{"id":101430,"date":"2021-09-26T22:22:36","date_gmt":"2021-09-26T20:22:36","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/reliz-openssh-8-8-s-otklyucheniem-podderzhki-czifrovyh-podpisej-rsa-sha"},"modified":"2021-09-26T22:22:36","modified_gmt":"2021-09-26T20:22:36","slug":"reliz-openssh-8-8-s-otklyucheniem-podderzhki-czifrovyh-podpisej-rsa-sha","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/reliz-openssh-8-8-s-otklyucheniem-podderzhki-czifrovyh-podpisej-rsa-sha","title":{"rendered":"OpenSSH 8.8 v\u00e4ljaanne, milles on v\u00e4lja l\u00fclitatud rsa-sha digitaalsete allkirjade tugi.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Avaldatud on OpenSSH 8.8, avatud rakenduse ja serveri versioon SSH 2.0 ja SFTP protokollide jaoks. V\u00e4ljalase on t\u00e4helepanuv\u00e4\u00e4rne, kuna vaikimisi on keelatud digitaalsete allkirjade kasutamine RSA v\u00f5tmete p\u00f5hjal, millel on SHA-1 r\u00e4siv\u00e4\u00e4rtus («ssh-rsa»). <\/p>\n

RSA allkirjade «ssh-rsa» toetuse l\u00f5petamine tuleneb fikseeritud eeltingimusega kokkulangemiste r\u00fcnnakute efektiivsuse suurenemisest (kokkulangemise leidmise maksumus on hinnanguliselt umbes 50 tuhat dollarit). RSA allkirjade toetamiseks SHA-256 ja SHA-512 r\u00e4siv\u00e4\u00e4rtustega (rsa-sha2-256\/512), mis on toetatud alates OpenSSH 7.2, on j\u00e4\u00e4dud muutumatuks. <\/p>\n

Enamikul juhtudel ei n\u00f5ua «ssh-rsa» toe l\u00f5petamine kasutajatelt mingite k\u00e4sitsi tehtud toimingute sooritamist, kuna OpenSSH'is oli varem vaikimisi aktiveeritud seadistus UpdateHostKeys, mis automaatselt suunab kliendid usaldusv\u00e4\u00e4rsematele algoritmidele. Migratsioonil kasutatakse protokolli laiendust «hostkeys@openssh.com», mis v\u00f5imaldab serveri<\/a> autentimise l\u00e4bimise j\u00e4rel teavitada klienti k\u00f5igist saadaval olevatest hosti v\u00f5tmetest. Kui \u00fchendus luuakse hostidega, millel on kliendi poolel v\u00e4ga vanad OpenSSH versioonid, saab RSA allkirjade «ssh-rsa» kasutamise tagasi tuua, lisades ~\/.ssh\/config faili: Host vana_hosti_nimi HostkeyAlgorithms +ssh-rsa \tPubkeyAcceptedAlgorithms +ssh-rsa <\/p>\n

Uues versioonis on samuti lahendatud turvaprobleem, mis tekkis sshd-s, alates OpenSSH 6.2 v\u00e4ljaandmisest, kui kasutajagruppide algseadistamine oli vigane autoriseeritud k\u00e4skude ja autoriseeritud p\u00f5him\u00f5tete t\u00e4itmisel. Need direktiivid peaksid tagama k\u00e4skude k\u00e4ivitamise teise kasutaja alt, kuid tegelikult p\u00e4risid nad sshd k\u00e4ivitamisel kasutatavad r\u00fchmad. Selline k\u00e4itumine v\u00f5imaldas teatud s\u00fcsteemi seadistuste korral aktiivsel t\u00f6\u00f6tlijal saada t\u00e4iendavaid privileege s\u00fcsteemis. <\/p>\n

Uue v\u00e4ljaande m\u00e4rkmes on samuti avaldatud hoiatus selle kohta, et plaanitakse vaikimisi muuta scp utiliit SFTP kasutamiseks, asendades vananenud protokolli SCP\/RCP. SFTP-s rakendatakse enam ennustatavaid meetodeid nimede t\u00f6\u00f6tlemiseks ning ei kasutata glob-mallide t\u00f6\u00f6tlemist failinimedes teisel hostil, mis p\u00f5hjustab turvaprobleeme. Eelk\u00f5ige SCP ja RCP puhul server<\/a> otsustab, millised failid ja kataloogid klienti edastada, samas kui klient kontrollib vaid tagastatud objektide nimede \u00f5igsust, mis klienti piisava kontrolli puudumisel v\u00f5ivad serveril edastada teisi failinimesid, mis erinevad n\u00f5utud failidest. SFTP protokoll puudub sellistest probleemidest, kuid ei toeta spetsiaalsete teede, nagu «~\/$», paljastamist. Selle erinevuse k\u00f5rvaldamiseks soovitati OpenSSH viimases v\u00e4ljaandes SFTP serveri rakenduses uut SFTP protokolli laiendust teede paljastamiseks ~\/$ ja ~user\/.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 OpenSSH 8.8, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430\u043c SSH 2.0 \u0438 SFTP. \u0412\u044b\u043f\u0443\u0441\u043a \u043f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u0435\u043d \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435\u043c \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0446\u0438\u0444\u0440\u043e\u0432\u044b\u0445 \u043f\u043e\u0434\u043f\u0438\u0441\u0435\u0439 \u043d\u0430 \u0431\u0430\u0437\u0435 RSA-\u043a\u043b\u044e\u0447\u0435\u0439 \u0441 \u0445\u044d\u0448\u0435\u043c SHA-1 («ssh-rsa»). \u041f\u0440\u0435\u043a\u0440\u0430\u0449\u0435\u043d\u0438\u0435 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u043f\u043e\u0434\u043f\u0438\u0441\u0435\u0439 «ssh-rsa» \u043e\u0431\u0443\u0441\u043b\u043e\u0432\u043b\u0435\u043d\u043e \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435\u043c \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u043a\u043e\u043b\u043b\u0438\u0437\u0438\u043e\u043d\u043d\u044b\u0445 \u0430\u0442\u0430\u043a \u0441 \u0437\u0430\u0434\u0430\u043d\u043d\u044b\u043c \u043f\u0440\u0435\u0444\u0438\u043a\u0441\u043e\u043c (\u0441\u0442\u043e\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0434\u0431\u043e\u0440\u0430 \u043a\u043e\u043b\u043b\u0438\u0437\u0438\u0438 \u043e\u0446\u0435\u043d\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e \u0432 50 \u0442\u044b\u0441\u044f\u0447 \u0434\u043e\u043b\u043b\u0430\u0440\u043e\u0432). \u0414\u043b\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101430","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47OpenSSH 8.8 v\u00e4ljaanne koos digitaalse allkirja rsa-sha toe v\u00e4ljal\u00fclitamisega | ProHoster","description":"Avaldatud on OpenSSH 8.8, avatud rakenduse klient ja server, mis t\u00f6\u00f6tab protokollide SSH 2.0 ja SFTP kaudu.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/reliz-openssh-8-8-s-otklyucheniem-podderzhki-czifrovyh-podpisej-rsa-sha","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 OpenSSH 8.8 \u0441 \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435\u043c \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u0446\u0438\u0444\u0440\u043e\u0432\u044b\u0445 \u043f\u043e\u0434\u043f\u0438\u0441\u0435\u0439 rsa-sha | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 OpenSSH 8.8, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430\u043c SSH 2.0 \u0438 SFTP.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/reliz-openssh-8-8-s-otklyucheniem-podderzhki-czifrovyh-podpisej-rsa-sha","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-09-26T20:22:36+00:00","article:modified_time":"2021-09-26T20:22:36+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101430","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-09-26 20:28:50","updated":"2026-02-09 21:42:00","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/101430","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=101430"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/101430\/revisions"}],"predecessor-version":[{"id":172943,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/101430\/revisions\/172943"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=101430"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=101430"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=101430"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}