{"id":52210,"date":"2019-11-03T00:00:00","date_gmt":"2019-11-02T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/v-openssh-dobavlena-podderzhka-universalnoj-dvuhfaktornoj-autentifikatsii"},"modified":"2020-02-18T13:59:53","modified_gmt":"2020-02-18T10:59:53","slug":"v-openssh-dobavlena-podderzhka-universalnoj-dvuhfaktornoj-autentifikatsii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/v-openssh-dobavlena-podderzhka-universalnoj-dvuhfaktornoj-autentifikatsii","title":{"rendered":"OpenSSH-sse on lisatud universaalse kahefaasilise autentimise tugi.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

OpenSSH koodibaasi on lisatud<\/a><\/noindex> eksperimentaalne tugi kahefaktoriaalse autentimise jaoks seadmetega, mis toetavad protokolli U2F<\/a><\/noindex>, mida arendab \u00fchendus FIDO<\/a><\/noindex>. U2F v\u00f5imaldab luua odavaid riistvaralisi tokeneid, et kinnitada kasutaja f\u00fc\u00fcsilist kohalolekut, millega suhtlemine toimub l\u00e4bi USB, Bluetooth v\u00f5i NFC. Selliseid seadmeid propageeritakse kahefaktorilise autentimise meetodina veebisaitidel, need on juba toetatud peamistes brauserites ning neid toodavad erinevad tootjad, sealhulgas Yubico, Feitian, Thetis ja Kensington.<\/p>\n

Kasutajate kohaloleku t\u00f5endamiseks seadmetega suhtlemiseks on OpenSSH-sse lisatud uus v\u00f5tmet\u00fc\u00fcp «sk-ecdsa-sha2-nistp256@openssh.com» («ecdsa-sk»), mis kasutab ECDSA (Elliptic Curve Digital Signature Algorithm) digitaalallkirjastamise algoritmi NIST P-256 elliptilise k\u00f5vera ja SHA-256 r\u00e4si abil. Tokenitega suhtlemise protseduurid on viidud eraldi teeki, mis laaditakse analoogselt PKCS#11 toe teegiga ja toimib teekide liidese peal. libfido2<\/a><\/noindex>, mis kommunikatsioonivahendeid USB-\u00fclese tokenite jaoks (tugineb protokollidele FIDO U2F\/CTAP 1 ja FIDO 2.0\/CTAP 2). OpenSSH arendajate poolt ette valmistatud vahemoodul libsk-libfido2 lisatud<\/a><\/noindex> libfido2 p\u00f5hikomponentidesse, nagu ka HID-drivers<\/a><\/noindex> OpenBSD jaoks.<\/p>\n

U2F-i lubamiseks saab kasutada v\u00e4rsket koodibaasi l\u00f5iget reposiitiumist<\/a><\/noindex> OpenSSH ja HEAD-haru teegi libfido2<\/a><\/noindex>, kuhu on juba lisatud vajalik OpenSSH jaoks vajalik kiht.
\nLibfido2 toetab OpenBSD, Linuxi, macOSi ja Windowsi. <\/p>\n

Autentimiseks ja v\u00f5tme genereerimiseks tuleb seada keskkonnamuutuja SSH_SK_PROVIDER, millele tuleb m\u00e4\u00e4rata libsk-libfido2.so asukoht (export SSH_SK_PROVIDER=\/path\/to\/libsk-libfido2.so), v\u00f5i m\u00e4\u00e4rata teek SecurityKeyProvider seadistuses, seej\u00e4rel k\u00e4ivitada «ssh-keygen -t ecdsa-sk» v\u00f5i, kui v\u00f5tmed on juba loodud ja seadistatud, \u00fchenduda serveriga kasutades «ssh». K\u00e4ivitamisel ssh-keygen salvestatakse loodud v\u00f5tme paar «~\/.ssh\/id_ecdsa_sk» ja seda saab kasutada nagu teisi v\u00f5tmeid. <\/p>\n

Avalik v\u00f5ti (id_ecdsa_sk.pub) tuleb kopeerida serverisse faili authorized_keys. Serveri poolel kontrollitakse ainult digitaalallkiri, samas kui tokenitega suhtlemine toimub kliendi poolel (serverisse ei ole vaja installida libsk-libfido2, kuid server peab toetama «ecdsa-sk» v\u00f5tme t\u00fc\u00fcpi). Genereeritud privaatv\u00f5ti (id_ecdsa_sk) on sisuliselt v\u00f5tme descriptor, mis moodustab tegeliku v\u00f5tme ainult koos U2F tokeni salajase j\u00e4rjestusega.<\/p>\n

Kui r\u00fcndaja p\u00e4\u00e4seb k\u00e4sipidi id_ecdsa_sk v\u00f5tmele, vajab ta autentimiseks ka juurdep\u00e4\u00e4su riistvara tokenile, ilma milleta on id_ecdsa_sk failis salvestatud privaatv\u00f5ti kasutuks. Lisaks on vaikimisi v\u00f5tmete kasutamisel (nii genereerimise kui ka autentimise ajal) vajalik kohaliku kasutaja f\u00fc\u00fcsilise kohaloleku kinnitus, n\u00e4iteks palutakse puudutada tokenil andurit, mis muudab eemalt r\u00fcnnakute teostamise s\u00fcsteemidesse, kus token on \u00fchendatud, keerulisemaks. Veel \u00fcheks kaitsekihiks ssh-keygen k\u00e4ivitamisel v\u00f5ib olla parool, mis on m\u00e4\u00e4ratud v\u00f5tmefaili juurdep\u00e4\u00e4suks. <\/p>\n

U2F v\u00f5ti saab lisada ssh-agenti kaudu «ssh-add ~\/.ssh\/id_ecdsa_sk», kuid ssh-agent peab olema \u00fcles ehitatud «ecdsa-sk» v\u00f5tmete toega, olemas peab olema libsk-libfido2 vahekiht ja agent peab t\u00f6\u00f6tama s\u00fcsteemis, millele token on \u00fchendatud.
\nUue «ecdsa-sk» v\u00f5tme t\u00fc\u00fcbi lisamine on vajalik, kuna OpenSSH ecdsa-v\u00f5tmete formaat erineb ECDSA digitaalallkirjade U2F formaadist, omades lisav\u00e4lju.<\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043a\u043e\u0434\u043e\u0432\u0443\u044e \u0431\u0430\u0437\u0443 OpenSSH \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0430 \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u0430\u044f \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430 \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432, \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u044e\u0449\u0438\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b U2F, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u044b\u0439 \u0430\u043b\u044c\u044f\u043d\u0441\u043e\u043c FIDO. U2F \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u0442\u044c \u043d\u0435\u0434\u043e\u0440\u043e\u0433\u0438\u0435 \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u044b\u0435 \u0442\u043e\u043a\u0435\u043d\u044b \u0434\u043b\u044f \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u044f \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435 \u0441 \u043a\u043e\u0442\u043e\u0440\u044b\u043c\u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 USB, Bluetooth \u0438\u043b\u0438 NFC. \u041f\u043e\u0434\u043e\u0431\u043d\u044b\u0435 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u043f\u0440\u043e\u0434\u0432\u0438\u0433\u0430\u044e\u0442\u0441\u044f \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0434\u043b\u044f \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043d\u0430 \u0441\u0430\u0439\u0442\u0430\u0445, \u0443\u0436\u0435 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u044e\u0442\u0441\u044f \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u043c\u0438 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430\u043c\u0438 \u0438 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u044e\u0442\u0441\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-52210","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47OpenSSH-sse on lisatud universaalne kahefaktoriline autentimise tugi | ProHoster","description":"OpenSSH koodibaasi on lisatud katseversioon kahefaktorilise autentimise toetuseks.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/v-openssh-dobavlena-podderzhka-universalnoj-dvuhfaktornoj-autentifikatsii","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 OpenSSH \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0430 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430 \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0430\u043b\u044c\u043d\u043e\u0439 \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 | ProHoster","og:description":"\u0412 \u043a\u043e\u0434\u043e\u0432\u0443\u044e \u0431\u0430\u0437\u0443 OpenSSH \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0430 \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u0430\u044f \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430 \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/v-openssh-dobavlena-podderzhka-universalnoj-dvuhfaktornoj-autentifikatsii","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-02T21:00:00+00:00","article:modified_time":"2020-02-18T10:59:53+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"52210","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 02:52:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:47:23","updated":"2026-01-24 02:52:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/52210","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=52210"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/52210\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=52210"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=52210"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=52210"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}