{"id":52210,"date":"2019-11-03T00:00:00","date_gmt":"2019-11-02T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/v-openssh-dobavlena-podderzhka-universalnoj-dvuhfaktornoj-autentifikatsii"},"modified":"2020-02-18T13:59:53","modified_gmt":"2020-02-18T10:59:53","slug":"v-openssh-dobavlena-podderzhka-universalnoj-dvuhfaktornoj-autentifikatsii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/v-openssh-dobavlena-podderzhka-universalnoj-dvuhfaktornoj-autentifikatsii","title":{"rendered":"OpenSSH-sse on lisatud universaalse kahefaktorilise autentimise toetus.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

OpenSSH koodibaasi lisatud<\/a><\/noindex> eksperimentaalne tugit\u00f6\u00f6tlus kahefaktorilise autentimise jaoks seadmete kasutamise kaudu, mis toetavad protokolli U2F<\/a><\/noindex>, mida arendab liit FIDO<\/a><\/noindex>. U2F v\u00f5imaldab luua odavaid riistvaratokenite kasutamist, et kinnitada kasutaja f\u00fc\u00fcsilist kohalolekut, mille vaheline suhtlemine toimub USB, Bluetooth v\u00f5i NFC kaudu. Sellised seadmed edendavad kahefaktorilist autentimist veebisaitidel, neid toetavad peamised brauserid ja neid valmistavad erinevad tootjad, sealhulgas Yubico, Feitian, Thetis ja Kensington.<\/p>\n

Kasutamiseks seadmetega, mis kinnitavad kasutaja kohalolekut, on OpenSSH-sse lisatud uus v\u00f5tmet\u00fc\u00fcp \u201esk-ecdsa-sha2-nistp256@openssh.com\u201c (\u201eecdsa-sk\u201c), mis kasutab ECDSA (Elliptic Curve Digital Signature Algorithm) digitaalallkirja algoritmi, kasutades NIST P-256 elliptilist k\u00f5verat ja SHA-256 hajutust. Koostoimeprotseduurid tokenitega on t\u00f5stetud eraldi teeki, mis laaditakse sarnaselt PKCS#11 toe teegiga ja on wrapper olemasoleva teegi \u00fcmber. libfido2<\/a><\/noindex>, mis pakub vahendeid tokenite suhtlemiseks USB kaudu (toetavad protokollid FIDO U2F\/CTAP 1 ja FIDO 2.0\/CTAP 2). OpenSSH arendajate loodud vaheklass libsk-libfido2 on aktiveeritud<\/a><\/noindex> on p\u00f5hiosas libfido2, nagu ka HID-draiver<\/a><\/noindex> OpenBSD jaoks.<\/p>\n

U2F aktiveerimiseks saab kasutada v\u00e4rsket l\u00f5iget koodibaasist repositsioon<\/a><\/noindex> OpenSSH-st ja HEAD harust teegist libfido2<\/a><\/noindex>, mis sisaldab juba vajalikku OpenSSH jaoks vajalikku kihti.
\nLibfido2 toetab t\u00f6\u00f6d OpenBSD, Linuxi, macOS-i ja Windowsiga. <\/p>\n

Autentimiseks ja v\u00f5tme genereerimiseks tuleb seada keskkonnamuutuja SSH_SK_PROVIDER, n\u00e4idates selle v\u00e4\u00e4rtuseks libsk-libfido2.so asukohta (export SSH_SK_PROVIDER=\\\/path\\\/to\\\/libsk-libfido2.so), v\u00f5i m\u00e4\u00e4rata teek seadistusega SecurityKeyProvider, seej\u00e4rel k\u00e4ivitada \u201essh-keygen -t ecdsa-sk\u201c v\u00f5i, kui v\u00f5tmed on juba loodud ja seadistatud, \u00fchenduda serveriga k\u00e4sklusega \u201essh\u201c. K\u00e4ivitamisel ssh-keygen salvestatakse loodud v\u00f5tmepaar \u201e~\\\/.ssh\\id_ecdsa_sk\u201c ja seda saab kasutada sarnaselt muude v\u00f5tmetega. <\/p>\n

Avalik v\u00f5ti (id_ecdsa_sk.pub) tuleb serverisse kopeerida faili authorized_keys. Serveri k\u00fcljel kontrollitakse vaid digitaalallkirja ning interaktsioon tokenitega toimub kliendi k\u00fcljes (serverisse ei ole vaja installida libsk-libfido2, kuid server peab toetama v\u00f5tme t\u00fc\u00fcpi \u201eecdsa-sk\u201c). Generatsiooni k\u00e4igus loodud privaatv\u00f5ti (id_ecdsa_sk) on tegelikult v\u00f5tme deskriptor, mis loob reaalse v\u00f5tme ainult koos tokeni U2F-lt hoitava salajase j\u00e4rjestusega.<\/p>\n

Kui id_ecdsa_sk v\u00f5ti satub r\u00fcndaja k\u00e4tte, vajab ta autentimiseks juurdep\u00e4\u00e4su ka riistvaratokenile, ilma milleta on failis id_ecdsa_sk salvestatud privaatv\u00f5ti kasutu. Lisaks on vaikimisi iga v\u00f5tmega seotud toimingute (nii genereerimise kui autentimise puhul) jaoks vajalik kohaliku kasutaja f\u00fc\u00fcsilise kohaloleku kinnitamine, n\u00e4iteks palutakse puudutada tokeni sensorit, mis raskendab kaugr\u00fcnnakute teostamist s\u00fcsteemides, kus token on \u00fchendatud. Veel \u00fche kaitsekiirusena v\u00f5ib ssh-keygen k\u00e4ivitamisel m\u00e4\u00e4rata parooli juurdep\u00e4\u00e4suks v\u00f5tmefailile. <\/p>\n

U2F v\u00f5ti v\u00f5ib ssh-agenti lisada k\u00e4suga \u201essh-add ~\\\/.ssh\\id_ecdsa_sk\u201c, kuid ssh-agent peab olema loodud \u201eecdsa-sk\u201c v\u00f5tmete toetusega, libsk-libfido2 vaheteeki peab olema olemas ja agent peab t\u00f6\u00f6tama s\u00fcsteemis, millega token on \u00fchendatud.
\nUus v\u00f5tmet\u00fc\u00fcp \u201eecdsa-sk\u201c on lisatud, kuna OpenSSH ecdsa-v\u00f5tmete formaat erineb U2F digitaalallkirjade ECDSA formaadist t\u00e4iendavate v\u00e4ljade olemasolu t\u00f5ttu.<\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043a\u043e\u0434\u043e\u0432\u0443\u044e \u0431\u0430\u0437\u0443 OpenSSH \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0430 \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u0430\u044f \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430 \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432, \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u044e\u0449\u0438\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b U2F, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u044b\u0439 \u0430\u043b\u044c\u044f\u043d\u0441\u043e\u043c FIDO. U2F \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u0442\u044c \u043d\u0435\u0434\u043e\u0440\u043e\u0433\u0438\u0435 \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u044b\u0435 \u0442\u043e\u043a\u0435\u043d\u044b \u0434\u043b\u044f \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u044f \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435 \u0441 \u043a\u043e\u0442\u043e\u0440\u044b\u043c\u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 USB, Bluetooth \u0438\u043b\u0438 NFC. \u041f\u043e\u0434\u043e\u0431\u043d\u044b\u0435 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u043f\u0440\u043e\u0434\u0432\u0438\u0433\u0430\u044e\u0442\u0441\u044f \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0434\u043b\u044f \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043d\u0430 \u0441\u0430\u0439\u0442\u0430\u0445, \u0443\u0436\u0435 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u044e\u0442\u0441\u044f \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u043c\u0438 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430\u043c\u0438 \u0438 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u044e\u0442\u0441\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-52210","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47OpenSSH on saanud toetuse universaalsele kahefaktorilisele autentimisele | ProHoster","description":"OpenSSH koodibaasi on lisatud eksperimentaalne tugi kahefaktorilisele autentimisele.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/v-openssh-dobavlena-podderzhka-universalnoj-dvuhfaktornoj-autentifikatsii","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 OpenSSH \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0430 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430 \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0430\u043b\u044c\u043d\u043e\u0439 \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 | ProHoster","og:description":"\u0412 \u043a\u043e\u0434\u043e\u0432\u0443\u044e \u0431\u0430\u0437\u0443 OpenSSH \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0430 \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u0430\u044f \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430 \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/v-openssh-dobavlena-podderzhka-universalnoj-dvuhfaktornoj-autentifikatsii","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-02T21:00:00+00:00","article:modified_time":"2020-02-18T10:59:53+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"52210","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 02:52:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:47:23","updated":"2026-01-24 02:52:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/52210","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=52210"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/52210\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=52210"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=52210"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=52210"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}