{"id":101355,"date":"2021-09-21T16:22:37","date_gmt":"2021-09-21T14:22:38","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/google-opublikoval-hiba-nadstrojku-nad-openssh-dlya-avtorizaczii-na-osnove-sertifikatov"},"modified":"2021-09-21T16:22:37","modified_gmt":"2021-09-21T14:22:38","slug":"google-opublikoval-hiba-nadstrojku-nad-openssh-dlya-avtorizaczii-na-osnove-sertifikatov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/google-opublikoval-hiba-nadstrojku-nad-openssh-dlya-avtorizaczii-na-osnove-sertifikatov","title":{"rendered":"Google avaldas HIBA, lisandmooduli OpenSSH jaoks, mis v\u00f5imaldab autentimist sertifikaatide alusel.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Google avaldas HIBA (Host Identity Based Authorization) projekti allikakoode, mis pakub t\u00e4iendava autoriseerimise mehhanismi rakendust SSH-i kaudu ligip\u00e4\u00e4su korraldamiseks, sidudes selle hostidega (kontrollid, kas juurdep\u00e4\u00e4s konkreetsele ressurssile on lubatud v\u00f5i mitte avatud v\u00f5tmete autentimise korral). Integreerimine OpenSSH-ga on tagatud, m\u00e4\u00e4rates HIBA t\u00f6\u00f6tleja direktiivis AuthorizedPrincipalsCommand faili \/etc\/ssh\/sshd_config. Projekti kood on kirjutatud C keeles ja levitatakse BSD litsentsi alusel. <\/p>\n

HIBA kasutab OpenSSH sertifikaatide p\u00f5hinevaid autentimismehhanisme, et pakkuda paindlikku ja keskset kasutajate autoriseerimise haldamist hostide seondumise kontekstis, kuid ei n\u00f5ua samas auth_keys ja authorized_users failide perioodilist muutmist hostide k\u00fcljest, millega \u00fchendust luuakse. Selle asemel, et hoida lubatud avalike v\u00f5tmete ja juurdep\u00e4\u00e4su tingimuste nimekirja authorized_(keys|users) failides, integreerib HIBA teabe kasutajate seondumisest hostidega otse sertifikaatidesse. Eelk\u00f5ige on pakutud laiendusi hostide ja kasutajate sertifikaatide jaoks, milles hoitakse hostide parameetreid ja kasutajate juurdep\u00e4\u00e4su tingimusi. <\/p>\n

Kontroll hosti k\u00fcljest algatatakse hiba-chk k\u00e4su kaudu, mis on m\u00e4\u00e4ratud AuthorizedPrincipalsCommand direktiivis. See k\u00e4sk dekodeerib sertifikaatidesse integreeritud laiendused ja nende p\u00f5hjal otsustab juurdep\u00e4\u00e4su andmise v\u00f5i blokeerimise. Juurdep\u00e4\u00e4sureeglid m\u00e4\u00e4ratakse keskelt v\u00e4ljaandva asutuse (CA) tasemel ja integreeritakse sertifikaatides nende genereerimise etapis. <\/p>\n

Usaldusv\u00e4\u00e4rsuse keskuse poolel hoitakse \u00fcldloendit saadavalolevatest volitustest (serveritest, millele on lubatud \u00fchendus) ja loetelu kasutajatest, kellele on antud \u00f5igus neid volitusi kasutada. Sertifitseeritud sertifikaatide genereerimiseks, mis sisaldavad integreeritud teavet volituste kohta, on pakutud utiliiti hiba-gen, samas on usaldusv\u00e4\u00e4rse keskuse loomise jaoks vajalikud funktsioonid viidud skripti iba-ca.sh. <\/p>\n

Kasutaja \u00fchendamise ajal kinnitatakse sertifikaadis m\u00e4rgitud volitused usaldusv\u00e4\u00e4rse keskuse digitaalallkirjaga, mis v\u00f5imaldab teha k\u00f5iki kontrollimisi tervikuna sihtserveri poolel, kuhu \u00fchendus toimub, ilma v\u00e4listesse teenustesse p\u00f6\u00f6rdumata. Usaldusv\u00e4\u00e4rse keskuse avalike v\u00f5tmete loetelu, mis kinnitab SSH-sertifikaate, m\u00e4rgitakse direktiiviga TrustedUserCAKeys. <\/p>\n

Lisaks kasutajate otsese sidumisega hostidega v\u00f5imaldab HIBA m\u00e4\u00e4rata paindlikumaid juurdep\u00e4\u00e4sureegleid. N\u00e4iteks saab hostide jaoks siduda teavet, nagu asukoht ja teenuse t\u00fc\u00fcp, ning kasutajate juurdep\u00e4\u00e4sureeglite m\u00e4\u00e4ramisel lubada \u00fchendust k\u00f5igile hostidele, millel on m\u00e4\u00e4ratud teenuse t\u00fc\u00fcp v\u00f5i hostidele, mis asuvad m\u00e4\u00e4ratud kohas.

\"Google<\/center>
\"Google<\/center>
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0435 \u0442\u0435\u043a\u0441\u0442\u044b \u043f\u0440\u043e\u0435\u043a\u0442\u0430 HIBA (Host Identity Based Authorization), \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u044e\u0449\u0435\u0433\u043e \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044e \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043f\u043e SSH \u0432 \u043f\u0440\u0438\u0432\u044f\u0437\u043a\u0435 \u043a \u0445\u043e\u0441\u0442\u0430\u043c (\u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438, \u0440\u0430\u0437\u0440\u0435\u0448\u0451\u043d \u0438\u043b\u0438 \u043d\u0435\u0442 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u043c\u0443 \u0440\u0435\u0441\u0443\u0440\u0441\u0443 \u043f\u0440\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u043e \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c \u043a\u043b\u044e\u0447\u0430\u043c). \u0418\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u044f \u0441 OpenSSH \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 \u0443\u043a\u0430\u0437\u0430\u043d\u0438\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430 HIBA \u0432 \u0434\u0438\u0440\u0435\u043a\u0442\u0438\u0432\u0435 AuthorizedPrincipalsCommand \u0432 \/etc\/ssh\/sshd_config. \u041a\u043e\u0434 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u043d\u0430\u043f\u0438\u0441\u0430\u043d […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":101356,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101355","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Google avaldas HIBA, OpenSSH laienduse sertifikaatide p\u00f5hise autoriseerimise jaoks | ProHoster","description":"Google avaldas HIBA (Host Identity Based Authorization) projekti algkoodid, mis pakuvad t\u00e4iendava autoriseerimise mehhanismi, et korraldada kasutajate SSH juurdep\u00e4\u00e4su hostide sidumisega (kontrollida, kas juurdep\u00e4\u00e4s konkreetsele ressursile on lubatud v\u00f5i mitte, autentimise k\u00e4igus avatud v\u00f5tmete kaudu). Integreerimine OpenSSH-ga toimub HIBA t\u00f6\u00f6tleja m\u00e4\u00e4ramise kaudu direktiivis AuthorizedPrincipalsCommand failis \/etc\/ssh\/sshd_config. Projekti kood on kirjutatud","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/google-opublikoval-hiba-nadstrojku-nad-openssh-dlya-avtorizaczii-na-osnove-sertifikatov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Google \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b HIBA, \u043d\u0430\u0434\u0441\u0442\u0440\u043e\u0439\u043a\u0443 \u043d\u0430\u0434 OpenSSH \u0434\u043b\u044f \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0435 \u0442\u0435\u043a\u0441\u0442\u044b \u043f\u0440\u043e\u0435\u043a\u0442\u0430 HIBA (Host Identity Based Authorization), \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u044e\u0449\u0435\u0433\u043e \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044e \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043f\u043e SSH \u0432 \u043f\u0440\u0438\u0432\u044f\u0437\u043a\u0435 \u043a \u0445\u043e\u0441\u0442\u0430\u043c (\u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438, \u0440\u0430\u0437\u0440\u0435\u0448\u0451\u043d \u0438\u043b\u0438 \u043d\u0435\u0442 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u043c\u0443 \u0440\u0435\u0441\u0443\u0440\u0441\u0443 \u043f\u0440\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u043e \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c \u043a\u043b\u044e\u0447\u0430\u043c). \u0418\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u044f \u0441 OpenSSH \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 \u0443\u043a\u0430\u0437\u0430\u043d\u0438\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430 HIBA \u0432 \u0434\u0438\u0440\u0435\u043a\u0442\u0438\u0432\u0435 AuthorizedPrincipalsCommand \u0432 \/etc\/ssh\/sshd_config. \u041a\u043e\u0434 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u043d\u0430\u043f\u0438\u0441\u0430\u043d","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/google-opublikoval-hiba-nadstrojku-nad-openssh-dlya-avtorizaczii-na-osnove-sertifikatov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-09-21T14:22:38+00:00","article:modified_time":"2021-09-21T14:22:38+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101355","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-09-21 14:52:03","updated":"2022-10-02 02:36:14"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/101355","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=101355"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/101355\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/101356"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=101355"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=101355"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=101355"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}