{"id":123013,"date":"2025-03-26T16:22:56","date_gmt":"2025-03-26T14:22:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/kompaniya-cloudflare-opublikovala-opkssh-dlya-autentifikaczii-v-ssh-cherez-openid-connect"},"modified":"2025-03-26T16:22:56","modified_gmt":"2025-03-26T14:22:58","slug":"kompaniya-cloudflare-opublikovala-opkssh-dlya-autentifikaczii-v-ssh-cherez-openid-connect","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/kompaniya-cloudflare-opublikovala-opkssh-dlya-autentifikaczii-v-ssh-cherez-openid-connect","title":{"rendered":"Spole\u010dnost Cloudflare publikovala opkssh pro autentizaci v SSH prost\u0159ednictv\u00edm OpenID Connect","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Spole\u010dnost Cloudflare p\u0159edstavila n\u00e1stroj opkssh (OpenPubkey SSH), kter\u00fd umo\u017e\u0148uje integrovat do OpenSSH prost\u0159edky centralizovan\u00e9 autentizace s mo\u017enost\u00ed p\u0159ihl\u00e1\u0161en\u00ed p\u0159es poskytovatele OpenID Connect. Pomoc\u00ed opkssh se lze zbavit manu\u00e1ln\u00ed pr\u00e1ce p\u0159i spr\u00e1v\u011b a nastavov\u00e1n\u00ed SSH kl\u00ed\u010d\u016f a tak\u00e9 organizovat p\u0159ipojen\u00ed k serveru z jak\u00fdchkoli host\u016f, ani\u017e by bylo nutn\u00e9 vytv\u00e1\u0159et soukrom\u00e9 kl\u00ed\u010de na ka\u017ed\u00e9m klientsk\u00e9m po\u010d\u00edta\u010di a bez manu\u00e1ln\u00edho kop\u00edrov\u00e1n\u00ed ve\u0159ejn\u00fdch kl\u00ed\u010d\u016f na server. Pro p\u0159ipojen\u00ed sta\u010d\u00ed prov\u00e9st na serveru vazbu k \u00fa\u010dtu u poskytovatele OpenID. K\u00f3d n\u00e1stroje je naps\u00e1n v jazyce Go a distribuuje se pod licenc\u00ed Apache 2.0. <\/p>\n

Opkssh je kompatibiln\u00ed s poskytovateli OpenID Google, Microsoft\/Azure a Gitlab, co\u017e umo\u017e\u0148uje nastavit p\u0159ihl\u00e1\u0161en\u00ed pomoc\u00ed existuj\u00edc\u00edch \u00fa\u010dt\u016f ve slu\u017eb\u00e1ch gmail.com, microsoft.com a gitlab.com. P\u0159i pou\u017e\u00edv\u00e1n\u00ed opkssh se m\u00edsto neomezen\u00fdch \u010dasov\u011b platn\u00fdch SSH kl\u00ed\u010d\u016f generuj\u00ed do\u010dasn\u00e9 kl\u00ed\u010de, kter\u00e9 plat\u00ed jen n\u011bkolik hodin a jsou generov\u00e1ny na z\u00e1klad\u011b potvrzen\u00ed od poskytovatele OpenID. \u00danik takov\u00fdch kl\u00ed\u010d\u016f po vypr\u0161en\u00ed platnosti nep\u0159edstavuje bezpe\u010dnostn\u00ed hrozbu. V\u00fdchoz\u00ed doba platnosti kl\u00ed\u010de je 24 hodin, po kter\u00e9 je nutn\u00e9 se znovu identifikovat p\u0159es OpenID. <\/p>\n

Integrace s OpenSSH je zalo\u017eena na mo\u017enosti vytv\u00e1\u0159et roz\u0161\u00ed\u0159en\u00ed protokolu SSH, kter\u00e1 umo\u017e\u0148uj\u00ed p\u0159ipojen\u00ed libovoln\u00fdch dat k SSH certifik\u00e1t\u016fm. Po \u00fasp\u011b\u0161n\u00e9 autentizaci p\u0159es OpenID klient vytvo\u0159\u00ed ve\u0159ejn\u00fd kl\u00ed\u010d, kter\u00fd obsahuje PK token potvrzuj\u00edc\u00ed p\u0159\u00edslu\u0161nost kl\u00ed\u010de k deklarovan\u00e9mu u\u017eivateli. Token je integrov\u00e1n do protokolu SSH prost\u0159ednictv\u00edm pole s dal\u0161\u00edmi daty SSH certifik\u00e1tu. Vytv\u00e1\u0159en\u00ed PK token\u016f a jejich ov\u011b\u0159ov\u00e1n\u00ed na stran\u011b serveru se prov\u00e1d\u00ed pomoc\u00ed kryptografick\u00e9ho protokolu OpenPubKey. <\/p>\n

OpenPubKey umo\u017e\u0148uje generovat ve\u0159ejn\u00fd kl\u00ed\u010d a p\u0159i\u0159adit ho k tokenu vydan\u00e9mu poskytovatelem OpenID. Pomoc\u00ed digit\u00e1ln\u00edho podpisu poskytovatel potvrzuje, \u017ee tento kl\u00ed\u010d byl vytvo\u0159en uveden\u00fdm autentizovan\u00fdm u\u017eivatelsk\u00fdm jm\u00e9nem. Nap\u0159\u00edklad poskytovatel OpenID Google m\u016f\u017ee potvrdit, \u017ee u\u017eivatel je autentizov\u00e1n jako test@gmail.com. Na serverov\u00e9 stran\u011b se kontroluje, zda je p\u0159ipojen\u00fd token podeps\u00e1n poskytovatelem OpenID a zda digit\u00e1ln\u00ed podpis odpov\u00edd\u00e1 uveden\u00e9mu ve\u0159ejn\u00e9mu kl\u00ed\u010di, tj. server m\u016f\u017ee potvrdit, \u017ee u\u017eivatel test@gmail.com skute\u010dn\u011b vytvo\u0159il ve\u0159ejn\u00fd kl\u00ed\u010d pro p\u0159ipojen\u00e9ho SSH klienta.

\"Spole\u010dnost<\/center> <\/p>\n

Integrace s OpenSSH je zaji\u0161t\u011bna uveden\u00edm programu opkssh v konfigura\u010dn\u00edm souboru \u201esshd_config\u201c pomoc\u00ed direktivy \u201eAuthorizedKeysCommand\u201c (nap\u0159\u00edklad: \u201eAuthorizedKeysCommand \/usr\/local\/bin\/opkssh verify %u %k %t\u201c). Nastaven\u00ed propojen\u00ed \u00fa\u010dt\u016f s OpenID se prov\u00e1d\u00ed na stran\u011b SSH serveru. Na stran\u011b SSH klienta nen\u00ed pot\u0159eba \u017e\u00e1dn\u00e9 zm\u011bny, ale p\u0159ed p\u0159ihl\u00e1\u0161en\u00edm je nutn\u00e9 spustit p\u0159\u00edkaz \u201eopkssh login\u201c a v zobrazen\u00e9m okn\u011b prohl\u00ed\u017ee\u010de vybrat poskytovatele OpenID a prov\u00e9st autentizaci skrze n\u011bj. <\/p>\n

N\u00e1stroj opkssh vygeneruje kl\u00ed\u010de SSH a z\u00edsk\u00e1 PK-token, kter\u00fd potvrzuje, \u017ee u\u017eivatel pro\u0161el autentizac\u00ed a umo\u017e\u0148uje ov\u011b\u0159it, \u017ee vytvo\u0159en\u00e9 kl\u00ed\u010de pat\u0159\u00ed uveden\u00e9mu u\u017eivateli. Ve\u0159ejn\u00fd kl\u00ed\u010d SSH, ke kter\u00e9mu je prost\u0159ednictv\u00edm pole s dodate\u010dn\u00fdmi \u00fadaji p\u0159i\u0159azen PK-token, bude zaps\u00e1n do souboru ~\/ .ssh\/id_ecdsas a za\u010dne se p\u0159ed\u00e1vat p\u0159i p\u0159ipojen\u00ed k serveru<\/a> n\u00e1stroji ssh. <\/p>\n

P\u0159ipojen\u00ed k serveru se prov\u00e1d\u00ed pomoc\u00ed standardn\u00edho SSH form\u00e1tu \u201essh login@server\u201c, p\u0159i\u010dem\u017e na serveru<\/a> login mus\u00ed b\u00fdt p\u0159edem ztoto\u017en\u011bn s \u00fa\u010dtem v OpenID, kter\u00fd u\u017eivatel pou\u017e\u00edv\u00e1. Pr\u00e1ce tedy spo\u010d\u00edv\u00e1 v tom, \u017ee ssh klient ode\u0161le na ssh server ve\u0159ejn\u00fd kl\u00ed\u010d, a server spust\u00ed p\u0159\u00edkaz \u201eopkssh verify\u201c pro ov\u011b\u0159en\u00ed kl\u00ed\u010de. <\/p>\n

Pro propojen\u00ed \u00fa\u010dtu s OpenID administr\u00e1tor serveru provede p\u0159\u00edkaz \u201eopkssh add\u201c. Nap\u0159\u00edklad pro umo\u017en\u011bn\u00ed p\u0159ihl\u00e1\u0161en\u00ed na server pod u\u017eivatelsk\u00fdm jm\u00e9nem \u201eroot\u201c s OpenID autentizac\u00ed prost\u0159ednictv\u00edm \u00fa\u010dtu test@gmail.com v Gmailu je t\u0159eba prov\u00e9st \u201esudo opkssh add root test@gmail.com google\u201c, pot\u00e9 se klient m\u016f\u017ee p\u0159ipojit pod parametry tohoto \u00fa\u010dtu pomoc\u00ed p\u0159\u00edkazu \u201essh root@host_serveru\u201c. <\/p>\n

Propojen\u00ed \u00fa\u010dtu lze tak\u00e9 prov\u00e9st ru\u010dn\u011b p\u0159es konfigura\u010dn\u00ed soubor \/etc\/opk\/auth_id (nebo ~\/.opk\/auth_id), do kter\u00e9ho bude pro v\u00fd\u0161e uveden\u00fd p\u0159\u00edklad zaps\u00e1n \u0159et\u011bzec \u201eroot test@gmail.com https:\/\/accounts.google.com\u201c. D\u00e1le lze p\u0159es soubor \/etc\/opk\/providers ur\u010dit seznam p\u0159\u00edpustn\u00fdch poskytovatel\u016f OpenID, jejich parametry a seznam povolen\u00fdch identifik\u00e1tor\u016f klient\u016f.

\"Spole\u010dnost<\/center>
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cloudflare \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439 opkssh (OpenPubkey SSH), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0432 OpenSSH \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0446\u0435\u043d\u0442\u0440\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c\u044e \u0432\u0445\u043e\u0434\u0430 \u0447\u0435\u0440\u0435\u0437 \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u0432 OpenID Connect. \u041f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 opkssh \u043c\u043e\u0436\u043d\u043e \u0438\u0437\u0431\u0430\u0432\u0438\u0442\u044c\u0441\u044f \u043e\u0442 \u0440\u0443\u0447\u043d\u043e\u0439 \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044e \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 SSH-\u043a\u043b\u044e\u0447\u0435\u0439, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0443 \u0441 \u043b\u044e\u0431\u044b\u0445 \u0445\u043e\u0441\u0442\u043e\u0432, \u0431\u0435\u0437 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0437\u0430\u043a\u0440\u044b\u0442\u044b\u0445 \u043a\u043b\u044e\u0447\u0435\u0439 \u043d\u0430 \u043a\u0430\u0436\u0434\u043e\u043c \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u043e\u043c \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0435 \u0438 \u0431\u0435\u0437 \u0440\u0443\u0447\u043d\u043e\u0433\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":123014,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-123013","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Spole\u010dnost Cloudflare zve\u0159ejnila opkssh pro autentifikaci v SSH p\u0159es OpenID Connect | ProHoster","description":"Spole\u010dnost Cloudflare p\u0159edstavila n\u00e1stroj opkssh (OpenPubkey SSH), kter\u00fd umo\u017e\u0148uje integrovat do OpenSSH prost\u0159edky centralized authentication s mo\u017enost\u00ed p\u0159ihl\u00e1\u0161en\u00ed prost\u0159ednictv\u00edm poskytovatel\u016f OpenID Connect.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/kompaniya-cloudflare-opublikovala-opkssh-dlya-autentifikaczii-v-ssh-cherez-openid-connect","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cloudflare \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 opkssh \u0434\u043b\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 SSH \u0447\u0435\u0440\u0435\u0437 OpenID Connect | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cloudflare \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439 opkssh (OpenPubkey SSH), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0432 OpenSSH \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0446\u0435\u043d\u0442\u0440\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c\u044e \u0432\u0445\u043e\u0434\u0430 \u0447\u0435\u0440\u0435\u0437 \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u0432 OpenID Connect.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/kompaniya-cloudflare-opublikovala-opkssh-dlya-autentifikaczii-v-ssh-cherez-openid-connect","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-03-26T14:22:58+00:00","article:modified_time":"2025-03-26T14:22:58+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"123013","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 22:07:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 11:38:16","updated":"2026-02-09 22:07:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/123013","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=123013"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/123013\/revisions"}],"predecessor-version":[{"id":160229,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/123013\/revisions\/160229"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/123014"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=123013"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=123013"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=123013"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}