{"id":123013,"date":"2025-03-26T16:22:56","date_gmt":"2025-03-26T14:22:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/kompaniya-cloudflare-opublikovala-opkssh-dlya-autentifikaczii-v-ssh-cherez-openid-connect"},"modified":"2025-03-26T16:22:56","modified_gmt":"2025-03-26T14:22:58","slug":"kompaniya-cloudflare-opublikovala-opkssh-dlya-autentifikaczii-v-ssh-cherez-openid-connect","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/kompaniya-cloudflare-opublikovala-opkssh-dlya-autentifikaczii-v-ssh-cherez-openid-connect","title":{"rendered":"Cloudflare on avaldanud opkssh, et autentida SSH kaudu OpenID Connecti","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Cloudflare tutvustas t\u00f6\u00f6riista opkssh (OpenPubkey SSH), mis v\u00f5imaldab integreerida OpenSSH-sse kesksed autentimisvahendid OpenID Connecti pakkujatega. Opkssh kasutamine vabastab teid SSH v\u00f5tmete haldamise ja seadistamise k\u00e4sit\u00f6\u00f6st ning v\u00f5imaldab \u00fchenduda serveriga mistahes hostidest, ilma et oleks vaja igas kliendi arvutis luua sulgevaid v\u00f5tmeid v\u00f5i k\u00e4sitsi kopeerida avatud v\u00f5tmeid serverisse. \u00dchendumiseks piisab, kui seote oma konto OpenID pakkujas serveris. T\u00f6\u00f6riista kood on kirjutatud Go keeles ning levitatakse Apache 2.0 litsentsi alusel. <\/p>\n

Opkssh on \u00fchilduv OpenID pakkujatega Google, Microsoft\/Azure ja Gitlab, v\u00f5imaldades sisse logimist olemasolevate gmail.com, microsoft.com ja gitlab.com teenuste kontode kaudu. Kasutades opkssh'd, genereeritakse ajutised v\u00f5tmed, mis kehtivad vaid m\u00f5ne tunni, ning neid luuakse OpenID pakkuja kinnitamisel. Sarnaste v\u00f5tmete lekkimine p\u00e4rast kehtivuse l\u00f5ppemist ei kujuta endast turvaohtu. Vaikimisi on v\u00f5tme kehtivusaeg 24 tundi, p\u00e4rast mida tuleb end OpenID kaudu uuesti tuvastada. <\/p>\n

Integratsioon OpenSSH-ga p\u00f5hineb SSH protokolli laienduste loomise v\u00f5imalusel, mis lubavad siduda sertifikaatide SSH-ga juhuslikke andmeid. P\u00e4rast OpenID kaudu autentimise l\u00e4bimist loob klient avaliku v\u00f5tme, mis sisaldab PK-tokenit, mis kinnitab v\u00f5tme kuuluvust deklareeritud kasutajale. Token integreeritakse SSH protokolli l\u00e4bi SSH sertifikaadi lisainfo v\u00e4lja. PK-tokenite loomine ja nende kontroll serveri poolel toimub OpenPubKey kr\u00fcptograafilise protokolli abil. <\/p>\n

OpenPubKey v\u00f5imaldab genereerida avalikku v\u00f5tme ja siduda see OpenID-kliendi poolt antud tokeniga. Digitaalallkirja kaudu kinnitab pakkuja, et see v\u00f5tme on loodud nimetatud autentitud kasutaja poolt. N\u00e4iteks v\u00f5ib Google'i OpenID-pakkuja kinnitada, et kasutaja on autentitud kui test@gmail.com. P\u00f5hja-serveris kontrollitakse, kas kinnitatud token on OpenID-pakkuja poolt allkirjastatud ja kas digitaalallkiri vastab nimetatud avalikule v\u00f5tmele, st server saab veenduda, et just kasutaja test@gmail.com on loonud avaliku v\u00f5tme \u00fchenduva SSH-klient jaoks.

\"Cloudflare<\/center> <\/p>\n

OpenSSH integreerimine toimub, m\u00e4\u00e4rates programmi opkssh konfiguratsioonifailis «sshd_config» direktiivi «AuthorizedKeysCommand» kaudu (nt: «AuthorizedKeysCommand \/usr\/local\/bin\/opkssh verify %u %k %t»). OpenID konto sidumine toimub SSH serveri k\u00fcljel. SSH kliendi poolel ei ole seadeid vaja muuta, kuid enne sisse logimist tuleb k\u00e4ivitada k\u00e4sk «opkssh login» ja avanevas brauseriaknas valida OpenID pakkuja ning autentida end l\u00e4bi selle. <\/p>\n

Opkssh t\u00f6\u00f6riist genereerib SSH v\u00f5tmed ja saab PK-tokeni, mis kinnitab, et kasutaja on autentitud ning v\u00f5imaldab kontrollida, et loodud v\u00f5tmed kuuluvad deklareeritud kasutajale. SSH avalik v\u00f5ti, millele on lisatud PK-token t\u00e4iendavate andmete v\u00e4ljal, salvestatakse faili ~\/.ssh\/id_ecdsas ja hakkab edastuma \u00fchenduse loomisel serverile<\/a> SSH t\u00f6\u00f6riista kaudu. <\/p>\n

Serverisse sisselogimine toimub tavap\u00e4rase SSH skeemi j\u00e4rgi «ssh logi@server», samal ajal, kui serveril<\/a> loge peab olema eelnevalt tuvastatud OpenID kontoga, mida kasutaja kasutab. Seega saadab ssh-klient ssh-serverile avaliku v\u00f5tme, ning server k\u00e4ivitab k\u00e4su «opkssh verify» v\u00f5tme kontrollimiseks. <\/p>\n

Konto sidumiseks OpenID-ga t\u00e4idab serveri administraator k\u00e4su «opkssh add». N\u00e4iteks, et lubada sisse logimine serverisse kasutaja «root» kaudu OpenID autentimisega Gmaili konto test@gmail.com kaudu, tuleks t\u00e4ita k\u00e4sk «sudo opkssh add root test@gmail.com google», p\u00e4rast mida saab klient siseneda selle konto parameetritega k\u00e4suga «ssh root@host_server». <\/p>\n

Konto sidumist saab samuti teha k\u00e4sitsi konfiguratsioonifaili \/etc\/opk\/auth_id (v\u00f5i ~\/.opk\/auth_id) kaudu, kuhu eeltoodud n\u00e4ite jaoks kirjutatakse rida «root test@gmail.com https:\/\/accounts.google.com». T\u00e4iendavalt saab failis \/etc\/opk\/providers m\u00e4\u00e4rata lubatud OpenID pakkujate loendi, nende parameetrid ja lubatud kliendi identifikaatorite loendi.

\"Cloudflare<\/center>
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cloudflare \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439 opkssh (OpenPubkey SSH), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0432 OpenSSH \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0446\u0435\u043d\u0442\u0440\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c\u044e \u0432\u0445\u043e\u0434\u0430 \u0447\u0435\u0440\u0435\u0437 \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u0432 OpenID Connect. \u041f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 opkssh \u043c\u043e\u0436\u043d\u043e \u0438\u0437\u0431\u0430\u0432\u0438\u0442\u044c\u0441\u044f \u043e\u0442 \u0440\u0443\u0447\u043d\u043e\u0439 \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044e \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 SSH-\u043a\u043b\u044e\u0447\u0435\u0439, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0443 \u0441 \u043b\u044e\u0431\u044b\u0445 \u0445\u043e\u0441\u0442\u043e\u0432, \u0431\u0435\u0437 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0437\u0430\u043a\u0440\u044b\u0442\u044b\u0445 \u043a\u043b\u044e\u0447\u0435\u0439 \u043d\u0430 \u043a\u0430\u0436\u0434\u043e\u043c \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u043e\u043c \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0435 \u0438 \u0431\u0435\u0437 \u0440\u0443\u0447\u043d\u043e\u0433\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":123014,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-123013","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Cloudflare avaldas opkssh SSH autentimiseks l\u00e4bi OpenID Connect | ProHoster","description":"Cloudflare on esitanud t\u00f6\u00f6riista opkssh (OpenPubkey SSH), mis v\u00f5imaldab integreerida OpenSSH-sse keskse autentimise vahendeid OpenID Connect pakkujatega sisselogimise v\u00f5imalusega. Opkssh abil saab vabalt loobuda SSH-v\u00f5tmete haldamisest ja seadistamisest, samuti korraldada \u00fchenduse loomist serveriga mistahes hostidest, ilma et peaksite igal kliendiarvutil looma privaatv\u00f5tit ja ilma k\u00e4sit\u00f6\u00f6ta.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/kompaniya-cloudflare-opublikovala-opkssh-dlya-autentifikaczii-v-ssh-cherez-openid-connect","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cloudflare \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 opkssh \u0434\u043b\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 SSH \u0447\u0435\u0440\u0435\u0437 OpenID Connect | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cloudflare \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439 opkssh (OpenPubkey SSH), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0432 OpenSSH \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0446\u0435\u043d\u0442\u0440\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c\u044e \u0432\u0445\u043e\u0434\u0430 \u0447\u0435\u0440\u0435\u0437 \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u0432 OpenID Connect. \u041f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 opkssh \u043c\u043e\u0436\u043d\u043e \u0438\u0437\u0431\u0430\u0432\u0438\u0442\u044c\u0441\u044f \u043e\u0442 \u0440\u0443\u0447\u043d\u043e\u0439 \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044e \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 SSH-\u043a\u043b\u044e\u0447\u0435\u0439, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0443 \u0441 \u043b\u044e\u0431\u044b\u0445 \u0445\u043e\u0441\u0442\u043e\u0432, \u0431\u0435\u0437 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0437\u0430\u043a\u0440\u044b\u0442\u044b\u0445 \u043a\u043b\u044e\u0447\u0435\u0439 \u043d\u0430 \u043a\u0430\u0436\u0434\u043e\u043c \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u043e\u043c \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0435 \u0438 \u0431\u0435\u0437 \u0440\u0443\u0447\u043d\u043e\u0433\u043e","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/kompaniya-cloudflare-opublikovala-opkssh-dlya-autentifikaczii-v-ssh-cherez-openid-connect","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-03-26T14:22:58+00:00","article:modified_time":"2025-03-26T14:22:58+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"123013","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 22:07:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 11:38:16","updated":"2026-02-09 22:07:19"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/123013","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=123013"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/123013\/revisions"}],"predecessor-version":[{"id":160229,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/123013\/revisions\/160229"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/123014"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=123013"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=123013"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=123013"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}