{"id":83061,"date":"2020-05-28T01:42:22","date_gmt":"2020-05-27T23:42:22","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/reliz-openssh-8-3-s-ustraneniem-uyazvimosti-v-scp"},"modified":"2020-05-28T01:42:22","modified_gmt":"2020-05-27T23:42:22","slug":"reliz-openssh-8-3-s-ustraneniem-uyazvimosti-v-scp","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/reliz-openssh-8-3-s-ustraneniem-uyazvimosti-v-scp","title":{"rendered":"Udgivelsen af OpenSSH 8.3 med en fejlrettelse i scp","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Efter tre m\u00e5neders udvikling <noindex><a rel=\"nofollow\" href=\"https:\/\/lists.mindrot.org\/pipermail\/openssh-unix-dev\/2020-May\/038528.html\">pr\u00e6senteret<\/a><\/noindex> udgivelse <noindex><a rel=\"nofollow\" href=\"https:\/\/www.openssh.com\/\">OpenSSH 8.3<\/a><\/noindex>, en open source-implementering af klient og server til arbejde med SSH 2.0- og SFTP-protokoller. <\/p>\n<p>Den nye version tilf\u00f8jer beskyttelse mod et angreb p\u00e5 scp, der giver serveren mulighed for at overf\u00f8re andre filnavne, som adskiller sig fra de anmodede (i mods\u00e6tning til <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=49953\">den tidligere s\u00e5rbarhed<\/a><\/noindex>, angrebet giver ikke mulighed for at \u00e6ndre den valgte brugerkatalog eller glob-maske). Lad os minde om, at i SCP beslutter serveren, hvilke filer og mapper der skal sendes til klienten, mens klienten blot kontrollerer gyldigheden af de returnerede objektnavne. Problemet ligger i det faktum, at hvis systemopkaldet utimes fejler, s\u00e5 fortolkes indholdet af filen som filens metadata. <\/p>\n<p>Denne funktion ved forbindelse til en server, der er under kontrol af en angriber, kan bruges til at gemme andre filnavne og indhold i brugerens filsystem, n\u00e5r der kopieres med scp under konfigurationer, der f\u00f8rer til fejl ved kald af utimes (f.eks. ved forbud mod utimes fra SELinux-politik eller systemkaldsfiltre). Sandsynligheden for at gennemf\u00f8re reelle angreb vurderes som minimal, da kaldet af utimes i typiske konfigurationer ikke fejler. Desuden g\u00e5r angrebet ikke ubem\u00e6rket hen \u2014 n\u00e5r scp kaldes, vises der en fejlmeddelelse om overf\u00f8rsel af data.<\/p>\n<p>Generelle \u00e6ndringer:<\/p>\n<ul>\n<li class=\"l\"> I sftp er behandlingen af argumentet \u00ab-1\u00bb stoppet, ligesom i ssh og scp, som tidligere blev accepteret, men ignoreret;\n<li class=\"l\"> I sshd, n\u00e5r der bruges IgnoreRhosts, er der nu tre valgmuligheder: \u00abyes\u00bb \u2014 ignorere rhosts\/shosts, \u00abno\u00bb \u2014 tage hensyn til rhosts\/shosts og \u00abshosts-only\u00bb \u2014 tillade \u00ab.shosts\u00bb, men forbyde \u00ab.rhosts\u00bb;\n<li class=\"l\"> I ssh sikres h\u00e5ndtering af substitutionen %TOKEN i indstillingerne LocalForward og RemoteForward, der anvendes til omdirigering af Unix-sokler;\n<li class=\"l\"> Tilladt at indl\u00e6se \u00e5bne n\u00f8gler fra en ukrypteret fil med privatn\u00f8glen, hvis der ikke er en separat fil med den \u00e5bne n\u00f8gle;\n<li class=\"l\"> Hvis systemet har libcrypto, bruger ssh og sshd nu implementeringen af algoritmen chacha20 fra dette bibliotek i stedet for den indbyggede b\u00e6rbare implementering, som halter bagud i ydeevne;\n<li class=\"l\"> Der er implementeret mulighed for dump af indholdet fra den bin\u00e6re liste over tilbagekaldte certifikater ved udf\u00f8relse af kommandoen \u00abssh-keygen -lQf \/path\u00bb;\n<li class=\"l\"> I den b\u00e6rbare version er der implementeret identifikation af systemer, hvor signaler med SA_RESTART-optionen afbryder arbejdet med select;\n<li class=\"l\"> Problemerne med at bygge i HP\/UX og AIX-systemer er l\u00f8st;\n<li class=\"l\"> Problemerne med at bygge seccomp-sandbox i nogle Linux-konfigurationer er l\u00f8st;\n<li class=\"l\"> Forbedret detektion af biblioteket libfido2 og l\u00f8st problemer med kompilering med indstillingen \u00ab--with-security-key-builtin\u00bb.\n<\/ul>\n<p>Udviklerne af OpenSSH har endnu en gang advaret om den kommende overgang af algoritmer, der bruger SHA-1 hash, til status som for\u00e6ldede; <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=52149\">for\u00f8gelsen<\/a><\/noindex> effektiviteten af kollisionsangreb med et givet pr\u00e6fiks (omkostningerne ved at finde en kollision estimeres til cirka 45.000 dollars). I en af de kommende udgaver planl\u00e6gges det at deaktivere muligheden for at bruge algoritmen til digitale signaturer baseret p\u00e5 offentlige n\u00f8gler &#171;ssh-rsa&#187; som standard, hvilket n\u00e6vnes i den originale RFC for SSH-protokollen og stadig er meget udbredt i praksis (for at tjekke brugen af ssh-rsa i dine systemer kan du pr\u00f8ve at oprette forbindelse via ssh med indstillingen &#171;-oHostKeyAlgorithms=-ssh-rsa&#187;).<\/p>\n<p>For at lette overgangen til de nye algoritmer i OpenSSH vil der i en af de kommende udgaver blive inkluderet indstillingen UpdateHostKeys som standard, der automatisk vil overf\u00f8re klienter til mere p\u00e5lidelige algoritmer. Blandt de anbefalede algoritmer til migration n\u00e6vnes rsa-sha2-256\/512 baseret p\u00e5 RFC8332 RSA SHA-2 (underst\u00f8ttet siden OpenSSH 7.2 og bruges som standard), ssh-ed25519 (underst\u00f8ttet siden OpenSSH 6.5) og ecdsa-sha2-nistp256\/384\/521 baseret p\u00e5 RFC5656 ECDSA (underst\u00f8ttet siden OpenSSH 5.7). <\/p>\n<p>Fra den seneste udgivelse er \u00abssh-rsa\u00bb og \u00abdiffie-hellman-group14-sha1\u00bb fjernet fra listen over CASignatureAlgorithms, der definerer de algoritmer, der er acceptable til digitale signaturer af nye certifikater, da brugen af SHA-1 i certifikater er forbundet med en ekstra risiko, fordi en angriber har ubegribelig tid til at finde sammenfald for et eksisterende certifikat, mens tiden til angreb p\u00e5 v\u00e6rtsn\u00f8gler er begr\u00e6nset af forbindelsestidsgr\u00e6nsen (LoginGraceTime). <\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Kilde: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=53039\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u043e\u0441\u043b\u0435 \u0442\u0440\u0451\u0445 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 OpenSSH 8.3, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430\u043c SSH 2.0 \u0438 SFTP. \u0412 \u043d\u043e\u0432\u043e\u043c \u0432\u044b\u043f\u0443\u0441\u043a\u0435 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0430 \u0437\u0430\u0449\u0438\u0442\u0430 \u043e\u0442 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 scp, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0441\u0435\u0440\u0432\u0435\u0440\u0443 \u043f\u0435\u0440\u0435\u0434\u0430\u0442\u044c \u0434\u0440\u0443\u0433\u0438\u0435 \u0438\u043c\u0435\u043d\u0430 \u0444\u0430\u0439\u043b\u043e\u0432, \u043e\u0442\u043b\u0438\u0447\u0430\u044e\u0449\u0438\u0435\u0441\u044f \u043e\u0442 \u0437\u0430\u043f\u0440\u043e\u0448\u0435\u043d\u043d\u044b\u0445 (\u0432 \u043e\u0442\u043b\u0438\u0447\u0438\u0435 \u043e\u0442 \u043f\u0440\u043e\u0448\u043b\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0430\u0442\u0430\u043a\u0430 \u043d\u0435 \u0434\u0430\u0451\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0441\u043c\u0435\u043d\u0438\u0442\u044c \u0432\u044b\u0431\u0440\u0430\u043d\u043d\u044b\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u043a\u0430\u0442\u0430\u043b\u043e\u0433 \u0438\u043b\u0438 glob-\u043c\u0430\u0441\u043a\u0443). \u041d\u0430\u043f\u043e\u043c\u043d\u0438\u043c, [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-83061","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u043e\u0441\u043b\u0435 \u0442\u0440\u0451\u0445 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/da\/blog\/news\/reliz-openssh-8-3-s-ustraneniem-uyazvimosti-v-scp\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"da_DK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 OpenSSH 8.3 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 scp | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u043e\u0441\u043b\u0435 \u0442\u0440\u0451\u0445 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/da\/blog\/news\/reliz-openssh-8-3-s-ustraneniem-uyazvimosti-v-scp\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-05-27T23:42:22+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-05-27T23:42:22+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Udgivelse af OpenSSH 8.3 med l\u00f8sning af s\u00e5rbarhed i scp | ProHoster","description":"Efter tre m\u00e5neders udvikling pr\u00e6senteres udgivelsen","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/reliz-openssh-8-3-s-ustraneniem-uyazvimosti-v-scp","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 OpenSSH 8.3 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 scp | ProHoster","og:description":"\u041f\u043e\u0441\u043b\u0435 \u0442\u0440\u0451\u0445 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/reliz-openssh-8-3-s-ustraneniem-uyazvimosti-v-scp","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-27T23:42:22+00:00","article:modified_time":"2020-05-27T23:42:22+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"83061","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 15:25:24","updated":"2022-10-02 17:17:29","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/83061","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=83061"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/83061\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=83061"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=83061"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=83061"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}