{"id":101168,"date":"2021-09-02T10:23:16","date_gmt":"2021-09-02T08:23:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/github-vvodit-novye-trebovaniya-dlya-udalyonnogo-podklyucheniya-k-git"},"modified":"2021-09-02T10:23:16","modified_gmt":"2021-09-02T08:23:16","slug":"github-vvodit-novye-trebovaniya-dlya-udalyonnogo-podklyucheniya-k-git","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/github-vvodit-novye-trebovaniya-dlya-udalyonnogo-podklyucheniya-k-git","title":{"rendered":"GitHub introduces new requirements for remote connections to Git","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
GitHub has announced changes aimed at enhancing the security of the Git protocol used in executing git push and git pull operations via SSH or the 'git:\/\/' scheme (access via https:\/\/ will not be affected). After the changes come into effect, a minimum of OpenSSH version 7.2 (released in 2016) or PuTTY version 0.75 (released this May) will be required for SSH connections to GitHub. For instance, compatibility will be disrupted with the SSH client included in CentOS 6 and Ubuntu 14.04, which have already reached their end of life. <\/p>\n
The changes involve discontinuing support for unencrypted connections to Git (via 'git:\/\/') and increasing the requirements for SSH keys used to access GitHub. GitHub will cease support for all DSA keys and outdated SSH algorithms, such as CBC ciphers (aes256-cbc, aes192-cbc, aes128-cbc) and HMAC-SHA-1. Additionally, new RSA keys will face stricter requirements (the use of SHA-1 will be prohibited), and support for ECDSA and Ed25519 host keys will be implemented. <\/p>\n
The changes will be implemented gradually. On September 14, new ECDSA and Ed25519 host keys will be generated. On November 2, support for new RSA keys based on SHA-1 will be discontinued (previously generated keys will continue to work). On November 16, support for host keys based on the DSA algorithm will end. On January 11, 2022, support for old SSH algorithms and the ability to connect unencrypted will be temporarily suspended as an experiment. On March 15, support for old algorithms will be permanently disabled. <\/p>\n
Additionally, it is worth noting that a change has been made in the OpenSSH codebase to disable the processing of RSA keys based on the SHA-1 hash ('ssh-rsa') by default. Support for RSA keys with SHA-256 and SHA-512 hashes (rsa-sha2-256\/512) remains unchanged. The discontinuation of 'ssh-rsa' key support is due to the increased effectiveness of collision attacks with a specified prefix (the cost of finding a collision is estimated to be around $50,000). To check for the use of ssh-rsa in your systems, you can try connecting via ssh with the option '-oHostKeyAlgorithms=-ssh-rsa'. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"