{"id":101430,"date":"2021-09-26T22:22:36","date_gmt":"2021-09-26T20:22:36","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/reliz-openssh-8-8-s-otklyucheniem-podderzhki-czifrovyh-podpisej-rsa-sha"},"modified":"2021-09-26T22:22:36","modified_gmt":"2021-09-26T20:22:36","slug":"reliz-openssh-8-8-s-otklyucheniem-podderzhki-czifrovyh-podpisej-rsa-sha","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/reliz-openssh-8-8-s-otklyucheniem-podderzhki-czifrovyh-podpisej-rsa-sha","title":{"rendered":"OpenSSH 8.8 vabastamine, kus on eemaldatud rsa-sha digitaalsete allkirjade tugi","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Avaldatud on OpenSSH 8.8 versioon, avatud rakenduse klient ja server, millega saab t\u00f6\u00f6tada SSH 2.0 ja SFTP protokollidega. V\u00e4ljalaskmine on m\u00e4rkimisv\u00e4\u00e4rne, kuna vaikimisi on keelatud RSA-avalike v\u00f5tmete digitaalsete allkirjade kasutamine SHA-1 r\u00e4simisega («ssh-rsa»). <\/p>\n

«ssh-rsa» allkirjade toetuse l\u00f5petamine on tingitud m\u00e4\u00e4ratud eellaadimisega kokkup\u00f5rke r\u00fcnnakute efektiivsuse suurendamisest (kokkup\u00f5rke leidmise maksumuseks hinnatakse umbes 50 tuhat dollarit). RSA allkirjade kontrollimiseks SHA-256 ja SHA-512 abil (rsa-sha2-256\/512), mis on toetatud OpenSSH 7.2 versioonist alates, on muutmine j\u00e4\u00e4nud samaks. <\/p>\n

Enamasti ei n\u00f5ua «ssh-rsa» toetuse l\u00f5petamine kasutajatelt k\u00e4sitsi sekkumist, kuna OpenSSH-s oli varem vaikimisi lubatud seade UpdateHostKeys, mis automaatselt suunab kliente usaldusv\u00e4\u00e4rsemate algoritmide kasutamisele. Migratsiooniks kasutatakse protokolli laiendust «hostkeys@openssh.com», mis v\u00f5imaldab serverile<\/a> autentimise l\u00e4bimisel teavitada klienti k\u00f5igist saadaval olevatest hosti v\u00f5tmetest. Kui \u00fchendatakse v\u00e4ga vana OpenSSH versiooni omava hostiga, saab «ssh-rsa» allkirjade kasutamise valikuliselt taastada, lisades ~\/.ssh\/config faili: Host vana_hosti_nimi HostkeyAlgorithms +ssh-rsa \tPubkeyAcceptedAlgorithms +ssh-rsa <\/p>\n

Uues versioonis on k\u00f5rvaldatud ka turvaprobleem, mis tekkis sshd-s, alates OpenSSH 6.2 v\u00e4ljaandmisest, kasutaja grupi vale initsialiseerimise t\u00f5ttu k\u00e4ideldes k\u00e4ske, mis on m\u00e4\u00e4ratud AuthorizedKeysCommand ja AuthorizedPrincipalsCommand direktiivides. Need direktiivid peaksid tagama k\u00e4skude k\u00e4ivitamise teise kasutajana, kuid tegelikult p\u00e4risid need sshd k\u00e4ivitamisel kasutatavad grupid. Selline k\u00e4itumine, teatud s\u00fcsteemsete seadistustega, v\u00f5imaldas k\u00e4ivitatud t\u00f6\u00f6tlejal saada s\u00fcsteemis t\u00e4iendavaid privileege. <\/p>\n

Uues v\u00e4ljaandes on ka avaldatud hoiatust, et vaikimisi kavatsetakse utiliit scp \u00fcle viia SFTP kasutamisele vana SCP\/RCP protokolli asemel. SFTP kasutab ennustatavaid meetodeid nimede t\u00f6\u00f6tlemiseks ja ei kasuta glob-mustrite t\u00f6\u00f6tlemist failinimedes shelli kaudu teisel hostil, mis tekitab turvaprobleeme. Eelk\u00f5ige SCP ja RCP kasutamisel server<\/a> otsustab, milliseid faile ja kaustu kliendile saata, ning klient kontrollib ainult tagastatud objektide nimede \u00f5igsust, mis v\u00f5imaldab serveril saata teisi faile, mis erinevad p\u00e4ringutest, juhul kui kliendi poolel ei ole n\u00f5utud kontrolli. SFTP protokoll on neid probleeme puuduv, kuid ei toeta eriliste tee s\u00f5lmede avamist, n\u00e4iteks «~\/». Selle erinevuse k\u00f5rvaldamiseks pakkus OpenSSH eelnevas v\u00e4ljaandes SFTP-serveri rakenduses v\u00e4lja uue protokolli laienduse, mis v\u00f5imaldab avada teid ~\/ ja ~user\/.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 OpenSSH 8.8, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430\u043c SSH 2.0 \u0438 SFTP. \u0412\u044b\u043f\u0443\u0441\u043a \u043f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u0435\u043d \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435\u043c \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0446\u0438\u0444\u0440\u043e\u0432\u044b\u0445 \u043f\u043e\u0434\u043f\u0438\u0441\u0435\u0439 \u043d\u0430 \u0431\u0430\u0437\u0435 RSA-\u043a\u043b\u044e\u0447\u0435\u0439 \u0441 \u0445\u044d\u0448\u0435\u043c SHA-1 («ssh-rsa»). \u041f\u0440\u0435\u043a\u0440\u0430\u0449\u0435\u043d\u0438\u0435 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u043f\u043e\u0434\u043f\u0438\u0441\u0435\u0439 «ssh-rsa» \u043e\u0431\u0443\u0441\u043b\u043e\u0432\u043b\u0435\u043d\u043e \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435\u043c \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u043a\u043e\u043b\u043b\u0438\u0437\u0438\u043e\u043d\u043d\u044b\u0445 \u0430\u0442\u0430\u043a \u0441 \u0437\u0430\u0434\u0430\u043d\u043d\u044b\u043c \u043f\u0440\u0435\u0444\u0438\u043a\u0441\u043e\u043c (\u0441\u0442\u043e\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0434\u0431\u043e\u0440\u0430 \u043a\u043e\u043b\u043b\u0438\u0437\u0438\u0438 \u043e\u0446\u0435\u043d\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e \u0432 50 \u0442\u044b\u0441\u044f\u0447 \u0434\u043e\u043b\u043b\u0430\u0440\u043e\u0432). \u0414\u043b\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101430","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47OpenSSH 8.8 versioon, kus on keelatud rsa-sha digitaalsete allkirjade tugi | ProHoster","description":"Avatud OpenSSH 8.8 versioon, avatud kliendi ja serveri teostus t\u00f6\u00f6ks SSH 2.0 ja SFTP protokollide kaudu, on v\u00e4lja antud.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/reliz-openssh-8-8-s-otklyucheniem-podderzhki-czifrovyh-podpisej-rsa-sha","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 OpenSSH 8.8 \u0441 \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435\u043c \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u0446\u0438\u0444\u0440\u043e\u0432\u044b\u0445 \u043f\u043e\u0434\u043f\u0438\u0441\u0435\u0439 rsa-sha | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 OpenSSH 8.8, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430\u043c SSH 2.0 \u0438 SFTP.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/reliz-openssh-8-8-s-otklyucheniem-podderzhki-czifrovyh-podpisej-rsa-sha","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-09-26T20:22:36+00:00","article:modified_time":"2021-09-26T20:22:36+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101430","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-09-26 20:28:50","updated":"2026-02-09 21:42:00","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/101430","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=101430"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/101430\/revisions"}],"predecessor-version":[{"id":172943,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/101430\/revisions\/172943"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=101430"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=101430"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=101430"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}