{"id":52210,"date":"2019-11-03T00:00:00","date_gmt":"2019-11-02T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/v-openssh-dobavlena-podderzhka-universalnoj-dvuhfaktornoj-autentifikatsii"},"modified":"2020-02-18T13:59:53","modified_gmt":"2020-02-18T10:59:53","slug":"v-openssh-dobavlena-podderzhka-universalnoj-dvuhfaktornoj-autentifikatsii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/v-openssh-dobavlena-podderzhka-universalnoj-dvuhfaktornoj-autentifikatsii","title":{"rendered":"OpenSSH har tilf\u00f8jet support for universel to-faktorautentifikation","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

I OpenSSH-kodebasen tilf\u00f8jet<\/a><\/noindex> eksperimentel support for to-faktor autentificering ved brug af enheder, der underst\u00f8tter protokollen U2F<\/a><\/noindex>, udviklet af alliancen FIDO<\/a><\/noindex>. U2F muligg\u00f8r oprettelse af omkostningseffektive hardware tokens til bekr\u00e6ftelse af brugerens fysiske tilstedev\u00e6relse, hvor interaktionen sker via USB, Bluetooth eller NFC. S\u00e5danne enheder markedsf\u00f8res som et middel til to-faktor autentificering p\u00e5 websteder, underst\u00f8ttes allerede af de fleste webbrowsere og produceres af forskellige producenter, herunder Yubico, Feitian, Thetis og Kensington.<\/p>\n

For interaction with devices that confirm the presence of a user, OpenSSH has added a new type of key, «sk-ecdsa-sha2-nistp256@openssh.com» («ecdsa-sk»), which uses the ECDSA (Elliptic Curve Digital Signature Algorithm) with the NIST P-256 elliptic curve and SHA-256 hash. The procedures for interacting with tokens have been moved to an intermediate library, which is loaded similarly to the library for supporting PKCS#11 and is a wrapper around the library. libfido2<\/a><\/noindex>, der giver midler til kommunikation med tokens over USB (underst\u00f8tter FIDO U2F\/CTAP 1 og FIDO 2.0\/CTAP 2 protokoller). Det mellemlag, der er forberedt af udviklerne af OpenSSH, er indarbejdet i hovedbiblioteket libfido2, ligesom er<\/a><\/noindex> HID-driveren til OpenBSD.<\/a><\/noindex> For at aktivere U2F kan du bruge den seneste version af kodebasen fra<\/p>\n

OpenSSH og HEAD-grenen af biblioteket [istio-mastery]<\/a><\/noindex> , som allerede indeholder det n\u00f8dvendige lag til OpenSSH. libfido2<\/a><\/noindex>Libfido2 underst\u00f8tter drift p\u00e5 OpenBSD, Linux, macOS og Windows.
\nFor autentificering og generering af n\u00f8glen skal milj\u00f8variablen SSH_SK_PROVIDER s\u00e6ttes, hvori stien til libsk-libfido2.so angives (export SSH_SK_PROVIDER=\/path\/to\/libsk-libfido2.so), eller biblioteket kan defineres via SecurityKeyProvider-ops\u00e6tning, hvorefter \"ssh-keygen -t ecdsa-sk\" skal k\u00f8res, eller hvis n\u00f8glerne allerede er oprettet og konfigureret, skal der oprettes forbindelse til serveren ved hj\u00e6lp af \"ssh\". N\u00e5r ssh-keygen k\u00f8res, gemmes det oprettede n\u00f8glepar i \"~\/.ssh\/id_ecdsa_sk\" og kan bruges som andre n\u00f8gler. <\/p>\n

For authentication and key generation, you must set the environment variable SSH_SK_PROVIDER, specifying the path to libsk-libfido2.so (export SSH_SK_PROVIDER=\\\/path\\\/to\\\/libsk-libfido2.so), or define the library through the SecurityKeyProvider setting, after which you can run «ssh-keygen -t ecdsa-sk» or, if the keys have already been created and configured, connect to the server using «ssh». When running ssh-keygen, the created key pair will be saved in «~\\\/ .ssh\\\/id_ecdsa_sk» and can be used similarly to other keys. <\/p>\n

The public key (id_ecdsa_sk.pub) should be copied to the server in the authorized_keys file. On the server side, only the digital signature is verified, while the interaction with tokens is carried out on the client side (there is no need to install libsk-libfido2 on the server, but the server must support the «ecdsa-sk» key type). The generated private key (id_ecdsa_sk) essentially serves as a descriptor of the key, forming the real key only in combination with the secret sequence stored on the U2F token.<\/p>\n

Hvis n\u00f8glen id_ecdsa_sk falder i h\u00e6nderne p\u00e5 en angriber, kr\u00e6ver det ogs\u00e5 adgang til den hardware-token for at kunne autentificere sig, da den gemte hemmelige n\u00f8gle i filen id_ecdsa_sk er v\u00e6rdil\u00f8s uden dette. Desuden kr\u00e6ves der som standard en lokal bekr\u00e6ftelse af fysisk tilstedev\u00e6relse fra brugeren ved enhver operation med n\u00f8gler (b\u00e5de ved generering og autentificering), fx ved at blive bedt om at r\u00f8re ved sensoren p\u00e5 tokenet, hvilket g\u00f8r det sv\u00e6rere at udf\u00f8re fjernangreb p\u00e5 systemer med tilsluttet token. Som et yderligere sikkerhedsniveau kan der ved opstart af ssh-keygen ogs\u00e5 angives en kode til adgang til filen med n\u00f8glen. <\/p>\n

The U2F key can be added to the ssh-agent via «ssh-add ~\\\/ .ssh\\\/id_ecdsa_sk», but the ssh-agent must be built with support for «ecdsa-sk» keys, the libsk-libfido2 layer must be present, and the agent must run on a system to which the token connects.
\nThe new key type «ecdsa-sk» has been added because the OpenSSH ecdsa key format differs from the U2F format for ECDSA digital signatures due to the presence of additional fields.<\/p>\n

<\/a><\/noindex><\/p>\n

Kilde: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043a\u043e\u0434\u043e\u0432\u0443\u044e \u0431\u0430\u0437\u0443 OpenSSH \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0430 \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u0430\u044f \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430 \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432, \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u044e\u0449\u0438\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b U2F, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u044b\u0439 \u0430\u043b\u044c\u044f\u043d\u0441\u043e\u043c FIDO. U2F \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u0442\u044c \u043d\u0435\u0434\u043e\u0440\u043e\u0433\u0438\u0435 \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u044b\u0435 \u0442\u043e\u043a\u0435\u043d\u044b \u0434\u043b\u044f \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u044f \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435 \u0441 \u043a\u043e\u0442\u043e\u0440\u044b\u043c\u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 USB, Bluetooth \u0438\u043b\u0438 NFC. \u041f\u043e\u0434\u043e\u0431\u043d\u044b\u0435 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u043f\u0440\u043e\u0434\u0432\u0438\u0433\u0430\u044e\u0442\u0441\u044f \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0434\u043b\u044f \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043d\u0430 \u0441\u0430\u0439\u0442\u0430\u0445, \u0443\u0436\u0435 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u044e\u0442\u0441\u044f \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u043c\u0438 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430\u043c\u0438 \u0438 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u044e\u0442\u0441\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-52210","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47St\u00f8tte til universel to-faktor-godkendelse er blevet tilf\u00f8jet til OpenSSH | ProHoster","description":"Eksperimentel underst\u00f8ttelse af to-faktor-godkendelse ved brug af er blevet tilf\u00f8jet til OpenSSH's kodebase.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/v-openssh-dobavlena-podderzhka-universalnoj-dvuhfaktornoj-autentifikatsii","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 OpenSSH \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0430 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430 \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0430\u043b\u044c\u043d\u043e\u0439 \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 | ProHoster","og:description":"\u0412 \u043a\u043e\u0434\u043e\u0432\u0443\u044e \u0431\u0430\u0437\u0443 OpenSSH \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0430 \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u0430\u044f \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430 \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/v-openssh-dobavlena-podderzhka-universalnoj-dvuhfaktornoj-autentifikatsii","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-02T21:00:00+00:00","article:modified_time":"2020-02-18T10:59:53+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"52210","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 02:52:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:47:23","updated":"2026-01-24 02:52:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/52210","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=52210"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/52210\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=52210"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=52210"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=52210"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}