{"id":103424,"date":"2022-02-24T15:36:49","date_gmt":"2022-02-24T13:36:49","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/reliz-openssh-8-9-s-ustraneniem-uyazvimosti-v-sshd"},"modified":"2022-02-24T15:36:49","modified_gmt":"2022-02-24T13:36:49","slug":"reliz-openssh-8-9-s-ustraneniem-uyazvimosti-v-sshd","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/reliz-openssh-8-9-s-ustraneniem-uyazvimosti-v-sshd","title":{"rendered":"OpenSSH 8.9 udgivet med s\u00e5rbarhedslukning i sshd","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Efter seks m\u00e5neders udvikling pr\u00e6senteres OpenSSH 8.9, den \u00e5bne implementering af klient og server til brug med SSH 2.0 og SFTP protokoller. I den nye version af sshd er en s\u00e5rbarhed blevet lukkede, som potentielt kunne give adgang uden autentificering. Problemet skyldes et heltals-overl\u00f8b i autentificeringskoden, men udnyttelse er kun mulig i kombination med andre logiske fejl i koden.    <\/p>\n<p> I sin nuv\u00e6rende form kan s\u00e5rbarheden ikke udnyttes, n\u00e5r privilegieadskillelsestilstand er aktiveret, da dens manifestation blokeres af individuelle kontroller udf\u00f8rt i koden for privilegieadskillelse. Privilegieadskillelsestilstand blev aktiveret som standard i 2002 med OpenSSH 3.2.2, og er obligatorisk siden udgivelsen af OpenSSH 7.5, der blev offentliggjort i 2017. Desuden i de b\u00e6rbare versioner af OpenSSH fra og med udgivelsen 6.5 (2014) blokeres s\u00e5rbarheden ved kompilering med aktivering af flags til beskyttelse mod heltals-overl\u00f8b.       <\/p>\n<p>Andre \u00e6ndringer:  <\/p>\n<ul>\n<li class=\"l\"> I den b\u00e6rbare version af OpenSSH er den indbygget st\u00f8tte til hashing af adgangskoder ved hj\u00e6lp af MD5-algoritmen fjernet (for at genoprette adgang er det tilladt at linke til eksterne biblioteker som libxcrypt).\n<li class=\"l\"> I ssh, sshd, ssh-add og ssh-agent er der implementeret et undersystem til at begr\u00e6nse overf\u00f8rsel og brug af n\u00f8gler, der er tilf\u00f8jet til ssh-agent. Undersystemet g\u00f8r det muligt at definere regler, der angiver hvordan og hvor n\u00f8gler kan bruges i ssh-agent. For eksempel, for at tilf\u00f8je en n\u00f8gle, der kun kan bruges til at autentificere enhver bruger, der opretter forbindelse til v\u00e6rten scylla.example.org, brugeren perseus til v\u00e6rten cetus.example.org og brugeren medea til v\u00e6rten charybdis.example.org med omdirigering via den mellemliggende v\u00e6rt scylla.example.org, kan f\u00f8lgende kommando anvendes:        $ ssh-add -h &#171;perseus@cetus.example.org&#187; &#092;            -h &#171;scylla.example.org&#187; &#092;            -h &#171;scylla.example.org&gt;medea@charybdis.example.org&#187; &#092;            ~\\\/ .ssh\\\/id_ed25519\n<li class=\"l\"> I ssh og sshd er hybridalgoritmen &#171;sntrup761x25519-sha512@openssh.com&#187; (ECDH\/x25519 + NTRU Prime), der er modstandsdygtig over for brute-force angreb p\u00e5 kvantecomputere, som standard blevet tilf\u00f8jet til listen over KexAlgorithms, der bestemmer r\u00e6kkef\u00f8lgen af valg af metoder til n\u00f8gleudveksling. I version 8.9 af OpenSSH blev denne forhandlingsmetode tilf\u00f8jet mellem metoderne ECDH og DH, men i den n\u00e6ste udgave planl\u00e6gges det at anvende det som standard.\n<li class=\"l\"> I ssh-keygen, ssh og ssh-agent er h\u00e5ndteringen af FIDO-token n\u00f8gler, der bruges til enhedsverifikation, forbedret, herunder n\u00f8gler til biometrisk autentificering.\n<li class=\"l\"> Der er tilf\u00f8jet kommandoen &#171;ssh-keygen -Y match-principals&#187; i ssh-keygen til at kontrollere brugernavne i filen med den tilladte liste over navne.\n<li class=\"l\"> I ssh-add og ssh-agent er det nu muligt at tilf\u00f8je PIN-beskyttede FIDO-n\u00f8gler til ssh-agent (PIN-anmodningen vises ved autentificering).\n<li class=\"l\"> I ssh-keygen er det tilladt at v\u00e6lge hash-algoritme (sha512 eller sha256) under dannelsen af signaturen.\n<li class=\"l\"> I ssh og sshd er netv\u00e6rksdata blevet l\u00e6st direkte ind i bufferne for modtagne pakker for at forbedre ydeevnen, hvilket omg\u00e5r den mellemliggende buffering i stakken. Tilsvarende er det implementeret, at de modtagne data direkte placeres i kanalbufferen.\n<li class=\"l\"> I ssh er listen over underst\u00f8ttede parametre (yes|no|unbound|host-bound) i direktivet PubkeyAuthentication blevet udvidet for at give mulighed for at v\u00e6lge den version af den anvendte protokoludvidelse.      <\/ul>\n<p>I en af de kommende udgivelser planl\u00e6gges det at \u00e6ndre standardindstillingen for scp-v\u00e6rkt\u00f8jet til at bruge SFTP i stedet for det for\u00e6ldede SCP\/RCP-protokol. SFTP anvender mere forudsigelige metoder til behandlingen af navne og undg\u00e5r glob-m\u00f8nstre i filnavne via shell p\u00e5 den anden v\u00e6rt, hvilket skaber sikkerhedsproblemer. Specifikt, n\u00e5r SCP og RCP anvendes, tr\u00e6ffer serveren beslutninger om, hvilke filer og kataloger der skal sendes til klienten, og klienten tjekker kun gyldigheden af de returnerede objektnavne, hvilket i tilf\u00e6lde af manglende tilstr\u00e6kkelig kontrol p\u00e5 klientsiden tillader <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/da\/server\/dts-shicago\/\"   title=\"server\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"2906\">server<\/a> overf\u00f8re andre filnavne, der adskiller sig fra de forespurgte. SFTP-protokollen har ikke disse problemer, men underst\u00f8tter ikke afsl\u00f8ring af specielle stier som &#171;~\\\/&#187;. For at l\u00f8se denne forskel blev der i den tidligere version af OpenSSH foresl\u00e5et en ny SFTP-protokoludvidelse til SFTP-serverimplementeringen for at afsl\u00f8re stierne ~\\\/ og ~user\\\/.<br \/>\n<br \/>Kilde: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=56751\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u043e\u0441\u043b\u0435 \u0448\u0435\u0441\u0442\u0438 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 OpenSSH 8.9, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430\u043c SSH 2.0 \u0438 SFTP. \u0412 \u043d\u043e\u0432\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438 \u0432 sshd \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u0446\u0435\u043b\u043e\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u044b\u043c \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u0432 \u043a\u043e\u0434\u0435 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u0430 \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0441\u043e\u0447\u0435\u0442\u0430\u043d\u0438\u0438 \u0441 \u0434\u0440\u0443\u0433\u0438\u043c\u0438 \u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0438\u043c\u0438 \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438 \u0432 \u043a\u043e\u0434\u0435. \u0412 \u0442\u0435\u043a\u0443\u0449\u0435\u043c [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-103424","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u043e\u0441\u043b\u0435 \u0448\u0435\u0441\u0442\u0438 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 OpenSSH 8.9, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430\u043c SSH 2.0 \u0438 SFTP.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/da\/blog\/news\/reliz-openssh-8-9-s-ustraneniem-uyazvimosti-v-sshd\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"da_DK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 OpenSSH 8.9 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 sshd | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u043e\u0441\u043b\u0435 \u0448\u0435\u0441\u0442\u0438 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 OpenSSH 8.9, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430\u043c SSH 2.0 \u0438 SFTP.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/da\/blog\/news\/reliz-openssh-8-9-s-ustraneniem-uyazvimosti-v-sshd\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2022-02-24T13:36:49+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2022-02-24T13:36:49+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Udgivelsen af OpenSSH 8.9 med fejlrettelser i sshd | ProHoster","description":"Efter seks m\u00e5neders udvikling er OpenSSH 8.9-release blevet pr\u00e6senteret, en \u00e5ben implementering af klient og server til brug over SSH 2.0- og SFTP-protokoller.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/reliz-openssh-8-9-s-ustraneniem-uyazvimosti-v-sshd","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 OpenSSH 8.9 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 sshd | ProHoster","og:description":"\u041f\u043e\u0441\u043b\u0435 \u0448\u0435\u0441\u0442\u0438 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 OpenSSH 8.9, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430\u043c SSH 2.0 \u0438 SFTP.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/reliz-openssh-8-9-s-ustraneniem-uyazvimosti-v-sshd","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-02-24T13:36:49+00:00","article:modified_time":"2022-02-24T13:36:49+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"103424","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-02-24 13:37:31","updated":"2026-02-09 21:42:01","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/103424","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=103424"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/103424\/revisions"}],"predecessor-version":[{"id":160186,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/103424\/revisions\/160186"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=103424"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=103424"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=103424"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}