OpenSSH 8.8 er udgivet, en open source-implementering af klient og server til arbejde med SSH 2.0 og SFTP-protokoller. Udgivelsen er bem\u00e6rkelsesv\u00e6rdig ved, at brugen af digitale signaturer baseret p\u00e5 RSA-n\u00f8gler med SHA-1-hash er deaktiveret som standard («ssh-rsa»). <\/p>\n
Stoppen for underst\u00f8ttelse af «ssh-rsa» skyldes den \u00f8gede effektivitet af kollisionangreb med forudbestemt pr\u00e6fiks (omkostningerne ved at finde en kollisionsv\u00e6rdi er ansl\u00e5et til cirka 50.000 dollars). For at kontrollere brugen af ssh-rsa i dine systemer kan du pr\u00f8ve at oprette forbindelse via ssh med indstillingen «-oHostKeyAlgorithms=-ssh-rsa». Underst\u00f8ttelsen af RSA-signaturer med SHA-256 og SHA-512-hashes (rsa-sha2-256\/512), som har v\u00e6ret underst\u00f8ttet siden OpenSSH 7.2, forbliver u\u00e6ndret. <\/p>\n
I de fleste tilf\u00e6lde vil stoppet for underst\u00f8ttelse af «ssh-rsa» ikke kr\u00e6ve, at brugerne udf\u00f8rer nogen manuelle handlinger, da indstillingen UpdateHostKeys tidligere var aktiveret som standard i OpenSSH, hvilket automatisk skifter kunder til mere p\u00e5lidelige algoritmer. Til migrering anvendes protokolekstraen «hostkeys@openssh.com», som g\u00f8r det muligt server<\/a> efter autentificering at informere kunden om alle tilg\u00e6ngelige v\u00e6rtsn\u00f8gler. Hvis du opretter forbindelse til v\u00e6rter med meget gamle versioner af OpenSSH p\u00e5 klientsiden, kan du selektivt genaktivere muligheden for at bruge «ssh-rsa»-signaturer ved at tilf\u00f8je i ~\/.ssh\/config: Host gammel_v\u00e6rtsnavn HostkeyAlgorithms +ssh-rsa \tPubkeyAcceptedAlgorithms +ssh-rsa <\/p>\n Den nye version adresserer ogs\u00e5 et sikkerhedsproblem, der opstod, fordi sshd, siden udgivelsen af OpenSSH 6.2, ikke korrekt udf\u00f8rte initialiseringen af brugergruppen ved udf\u00f8relse af kommandoer defineret i direktiverne AuthorizedKeysCommand og AuthorizedPrincipalsCommand. Disse direktiver skulle sikre, at kommandoer k\u00f8res under en anden bruger, men i praksis arvede de gruppelisten, der blev brugt ved opstart af sshd. Potentielt kunne en s\u00e5dan adf\u00e6rd, under nogle specifikke systemindstillinger, tillade en k\u00f8rende behandler at opn\u00e5 ekstra privilegier i systemet. <\/p>\n I noten til den nye udgave er der ogs\u00e5 offentliggjort en advarsel om hensigten om som standard at \u00e6ndre scp-v\u00e6rkt\u00f8jet til at bruge SFTP i stedet for det for\u00e6ldede SCP\/RCP-protokol. SFTP anvender mere forudsigelige metoder til behandlingen af navne og benytter ikke glob-syntaks i filnavnene p\u00e5 den eksterne v\u00e6rt, hvilket skaber sikkerhedsproblemer. Is\u00e6r ved brug af SCP og RCP. server<\/a> fastl\u00e6gger, hvilke filer og mapper der skal sendes til klienten, mens klienten blot kontrollerer korrektheden af de returnerede objekt navne, hvilket i tilf\u00e6lde af manglende ordentlig kontrol p\u00e5 klientsiden tillader serveren at sende andre filnavne, der adskiller sig fra de anmodede. SFTP-protokollen mangler disse problemer, men underst\u00f8tter ikke afsl\u00f8ring af s\u00e6rlige stier, s\u00e5som «~». For at fjerne denne forskel blev der i den tidligere udgivelse af OpenSSH foresl\u00e5et en ny protokolekstra for SFTP-serverimplementeringen til at afsl\u00f8re stier ~ og ~user. \u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 OpenSSH 8.8, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430\u043c SSH 2.0 \u0438 SFTP. \u0412\u044b\u043f\u0443\u0441\u043a \u043f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u0435\u043d \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435\u043c \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0446\u0438\u0444\u0440\u043e\u0432\u044b\u0445 \u043f\u043e\u0434\u043f\u0438\u0441\u0435\u0439 \u043d\u0430 \u0431\u0430\u0437\u0435 RSA-\u043a\u043b\u044e\u0447\u0435\u0439 \u0441 \u0445\u044d\u0448\u0435\u043c SHA-1 («ssh-rsa»). \u041f\u0440\u0435\u043a\u0440\u0430\u0449\u0435\u043d\u0438\u0435 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u043f\u043e\u0434\u043f\u0438\u0441\u0435\u0439 «ssh-rsa» \u043e\u0431\u0443\u0441\u043b\u043e\u0432\u043b\u0435\u043d\u043e \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435\u043c \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u043a\u043e\u043b\u043b\u0438\u0437\u0438\u043e\u043d\u043d\u044b\u0445 \u0430\u0442\u0430\u043a \u0441 \u0437\u0430\u0434\u0430\u043d\u043d\u044b\u043c \u043f\u0440\u0435\u0444\u0438\u043a\u0441\u043e\u043c (\u0441\u0442\u043e\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0434\u0431\u043e\u0440\u0430 \u043a\u043e\u043b\u043b\u0438\u0437\u0438\u0438 \u043e\u0446\u0435\u043d\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e \u0432 50 \u0442\u044b\u0441\u044f\u0447 \u0434\u043e\u043b\u043b\u0430\u0440\u043e\u0432). \u0414\u043b\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101430","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47OpenSSH 8.8 udgivet med deaktivering af underst\u00f8ttelse af digitale signaturer rsa-sha | ProHoster","description":"OpenSSH 8.8 er blevet udgivet, en open source-implementering af klient og server til drift via SSH 2.0 og SFTP-protokoller.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/reliz-openssh-8-8-s-otklyucheniem-podderzhki-czifrovyh-podpisej-rsa-sha","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 OpenSSH 8.8 \u0441 \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435\u043c \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u0446\u0438\u0444\u0440\u043e\u0432\u044b\u0445 \u043f\u043e\u0434\u043f\u0438\u0441\u0435\u0439 rsa-sha | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 OpenSSH 8.8, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430\u043c SSH 2.0 \u0438 SFTP.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/reliz-openssh-8-8-s-otklyucheniem-podderzhki-czifrovyh-podpisej-rsa-sha","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-09-26T20:22:36+00:00","article:modified_time":"2021-09-26T20:22:36+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101430","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-09-26 20:28:50","updated":"2026-02-09 21:42:00","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/101430","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=101430"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/101430\/revisions"}],"predecessor-version":[{"id":172943,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/101430\/revisions\/172943"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=101430"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=101430"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=101430"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Kilde: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"