{"id":123013,"date":"2025-03-26T16:22:56","date_gmt":"2025-03-26T14:22:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/kompaniya-cloudflare-opublikovala-opkssh-dlya-autentifikaczii-v-ssh-cherez-openid-connect"},"modified":"2025-03-26T16:22:56","modified_gmt":"2025-03-26T14:22:58","slug":"kompaniya-cloudflare-opublikovala-opkssh-dlya-autentifikaczii-v-ssh-cherez-openid-connect","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/kompaniya-cloudflare-opublikovala-opkssh-dlya-autentifikaczii-v-ssh-cherez-openid-connect","title":{"rendered":"Cloudflare har offentliggjort opkssh til SSH-autentificering via OpenID Connect","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Cloudflare har pr\u00e6senteret v\u00e6rkt\u00f8jet opkssh (OpenPubkey SSH), som muligg\u00f8r integration af centraliseret autentifikation i OpenSSH med mulighed for login via OpenID Connect-udbydere. Med opkssh kan man undg\u00e5 manuel administration og ops\u00e6tning af SSH-n\u00f8gler og organisere forbindelse til serveren fra enhver v\u00e6rt uden behov for at oprette private n\u00f8gler p\u00e5 hver klientcomputer og uden manuel kopiering af offentlige n\u00f8gler til serveren. For at tilslutte sig er det tilstr\u00e6kkeligt at udf\u00f8re en binding til en konto hos OpenID-udbyderen p\u00e5 serveren. Koden til v\u00e6rkt\u00f8jet er skrevet i Go og distribueres under Apache 2.0 licensen. <\/p>\n

Opkssh er kompatibel med OpenID-udbydere som Google, Microsoft\/Azure og Gitlab, hvilket g\u00f8r det muligt at konfigurere login via eksisterende konti i tjenesterne gmail.com, microsoft.com og gitlab.com. Ved brug af opkssh genereres der midlertidige n\u00f8gler i stedet for n\u00f8gler uden tidsbegr\u00e6nsning, som er gyldige i et par timer og skabes baseret p\u00e5 bekr\u00e6ftelse fra OpenID-udbyderen. L\u00e6kage af s\u00e5danne n\u00f8gler efter udl\u00f8b udg\u00f8r ikke en sikkerhedstrussel. Som standard er n\u00f8glernes gyldighedsperiode 24 timer, hvorefter det er n\u00f8dvendigt at identificere sig igen via OpenID. <\/p>\n

Integrationen med OpenSSH er baseret p\u00e5 muligheden for at oprette SSH-protokoludvidelser, der tillader vedh\u00e6ftning af vilk\u00e5rlige data til SSH-certifikater. Efter autentifikation via OpenID genererer klienten en offentlig n\u00f8gle, der indeholder en PK-token, som bekr\u00e6fter, at n\u00f8glen tilh\u00f8rer den angivne bruger. Tokenet integreres i SSH-protokollen gennem feltet for yderligere data i SSH-certifikatet. Oprettelse af PK-tokens og deres verificering p\u00e5 serversiden udf\u00f8res ved hj\u00e6lp af det kryptografiske protokol OpenPubKey. <\/p>\n

OpenPubKey g\u00f8r det muligt at generere en offentlig n\u00f8gle og knytte den til en token, der er udstedt af OpenID-udbyderen. Gennem den digitale underskrift bekr\u00e6fter udbyderen, at denne n\u00f8gle er oprettet af den angivne autentificerede bruger. For eksempel kan OpenID-udbyderen Google bekr\u00e6fte, at brugeren er autentificeret som test@gmail.com. P\u00e5 serversiden kontrolleres det, om den vedh\u00e6ftede token er underskrevet af OpenID-udbyderen, og om den digitale underskrift svarer til den angivne offentlige n\u00f8gle, dvs. serveren kan bekr\u00e6fte, at det netop er brugeren test@gmail.com, der har oprettet den offentlige n\u00f8gle til den tilkoblede SSH-klient.

\"Cloudflare<\/center> <\/p>\n

Integrationen med OpenSSH er organiseret ved at angive programmet opkssh i konfigurationsfilen 'sshd_config' gennem direktivet 'AuthorizedKeysCommand' (f.eks.: 'AuthorizedKeysCommand \/usr\/local\/bin\/opkssh verify %u %k %t'). Ops\u00e6tningen af \u200b\u200bbindingen af \u200b\u200bbrugerkonti til OpenID udf\u00f8res p\u00e5 SSH-serverens side. P\u00e5 SSH-klientens side kr\u00e6ves der ikke \u00e6ndringer i indstillingerne, men f\u00f8r login skal kommandoen 'opkssh login' k\u00f8res, hvorefter der v\u00e6lges en OpenID-udbyder i det fremkomne browservindue, og godkendelse skal gennemf\u00f8res via denne. <\/p>\n

V\u00e6rkt\u00f8jet opkssh genererer SSH-n\u00f8gler og modtager en PK-token, der bekr\u00e6fter, at brugeren er blevet autentificeret og g\u00f8r det muligt at bekr\u00e6fte, at de oprettede n\u00f8gler tilh\u00f8rer den angivne bruger. Den offentlige SSH-n\u00f8gle, som har en PK-token knyttet til sig via et felt med ekstra data, vil blive skrevet til filen ~\/ .ssh\/id_ecdsas og begynder at blive sendt ved tilslutning til server<\/a> v\u00e6rkt\u00f8jet ssh. <\/p>\n

For at oprette forbindelse til serveren anvendes den s\u00e6dvanlige SSH-syntaks 'ssh login@server', mens serveren<\/a> login f\u00f8rst skal identificeres med en konto i OpenID, som brugeren benytter. Den samlede proces indeb\u00e6rer, at SSH-klienten sender den offentlige n\u00f8gle til SSH-serveren, som derefter k\u00f8rer kommandoen 'opkssh verify' for at kontrollere n\u00f8glen. <\/p>\n

For at binde en konto til OpenID udf\u00f8rer serveradministratoren kommandoen 'opkssh add'. For eksempel, for at tillade login p\u00e5 serveren som brugeren 'root' med OpenID-godkendelse gennem kontoen test@gmail.com i Gmail, skal man k\u00f8re 'sudo opkssh add root test@gmail.com google', hvorefter klienten kan oprette forbindelse med disse kontoindstillinger ved hj\u00e6lp af kommandoen 'ssh root@server_host'. <\/p>\n

Bindingen af kontoen kan ogs\u00e5 udf\u00f8res manuelt gennem konfigurationsfilen \/etc\/opk\/auth_id (eller ~\/.opk\/auth_id), hvor der for ovenst\u00e5ende eksempel skrives linjen 'root test@gmail.com https:\/\/accounts.google.com'. Desuden kan man gennem filen \/etc\/opk\/providers definere listen over godkendte OpenID-udbydere, deres parametre og listen over tilladte klientidentifikatorer.

\"Cloudflare<\/center>
\n
Kilde: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cloudflare \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439 opkssh (OpenPubkey SSH), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0432 OpenSSH \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0446\u0435\u043d\u0442\u0440\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c\u044e \u0432\u0445\u043e\u0434\u0430 \u0447\u0435\u0440\u0435\u0437 \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u0432 OpenID Connect. \u041f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 opkssh \u043c\u043e\u0436\u043d\u043e \u0438\u0437\u0431\u0430\u0432\u0438\u0442\u044c\u0441\u044f \u043e\u0442 \u0440\u0443\u0447\u043d\u043e\u0439 \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044e \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 SSH-\u043a\u043b\u044e\u0447\u0435\u0439, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0443 \u0441 \u043b\u044e\u0431\u044b\u0445 \u0445\u043e\u0441\u0442\u043e\u0432, \u0431\u0435\u0437 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0437\u0430\u043a\u0440\u044b\u0442\u044b\u0445 \u043a\u043b\u044e\u0447\u0435\u0439 \u043d\u0430 \u043a\u0430\u0436\u0434\u043e\u043c \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u043e\u043c \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0435 \u0438 \u0431\u0435\u0437 \u0440\u0443\u0447\u043d\u043e\u0433\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":123014,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-123013","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Cloudflare har offentliggjort opkssh til SSH-autentificering via OpenID Connect | ProHoster","description":"Cloudflare har pr\u00e6senteret v\u00e6rkt\u00f8jet opkssh (OpenPubkey SSH), der g\u00f8r det muligt at integrere centraliseret autentificering i OpenSSH med mulighed for login via OpenID Connect-udbydere.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/kompaniya-cloudflare-opublikovala-opkssh-dlya-autentifikaczii-v-ssh-cherez-openid-connect","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cloudflare \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 opkssh \u0434\u043b\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 SSH \u0447\u0435\u0440\u0435\u0437 OpenID Connect | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cloudflare \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439 opkssh (OpenPubkey SSH), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0432 OpenSSH \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0446\u0435\u043d\u0442\u0440\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c\u044e \u0432\u0445\u043e\u0434\u0430 \u0447\u0435\u0440\u0435\u0437 \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u0432 OpenID Connect.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/kompaniya-cloudflare-opublikovala-opkssh-dlya-autentifikaczii-v-ssh-cherez-openid-connect","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-03-26T14:22:58+00:00","article:modified_time":"2025-03-26T14:22:58+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"123013","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 22:07:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 11:38:16","updated":"2026-02-09 22:07:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/123013","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=123013"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/123013\/revisions"}],"predecessor-version":[{"id":160229,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/123013\/revisions\/160229"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media\/123014"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=123013"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=123013"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=123013"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}