{"id":52210,"date":"2019-11-03T00:00:00","date_gmt":"2019-11-02T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/v-openssh-dobavlena-podderzhka-universalnoj-dvuhfaktornoj-autentifikatsii"},"modified":"2020-02-18T13:59:53","modified_gmt":"2020-02-18T10:59:53","slug":"v-openssh-dobavlena-podderzhka-universalnoj-dvuhfaktornoj-autentifikatsii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/v-openssh-dobavlena-podderzhka-universalnoj-dvuhfaktornoj-autentifikatsii","title":{"rendered":"Podpora univerz\u00e1ln\u00ed dvoufaktorov\u00e9 autentizace byla p\u0159id\u00e1na do OpenSSH","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Do k\u00f3du OpenSSH byla p\u0159id\u00e1na<\/a><\/noindex> experiment\u00e1ln\u00ed podpora dvoufaktorov\u00e9 autentizace pomoc\u00ed za\u0159\u00edzen\u00ed podporuj\u00edc\u00edch protokol U2F<\/a><\/noindex>, vyv\u00edjen\u00e9ho alianc\u00ed FIDO<\/a><\/noindex>. U2F umo\u017e\u0148uje vytv\u00e1\u0159et cenov\u011b dostupn\u00e9 hardwarov\u00e9 tokeny pro potvrzen\u00ed fyzick\u00e9 p\u0159\u00edtomnosti u\u017eivatele, jejich\u017e interakce prob\u00edh\u00e1 p\u0159es USB, Bluetooth nebo NFC. Takov\u00e1 za\u0159\u00edzen\u00ed jsou propagov\u00e1na jako prost\u0159edek pro dvoufaktorovou autentizaci na webov\u00fdch str\u00e1nk\u00e1ch, ji\u017e je podporuj\u00ed hlavn\u00ed prohl\u00ed\u017ee\u010de a vyr\u00e1b\u00ed je r\u016fzn\u00ed v\u00fdrobci, v\u010detn\u011b Yubico, Feitian, Thetis a Kensington.<\/p>\n

Pro interakci s za\u0159\u00edzen\u00edmi potvrzuj\u00edc\u00edmi p\u0159\u00edtomnost u\u017eivatele byl do OpenSSH p\u0159id\u00e1n nov\u00fd typ kl\u00ed\u010d\u016f «sk-ecdsa-sha2-nistp256@openssh.com» («ecdsa-sk»), kter\u00fd vyu\u017e\u00edv\u00e1 algoritmus digit\u00e1ln\u00edho podpisu ECDSA (Elliptic Curve Digital Signature Algorithm) s eliptickou k\u0159ivkou NIST P-256 a hashovac\u00ed funkc\u00ed SHA-256. Postupy interakce s tokeny byly p\u0159esunuty do mezipam\u011bti, kter\u00e1 se na\u010d\u00edt\u00e1 obdobn\u011b jako knihovna pro podporu PKCS#11 a je ob\u00e1lkou nad knihovnou. libfido2<\/a><\/noindex>, kter\u00e1 poskytuje prost\u0159edky pro komunikaci s tokeny p\u0159es USB (podporov\u00e1ny jsou protokoly FIDO U2F\/CTAP 1 a FIDO 2.0\/CTAP 2). Vyvinut\u00e1 mezi-knihovna libsk-libfido2 od v\u00fdvoj\u00e1\u0159\u016f OpenSSH je zahrnuta<\/a><\/noindex> je sou\u010d\u00e1st\u00ed libfido2, stejn\u011b jako HID ovlada\u010d<\/a><\/noindex> pro OpenBSD.<\/p>\n

Pro povolen\u00ed U2F lze pou\u017e\u00edt aktu\u00e1ln\u00ed z\u00e1st\u0159ih k\u00f3du z repozit\u00e1\u0159e<\/a><\/noindex> OpenSSH a HEAD-branch knihovny libfido2<\/a><\/noindex>, kter\u00e1 ji\u017e obsahuje pot\u0159ebnou mezivrstvu pro OpenSSH.
\nLibfido2 podporuje provoz v OpenBSD, Linuxu, macOS a Windows. <\/p>\n

Pro autentizaci a generaci kl\u00ed\u010de je t\u0159eba nastavit prom\u011bnnou prost\u0159ed\u00ed SSH_SK_PROVIDER a uv\u00e9st cestu k libsk-libfido2.so (export SSH_SK_PROVIDER=\\\/path\\\/to\\\/libsk-libfido2.so), nebo definovat knihovnu prost\u0159ednictv\u00edm nastaven\u00ed SecurityKeyProvider, po \u010dem\u017e je t\u0159eba spustit «ssh-keygen -t ecdsa-sk» nebo, pokud byly kl\u00ed\u010de ji\u017e vytvo\u0159eny a nakonfigurov\u00e1ny, p\u0159ipojit se k serveru pomoc\u00ed «ssh». P\u0159i spu\u0161t\u011bn\u00ed ssh-keygen bude vytvo\u0159en\u00fd p\u00e1r kl\u00ed\u010d\u016f ulo\u017een v «~\\\/ .ssh\\\/id_ecdsa_sk» a m\u016f\u017ee b\u00fdt pou\u017eit obdobn\u011b jako jin\u00e9 kl\u00ed\u010de. <\/p>\n

Ve\u0159ejn\u00fd kl\u00ed\u010d (id_ecdsa_sk.pub) by m\u011bl b\u00fdt zkop\u00edrov\u00e1n na server do souboru authorized_keys. Na stran\u011b serveru se pouze ov\u011b\u0159uje digit\u00e1ln\u00ed podpis, zat\u00edmco interakce s tokeny prob\u00edh\u00e1 na stran\u011b klienta (na serveru nen\u00ed pot\u0159eba instalovat libsk-libfido2, ale server by m\u011bl podporovat typ kl\u00ed\u010d\u016f «ecdsa-sk»). Vygenerovan\u00fd soukrom\u00fd kl\u00ed\u010d (id_ecdsa_sk) je v podstat\u011b deskriptor kl\u00ed\u010de, kter\u00fd vytv\u00e1\u0159\u00ed skute\u010dn\u00fd kl\u00ed\u010d pouze v kombinaci s tajnou sekvenc\u00ed uchov\u00e1vanou na stran\u011b tokenu U2F.<\/p>\n

Pokud se kl\u00ed\u010d id_ecdsa_sk dostane do rukou \u00fato\u010dn\u00edka, bude k proveden\u00ed autentizace pot\u0159ebovat tak\u00e9 p\u0159\u00edstup k hardwarov\u00e9mu tokenu, bez n\u011bho\u017e je ulo\u017een\u00fd soubor id_ecdsa_sk soukrom\u00fd kl\u00ed\u010d bezcenn\u00fd. Nav\u00edc, ve v\u00fdchoz\u00edm nastaven\u00ed je vy\u017eadov\u00e1no m\u00edstn\u00ed potvrzen\u00ed fyzick\u00e9 p\u0159\u00edtomnosti u\u017eivatele p\u0159i prov\u00e1d\u011bn\u00ed jak\u00fdchkoliv operac\u00ed s kl\u00ed\u010di (jak p\u0159i generov\u00e1n\u00ed, tak p\u0159i autentizaci), nap\u0159\u00edklad se doporu\u010duje dotknout se senzoru na tokenu, co\u017e zt\u011b\u017euje prov\u00e1d\u011bn\u00ed d\u00e1lkov\u00fdch \u00fatok\u016f na syst\u00e9my s p\u0159ipojen\u00fdm tokenem. Jako dal\u0161\u00ed prvek ochrany m\u016f\u017ee b\u00fdt p\u0159i spu\u0161t\u011bn\u00ed ssh-keygen tak\u00e9 zad\u00e1no heslo pro p\u0159\u00edstup k souboru s kl\u00ed\u010dem. <\/p>\n

Kl\u00ed\u010d U2F m\u016f\u017ee b\u00fdt p\u0159id\u00e1n do ssh-agentu p\u0159es «ssh-add ~\\\/ .ssh\\\/id_ecdsa_sk», ale ssh-agent mus\u00ed b\u00fdt vytvo\u0159en s podporou kl\u00ed\u010d\u016f «ecdsa-sk», mus\u00ed b\u00fdt k dispozici vrstva libsk-libfido2 a agent mus\u00ed b\u011b\u017eet na syst\u00e9m, ke kter\u00e9mu se token p\u0159ipojuje.
\nNov\u00fd typ kl\u00ed\u010d\u016f «ecdsa-sk» byl p\u0159id\u00e1n, proto\u017ee form\u00e1t ecdsa-kl\u00ed\u010d\u016f OpenSSH se li\u0161\u00ed od form\u00e1tu U2F pro digit\u00e1ln\u00ed podpisy ECDSA p\u0159\u00edtomnost\u00ed dal\u0161\u00edch pol\u00ed.<\/p>\n

<\/a><\/noindex><\/p>\n

Zdroj: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043a\u043e\u0434\u043e\u0432\u0443\u044e \u0431\u0430\u0437\u0443 OpenSSH \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0430 \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u0430\u044f \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430 \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432, \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u044e\u0449\u0438\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b U2F, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u044b\u0439 \u0430\u043b\u044c\u044f\u043d\u0441\u043e\u043c FIDO. U2F \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u0442\u044c \u043d\u0435\u0434\u043e\u0440\u043e\u0433\u0438\u0435 \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u044b\u0435 \u0442\u043e\u043a\u0435\u043d\u044b \u0434\u043b\u044f \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u044f \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435 \u0441 \u043a\u043e\u0442\u043e\u0440\u044b\u043c\u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 USB, Bluetooth \u0438\u043b\u0438 NFC. \u041f\u043e\u0434\u043e\u0431\u043d\u044b\u0435 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u043f\u0440\u043e\u0434\u0432\u0438\u0433\u0430\u044e\u0442\u0441\u044f \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0434\u043b\u044f \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043d\u0430 \u0441\u0430\u0439\u0442\u0430\u0445, \u0443\u0436\u0435 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u044e\u0442\u0441\u044f \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u043c\u0438 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430\u043c\u0438 \u0438 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u044e\u0442\u0441\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-52210","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Do OpenSSH byla p\u0159id\u00e1na podpora univerz\u00e1ln\u00ed dvouf\u00e1zov\u00e9 autentizace | ProHoster","description":"Do k\u00f3dov\u00e9 z\u00e1kladny OpenSSH byla p\u0159id\u00e1na experiment\u00e1ln\u00ed podpora pro dvouf\u00e1zovou autentizaci s vyu\u017eit\u00edm.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/v-openssh-dobavlena-podderzhka-universalnoj-dvuhfaktornoj-autentifikatsii","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 OpenSSH \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0430 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430 \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0430\u043b\u044c\u043d\u043e\u0439 \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 | ProHoster","og:description":"\u0412 \u043a\u043e\u0434\u043e\u0432\u0443\u044e \u0431\u0430\u0437\u0443 OpenSSH \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0430 \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u0430\u044f \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430 \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/v-openssh-dobavlena-podderzhka-universalnoj-dvuhfaktornoj-autentifikatsii","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-02T21:00:00+00:00","article:modified_time":"2020-02-18T10:59:53+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"52210","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 02:52:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:47:23","updated":"2026-01-24 02:52:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/52210","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=52210"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/52210\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=52210"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=52210"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=52210"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}