed implementace klasick\u00e9ho protokolu SSH. V SSH3 je semantics klasick\u00e9ho protokolu SSH realizov\u00e1na prost\u0159ednictv\u00edm mechanism\u016f HTTP, co\u017e umo\u017enilo realizaci n\u011bkter\u00fdch dodate\u010dn\u00fdch mo\u017enost\u00ed a skryt\u00ed aktivit spojen\u00fdch se SSH mezi jin\u00fdm provozem. <\/p>\n

P\u0159i pou\u017e\u00edv\u00e1n\u00ed SSH3 server nen\u00ed k odli\u0161en\u00ed od HTTP serveru a p\u0159ij\u00edm\u00e1 dotazy na portu 443 (HTTPS), a provoz SSH3 se m\u00eds\u00ed s typick\u00fdm HTTP provozem, co\u017e zt\u011b\u017euje prov\u00e1d\u011bn\u00ed \u00fatok\u016f souvisej\u00edc\u00edch se skenov\u00e1n\u00edm port\u016f a identifikac\u00ed SSH server\u016f pro \u00fatoky hrubou silou. Pro zt\u00ed\u017een\u00ed prov\u00e1d\u011bn\u00ed \u00fatok\u016f na servery<\/a> SSH3, krom\u011b znalosti informac\u00ed o p\u0159\u00edtomnosti serveru na zadan\u00e9 IP adrese, m\u016f\u017ee m\u00edt tajnou cestu-identifik\u00e1tor SSH3 serveru. Bez zad\u00e1n\u00ed spr\u00e1vn\u00e9ho identifik\u00e1toru server bude zpracov\u00e1vat odpov\u011bdi jako b\u011b\u017en\u00fd HTTPS server a neprozrad\u00ed, \u017ee je mo\u017en\u00e9 se p\u0159ipojit p\u0159es SSH3. Nap\u0159\u00edklad p\u0159i zad\u00e1n\u00ed identifik\u00e1toru \u201ee6ae772cbdaafd6918865cc2ce449dae\u201c se lze k serveru p\u0159ipojit pouze na URL \u201ehttps:\/\/192.0.2.0:443\/e6ae772cbdaafd6918865cc2ce449dae\u201c, pokud je identifik\u00e1tor uveden nespr\u00e1vn\u011b, server vr\u00e1t\u00ed standardn\u00ed chybu \u201e404\u201c. <\/p>\n

V roz\u0161\u00ed\u0159en\u00e9 funk\u010dnosti SSH3 se zmi\u0148uje mo\u017enost pou\u017eit\u00ed certifik\u00e1t\u016f X.509 a metod OAuth 2.0\/OpenID Connect pro autentizaci, krom\u011b klasick\u00fdch metod SSH; podpora p\u0159esm\u011brov\u00e1n\u00ed UDP port\u016f p\u0159es SSH tunel vedle mo\u017enosti p\u0159esm\u011brov\u00e1n\u00ed TCP port\u016f (nap\u0159\u00edklad pro tunelov\u00e1n\u00ed QUIC, DNS a RTP); vyu\u017eit\u00ed pokro\u010dil\u00fdch funkc\u00ed protokolu QUIC, jako je migrace spojen\u00ed bez p\u0159eru\u0161en\u00ed a zalo\u017een\u00ed multipath spojen\u00ed pro paraleln\u00ed p\u0159enos dat p\u0159es n\u011bkolik cest. <\/p>\n

Z\u00e1kladn\u00edm p\u0159\u00ednosem SSH3 je v\u00fdrazn\u00e9 zkr\u00e1cen\u00ed doby pro nav\u00e1z\u00e1n\u00ed spojen\u00ed. P\u0159i p\u0159ipojov\u00e1n\u00ed k serveru SSH3 je pot\u0159eba prov\u00e9st pouze 3 s\u00ed\u0165ov\u00e9 iterace (Round Trip), zat\u00edmco pro SSHv2 je to 5-7 iterac\u00ed v\u00fdm\u011bny paket\u016f. Doba odezvy na kl\u00e1vesnicov\u00fd vstup pro ji\u017e nav\u00e1zan\u00e1 sezen\u00ed v SSH3 a SSHv2 je na stejn\u00e9 \u00farovni.

\"Byl<\/center> <\/p>\n

Pro \u0161ifrov\u00e1n\u00ed komunika\u010dn\u00edho kan\u00e1lu v SSH3 vyu\u017e\u00edv\u00e1 protokol TLS 1.3, a pro autentizaci lze pou\u017e\u00edt klasick\u00e9 metody zalo\u017een\u00e9 na heslech a ve\u0159ejn\u00fdch kl\u00ed\u010d\u00edch (RSA a EdDSA\/ed25519). D\u00e1le mohou b\u00fdt v SSH3 implementov\u00e1ny metody zalo\u017een\u00e9 na protokolu OAuth 2.0, kter\u00e9 umo\u017e\u0148uj\u00ed delegaci autentizace na t\u0159et\u00ed strany, nap\u0159\u00edklad pro vstup s potvrzen\u00edm pomoc\u00ed \u00fa\u010dt\u016f ve slu\u017eb\u00e1ch Google, Microsoft a GitHub. Pro p\u0159ipojen\u00ed k server\u016fm pomoc\u00ed kl\u00ed\u010d\u016f je mo\u017en\u00e9 krom\u011b SSH kl\u00ed\u010d\u016f pou\u017e\u00edt tak\u00e9 certifik\u00e1ty X.509 pou\u017e\u00edvan\u00e9 pro HTTPS. <\/p>\n

Zve\u0159ejn\u011bn\u00e1 implementace klienta a serveru SSH3 podporuje mnoho z\u00e1kladn\u00edch funkc\u00ed OpenSSH, mezi nimi\u017e nalezneme: <\/p>\n