{"id":123013,"date":"2025-03-26T16:22:56","date_gmt":"2025-03-26T14:22:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/kompaniya-cloudflare-opublikovala-opkssh-dlya-autentifikaczii-v-ssh-cherez-openid-connect"},"modified":"2025-03-26T16:22:56","modified_gmt":"2025-03-26T14:22:58","slug":"kompaniya-cloudflare-opublikovala-opkssh-dlya-autentifikaczii-v-ssh-cherez-openid-connect","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/kompaniya-cloudflare-opublikovala-opkssh-dlya-autentifikaczii-v-ssh-cherez-openid-connect","title":{"rendered":"Cloudflare on v\u00e4lja andnud opkssh, et autentida SSH-d OpenID Connecti kaudu.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Cloudflare esitas t\u00f6\u00f6riista opkssh (OpenPubkey SSH), mis v\u00f5imaldab integreerida OpenSSH-sse keskset autentimist OpenID Connecti pakkujatega sisenemise v\u00f5imalusega. T\u00f6\u00f6riista opkssh abil on v\u00f5imalik v\u00e4ltida k\u00e4sitsi SSH-v\u00f5tmete haldamist ja seadistamist, samuti korraldada serverisse \u00fchendust mistahes hostidest, ilma et oleks vajalik luua erav\u00f5tmeid iga kliendi arvuti jaoks ja ilma, et oleks vaja k\u00e4sitsi kopeerida avalikke v\u00f5tmeid serverisse. \u00dchendumiseks piisab, kui seada serveris konto sidumine OpenID pakkujaga. T\u00f6\u00f6riista kood on kirjutatud Go keeles ja levitatakse Apache 2.0 litsentsi alusel. <\/p>\n

Opkssh on \u00fchilduv OpenID pakkujatega Google, Microsoft\/Azure ja Gitlab, mis v\u00f5imaldab seadistada sisselogimise olemasolevate kontode kaudu gmail.com, microsoft.com ja gitlab.com teenustes. Opkssh kasutamisel genereeritakse ajutised v\u00f5tmest, mis kehtivad vaid m\u00f5ned tunnid ja moodustatakse OpenID pakkuja kinnituse alusel. Selliste v\u00f5tmete lekkimine p\u00e4rast kehtivusaja l\u00f5ppu ei kujuta endast turvariski. Vaikimisi on v\u00f5tme kehtivusaeg 24 tundi, p\u00e4rast mida on vajalik uuesti end OpenID kaudu tuvastada. <\/p>\n

Integratsioon OpenSSH-iga p\u00f5hineb SSH protokolli laienduste loomise v\u00f5imalusel, mis lubavad manustada juhuslikke andmeid SSH-sertifikaatidele. P\u00e4rast OpenID kaudu autentimist vormib klient avaliku v\u00f5tme, mis sisaldab PK-tokenit, mis kinnitab, et v\u00f5ti kuulub v\u00e4idetud kasutajale. Token integreeritakse SSH protokolli SSH-sertifikaadi t\u00e4iendavate andmete v\u00e4lja kaudu. PK-tokenite loomine ja nende kontrollimine serveri k\u00fcljel toimub OpenPubKey kr\u00fcptograafilise protokolli abil. <\/p>\n

OpenPubKey v\u00f5imaldab genereerida avaliku v\u00f5tme ja siduda selle OpenID teenusepakkuja v\u00e4ljastatud tokeniga. Digitaalse allkirjaga kinnitab teenusepakkuja, et see v\u00f5ti on loodud v\u00e4idetud autentitud kasutaja poolt. N\u00e4iteks v\u00f5ib Google'i OpenID teenusepakkuja kinnitada, et kasutaja on autentitud kui test@gmail.com. P\u00f5hja pool toimub kontroll, kas OpenID teenusepakkuja on allkirjastanud kaasatud tokeni ja kas digitaalne allkiri vastab v\u00e4idetud avalikule v\u00f5tmele, st server saab veenduda, et just kasutaja test@gmail.com on loonud avaliku v\u00f5tme SSH kliendile.

\"Cloudflare<\/center> <\/p>\n

OpenSSH-i integreerimine toimub, n\u00e4idates programmi opkssh faili konfigureerimise «sshd_config» kaudu direktiiviga «AuthorizedKeysCommand» (nt: «AuthorizedKeysCommand \/usr\/local\/bin\/opkssh verify %u %k %t»). OpenID kontode seostamine h\u00e4\u00e4lestatakse SSH-serveri poolel. SSH-kliendi poolel muudatusi ei n\u00f5uta, kuid enne sisselogimist tuleb k\u00e4ivitada k\u00e4sk «opkssh login» ja avanevas brauseriaknas valida OpenID pakkuja ja autentida end selle kaudu. <\/p>\n

Utility opkssh genereerib SSH v\u00f5tmed ja saadab PK-tokeni, mis kinnitab, et kasutaja on l\u00e4binud autentimise ning v\u00f5imaldab kontrollida, et loodud v\u00f5tmed kuuluvad v\u00e4idetud kasutajale. Avalik SSH v\u00f5ti, millele on lisatud PK-token t\u00e4iendavate andmete v\u00e4lja kaudu, salvestatakse faili ~\/\\.ssh\/id_ecdsas ja hakkab edastama, kui \u00fchendate serveri<\/a> utility ssh. <\/p>\n

Serverisse \u00fchenduse loomine toimub SSH-le iseloomuliku skeemi «ssh kasutajanimi@server» kaudu, kusjuures serveris<\/a> kasutajanimi peab olema eelnevalt tuvastatud OpenID kontoga, mida kasutab kasutaja. Niisiis, t\u00f6\u00f6 seisneb selles, et ssh-kliendi pool saadab ssh-serverile avaliku v\u00f5tme, ning server k\u00e4ivitab k\u00e4su «opkssh verify» v\u00f5tme kontrollimiseks. <\/p>\n

Konto sidumiseks OpenID-ga t\u00e4idab serveri administraator k\u00e4sku «opkssh add». N\u00e4iteks, et lubada sisse logida serverisse kasutajana «root» OpenID autentimise kaudu test@gmail.com konto kaudu Gmailis, tuleb k\u00e4ivitada «sudo opkssh add root test@gmail.com google», p\u00e4rast mida saab klient sellele kontole sisselogimist teostada k\u00e4suga «ssh root@serveri_host». <\/p>\n

Konto sidumise saab teha ka k\u00e4sitsi, redigeerides konfigureerimisfaili \/etc\/opk\/auth_id (v\u00f5i ~\/ .opk\/auth_id), kuhu eelneva n\u00e4ite puhul kirjutatakse rida «root test@gmail.com https:\/\/accounts.google.com». T\u00e4iendavalt saab l\u00e4bi faili \/etc\/opk\/providers m\u00e4\u00e4rata lubatud OpenID pakkujate loendi, nende parameetrid ja lubatud kliendi identifikaatorite loendi.

\"Cloudflare<\/center>
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cloudflare \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439 opkssh (OpenPubkey SSH), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0432 OpenSSH \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0446\u0435\u043d\u0442\u0440\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c\u044e \u0432\u0445\u043e\u0434\u0430 \u0447\u0435\u0440\u0435\u0437 \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u0432 OpenID Connect. \u041f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 opkssh \u043c\u043e\u0436\u043d\u043e \u0438\u0437\u0431\u0430\u0432\u0438\u0442\u044c\u0441\u044f \u043e\u0442 \u0440\u0443\u0447\u043d\u043e\u0439 \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044e \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 SSH-\u043a\u043b\u044e\u0447\u0435\u0439, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0443 \u0441 \u043b\u044e\u0431\u044b\u0445 \u0445\u043e\u0441\u0442\u043e\u0432, \u0431\u0435\u0437 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0437\u0430\u043a\u0440\u044b\u0442\u044b\u0445 \u043a\u043b\u044e\u0447\u0435\u0439 \u043d\u0430 \u043a\u0430\u0436\u0434\u043e\u043c \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u043e\u043c \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0435 \u0438 \u0431\u0435\u0437 \u0440\u0443\u0447\u043d\u043e\u0433\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":123014,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-123013","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ettev\u00f5te Cloudflare avaldas opkssh SSH autentimiseks OpenID Connecti kaudu | ProHoster","description":"Ettev\u00f5te Cloudflare tutvustas t\u00f6\u00f6riista opkssh (OpenPubkey SSH), mis v\u00f5imaldab integreerida OpenSSH-sse keskset autentimiss\u00fcsteemi koos sisselogimise v\u00f5imalusega OpenID Connect pakkujate kaudu.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/kompaniya-cloudflare-opublikovala-opkssh-dlya-autentifikaczii-v-ssh-cherez-openid-connect","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cloudflare \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 opkssh \u0434\u043b\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 SSH \u0447\u0435\u0440\u0435\u0437 OpenID Connect | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cloudflare \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439 opkssh (OpenPubkey SSH), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0432 OpenSSH \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0446\u0435\u043d\u0442\u0440\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c\u044e \u0432\u0445\u043e\u0434\u0430 \u0447\u0435\u0440\u0435\u0437 \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u0432 OpenID Connect.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/kompaniya-cloudflare-opublikovala-opkssh-dlya-autentifikaczii-v-ssh-cherez-openid-connect","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-03-26T14:22:58+00:00","article:modified_time":"2025-03-26T14:22:58+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"123013","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 22:07:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 11:38:16","updated":"2026-02-09 22:07:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/123013","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=123013"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/123013\/revisions"}],"predecessor-version":[{"id":160229,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/123013\/revisions\/160229"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/123014"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=123013"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=123013"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=123013"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}