{"id":99236,"date":"2021-02-22T22:22:43","date_gmt":"2021-02-22T20:22:43","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-passwdqc-2-0-0-s-podderzhkoj-vneshnih-filtrov"},"modified":"2021-02-22T22:22:43","modified_gmt":"2021-02-22T20:22:43","slug":"vypusk-passwdqc-2-0-0-s-podderzhkoj-vneshnih-filtrov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/vypusk-passwdqc-2-0-0-s-podderzhkoj-vneshnih-filtrov","title":{"rendered":"Vyd\u00e1n\u00ed passwdqc 2.0.0 s podporou extern\u00edch filtr\u016f","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Byla vyd\u00e1na nov\u00e1 verze passwdqc \u2014 sady n\u00e1stroj\u016f pro kontrolu slo\u017eitosti hesel a fr\u00e1z\u00ed, kter\u00e1 zahrnuje modul pam_passwdqc, programy pwqcheck, pwqfilter (p\u0159id\u00e1n v t\u00e9to verzi) a pwqgen pro ru\u010dn\u00ed pou\u017eit\u00ed nebo ze skript\u016f, jako\u017e i knihovnu libpasswdqc. Podporov\u00e1ny jsou jak syst\u00e9my s PAM (v\u011bt\u0161ina Linuxu, FreeBSD, DragonFly BSD, Solaris, HP-UX), tak bez PAM (podporov\u00e1no rozhran\u00ed passwordcheck v OpenBSD, dod\u00e1v\u00e1 se ob\u00e1lka pro pou\u017eit\u00ed pwqcheck z PHP, existuje placen\u00e1 verze pro Windows, a programy a knihovna mohou b\u00fdt pou\u017eity i na jin\u00fdch syst\u00e9mech). <\/p>\n

Ve srovn\u00e1n\u00ed s p\u0159edchoz\u00edmi verzemi byla p\u0159id\u00e1na podpora extern\u00edch soubor\u016f pro filtrov\u00e1n\u00ed hesel, v\u010detn\u011b bin\u00e1rn\u00edch, kter\u00e9 v sou\u010dasn\u00e9 dob\u011b p\u0159edstavuj\u00ed realizaci vylep\u0161en\u00e9ho ku\u0159ec\u00edho filtru. Tento filtr zaru\u010den\u011b neuvoln\u00ed \u017e\u00e1dn\u00e9 z zak\u00e1zan\u00fdch hesel, ale m\u016f\u017ee ob\u010das vykazovat fale\u0161n\u00e9 poplachy, jejich\u017e pravd\u011bpodobnost je p\u0159i pou\u017eit\u00fdch nastaven\u00edch a algoritmu passwdqc zanedbateln\u00e1. Kontrola hesla na p\u0159\u00edtomnost ve filtraci vy\u017eaduje maxim\u00e1ln\u011b dva n\u00e1hodn\u00e9 p\u0159\u00edstupy ke \u010dten\u00ed z disku, co\u017e je velmi rychl\u00e9 a obvykle nezp\u016fsobuje nadm\u011brn\u00e9 zat\u00ed\u017een\u00ed. serveru<\/a>. <\/p>\n

Pro vytv\u00e1\u0159en\u00ed a pr\u00e1ci s bin\u00e1rn\u00edmi filtry v passwdqc byl p\u0159id\u00e1n program pwqfilter. Ten m\u016f\u017ee vytvo\u0159it filtr jak ze seznamu samotn\u00fdch hesel, tak z jejich hash\u016f MD4 nebo NTLM. Podpora hash\u016f NTLM umo\u017e\u0148uje importovat hesla ze seznamu HIBP (Pwned Passwords), distribuovan\u00e9ho t\u00edmto zp\u016fsobem. Bylo vlo\u017eeno mnoho \u00fasil\u00ed do optimalizace pwqfilter pro rychlost, kompaktnost z\u00edskan\u00fdch filtr\u016f a tak\u00e9 \u00farove\u0148 fale\u0161n\u00fdch poplach\u016f. Nap\u0159\u00edklad vytvo\u0159en\u00ed ku\u0159ec\u00edho filtru s load factor 98 % z souboru pwned-passwords-ntlm-ordered-by-hash-v7.txt o velikosti 21 GiB (22 GB) a obsahuj\u00edc\u00edho v\u00edce ne\u017e 613 milion\u016f \u0159\u00e1dk\u016f trv\u00e1 p\u0159ibli\u017en\u011b 8 minut na procesoru Core i7-4770K. Vytvo\u0159en\u00fd filtr zab\u00edr\u00e1 2.3 GiB (2.5 GB) a m\u00e1 \u00farove\u0148 fale\u0161n\u00fdch poplach\u016f p\u0159ibli\u017en\u011b 1 na 1.15 miliard. P\u0159i ni\u017e\u0161\u00edm c\u00edlov\u00e9m koeficientu zat\u00ed\u017een\u00ed m\u016f\u017ee b\u00fdt filtr vytvo\u0159en mnohem rychleji a bude m\u00edt \u00farove\u0148 fale\u0161n\u00fdch poplach\u016f je\u0161t\u011b ni\u017e\u0161\u00ed, ale jeho velikost bude v\u011bt\u0161\u00ed. <\/p>\n

passwdqc velmi dob\u0159e zabra\u0148uje slab\u00fdm hesl\u016fm a to bez pou\u017eit\u00ed extern\u00edch soubor\u016f. Jejich pou\u017eit\u00ed m\u016f\u017ee d\u00e1le zv\u00fd\u0161it efektivitu passwdqc, p\u0159i\u010dem\u017e p\u0159itom t\u00e9m\u011b\u0159 nezp\u016fsobuje u\u017eivatel\u016fm dal\u0161\u00ed nep\u0159\u00edjemnosti, nebo m\u016f\u017ee povolit oslaben\u00ed dal\u0161\u00edch omezen\u00ed. Kontrola vybran\u00fdch hesel u\u017eivateli podle zn\u00e1m\u00fdch \u00fanik\u016f dat je doporu\u010dov\u00e1na NIST. Pro projekt Openwall je to potenci\u00e1ln\u00ed mo\u017enost financov\u00e1n\u00ed v\u00fdvoje passwdqc (a nejen) prost\u0159ednictv\u00edm prodeje hotov\u00fdch filtr\u016f, ani\u017e by omezovala u\u017eivatele ve vytv\u00e1\u0159en\u00ed vlastn\u00edch filtr\u016f s vyu\u017eit\u00edm programu pwqfilter vydan\u00e9ho pod svobodnou licenc\u00ed. <\/p>\n

pwqfilter pracuje s libovoln\u00fdmi \u0159et\u011bzci a m\u016f\u017ee b\u00fdt pou\u017eit m\u00edsto grep pro mnoh\u00e9 \u00fa\u010dely, kter\u00e9 se ani net\u00fdkaj\u00ed hesel a bezpe\u010dnosti. Vzhledem k tomu m\u00e1 pwqfilter n\u011bkolik mo\u017enost\u00ed podobn\u00fdch t\u011bm, kter\u00e9 jsou dostupn\u00e9 v grep, vyh\u00fdb\u00e1 se pou\u017e\u00edv\u00e1n\u00ed n\u00e1zv\u016f mo\u017enost\u00ed, kter\u00e9 by odporovaly t\u011bm v grep, a pou\u017e\u00edv\u00e1 stejn\u00e9 n\u00e1vratov\u00e9 k\u00f3dy jako grep. <\/p>\n

Pro \u00fakoly, kde jsou fale\u0161n\u00e9 pozitivy krajn\u011b ne\u017e\u00e1douc\u00ed, m\u016f\u017ee b\u00fdt jejich \u00farove\u0148 sn\u00ed\u017eena nap\u0159\u00edklad na jednu na kvintilion (milion miliard) p\u0159i zat\u00ed\u017een\u00ed a\u017e 44%. (Klasick\u00fd kuka\u010d\u010d\u00ed filtr ned\u00e1v\u00e1 tak v\u00fdznamn\u00e9 sn\u00ed\u017een\u00ed \u00farovn\u011b fale\u0161n\u00fdch pozitiv\u016f p\u0159i sn\u00ed\u017een\u00ed zat\u00ed\u017een\u00ed. V passwdqc je to dosa\u017eeno d\u00edky vylep\u0161en\u00edm algoritmu).
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412\u044b\u043f\u0443\u0449\u0435\u043d\u0430 \u043d\u043e\u0432\u0430\u044f \u0432\u0435\u0440\u0441\u0438\u044f passwdqc — \u043d\u0430\u0431\u043e\u0440\u0430 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0434\u043b\u044f \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u0441\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u043f\u0430\u0440\u043e\u043b\u0435\u0439 \u0438 \u043f\u0430\u0440\u043e\u043b\u044c\u043d\u044b\u0445 \u0444\u0440\u0430\u0437, \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0449\u0435\u0433\u043e \u043c\u043e\u0434\u0443\u043b\u044c pam_passwdqc, \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b pwqcheck, pwqfilter (\u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0430 \u0432 \u044d\u0442\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438) \u0438 pwqgen \u0434\u043b\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0432\u0440\u0443\u0447\u043d\u0443\u044e \u0438\u043b\u0438 \u0438\u0437 \u0441\u043a\u0440\u0438\u043f\u0442\u043e\u0432, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0443 libpasswdqc. \u041f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u044e\u0442\u0441\u044f \u043a\u0430\u043a \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0441 PAM (\u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e Linux, FreeBSD, DragonFly BSD, Solaris, HP-UX), \u0442\u0430\u043a \u0438 \u0431\u0435\u0437 PAM (\u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 passwordcheck […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-99236","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vyd\u00e1n\u00ed passwdqc 2.0.0 s podporou extern\u00edch filtr\u016f | ProHoster","description":"Byla vyd\u00e1na nov\u00e1 verze passwdqc - sady n\u00e1stroj\u016f pro kontrolu slo\u017eitosti hesel a heslov\u00fdch fr\u00e1z\u00ed, kter\u00e1 zahrnuje modul pam_passwdqc, programy pwqcheck, pwqfilter (p\u0159id\u00e1n v t\u00e9to verzi) a pwqgen.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/vypusk-passwdqc-2-0-0-s-podderzhkoj-vneshnih-filtrov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a passwdqc 2.0.0 \u0441 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u043e\u0439 \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0444\u0438\u043b\u044c\u0442\u0440\u043e\u0432 | ProHoster","og:description":"\u0412\u044b\u043f\u0443\u0449\u0435\u043d\u0430 \u043d\u043e\u0432\u0430\u044f \u0432\u0435\u0440\u0441\u0438\u044f passwdqc - \u043d\u0430\u0431\u043e\u0440\u0430 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0434\u043b\u044f \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u0441\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u043f\u0430\u0440\u043e\u043b\u0435\u0439 \u0438 \u043f\u0430\u0440\u043e\u043b\u044c\u043d\u044b\u0445 \u0444\u0440\u0430\u0437, \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0449\u0435\u0433\u043e \u043c\u043e\u0434\u0443\u043b\u044c pam_passwdqc, \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b pwqcheck, pwqfilter (\u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0430 \u0432 \u044d\u0442\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438) \u0438 pwqgen \u0434\u043b\u044f.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/vypusk-passwdqc-2-0-0-s-podderzhkoj-vneshnih-filtrov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-02-22T20:22:43+00:00","article:modified_time":"2021-02-22T20:22:43+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"99236","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[],"defaultGraph":"","defaultPostTypeGraph":""},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 09:53:59","updated":"2026-02-22 15:29:50","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/99236","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=99236"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/99236\/revisions"}],"predecessor-version":[{"id":162219,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/99236\/revisions\/162219"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=99236"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=99236"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=99236"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}