{"id":38754,"date":"2019-10-31T22:25:45","date_gmt":"2019-10-31T19:25:45","guid":{"rendered":"https:\/\/prohoster.info\/blog\/reliz-openssh-8-1\/"},"modified":"2019-10-31T22:25:45","modified_gmt":"2019-10-31T19:25:45","slug":"reliz-openssh-8-1","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/news\/reliz-openssh-8-1","title":{"rendered":"Izdanje OpenSSH 8.1","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Nakon \u0161est mjeseci razvoja <noindex><a rel=\"nofollow\" href=\"http:\/\/lists.mindrot.org\/pipermail\/openssh-unix-dev\/2019-October\/037966.html\">predstavljen<\/a><\/noindex> izdanje <noindex><a rel=\"nofollow\" href=\"http:\/\/www.openssh.com\/\">OpenSSH 8.1<\/a><\/noindex>, otvorena implementacija klijenta i poslu\u017eitelja za rad s protokolima SSH 2.0 i SFTP. <\/p>\n<p>U novom izdanju posebno se isti\u010de rje\u0161avanje ranjivosti koja poga\u0111a ssh, sshd, ssh-add i ssh-keygen. Problem se javlja u kodu za parsiranje privatnih klju\u010deva tipa XMSS i omogu\u0107ava napada\u010du da inicira cjelobrojno prelivanje. Ranjivost je ozna\u010dena kao eksploatabilna, ali rijetko primjenjiva, budu\u0107i da podr\u0161ka za XMSS klju\u010deve spada u eksperimentalne mogu\u0107nosti, onemogu\u0107ene prema zadanim postavkama (u prenosivoj verziji u autoconf \u010dak nije predvi\u0111ena opcija za uklju\u010divanje XMSS).<\/p>\n<p>Glavne promjene: <\/p>\n<ul>\n<li class=\"l\"> u ssh, sshd i ssh-agent <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=50929\">dodana je<\/a><\/noindex> kod koji sprje\u010dava obnavljanje privatnog klju\u010da u radnoj memoriji tijekom izvo\u0111enja napada putem bo\u010dnih kanala, kao \u0161to su <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=47856\">Spectre, Meltdown<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=41340\">RowHammer<\/a><\/noindex> i <noindex><a rel=\"nofollow\" href=\"https:\/\/rambleed.com\/\">RAMBleed<\/a><\/noindex>. Privatni klju\u010devi sada se \u0161ifriraju prilikom u\u010ditavanja u memoriju i de\u0161ifriraju se samo tijekom kori\u0161tenja, ostaju\u0107i tijekom tog vremena \u0161ifrirani. Ovim pristupom, za uspje\u0161no obnavljanje privatnog klju\u010da, napada\u010du je potrebno prethodno rekonstruirati nasumi\u010dno generirani me\u0111uklju\u010d veli\u010dine 16 KB koji se koristi za \u0161ifriranje glavnog klju\u010da, \u0161to je malo vjerojatno s obzirom na u\u010destalost pogre\u0161aka pri obnovi karakteristi\u010dnu za moderne napade;\n<li class=\"l\"> U  <noindex><a rel=\"nofollow\" href=\"https:\/\/man.openbsd.org\/ssh-keygen.1\">ssh-keygen<\/a><\/noindex>  dodana je eksperimentalna podr\u0161ka pojednostavljenoj shemi stvaranja i verifikacije digitalnih potpisa. Digitalni potpisi mogu se stvarati pomo\u0107u obi\u010dnih SSH klju\u010deva pohranjenih na disku ili u ssh-agentu, a verifikovati koriste\u0107i sli\u010dan popis odobrenih klju\u010deva <noindex><a rel=\"nofollow\" href=\"https:\/\/man.openbsd.org\/ssh-keygen.1#ALLOWED_SIGNERS\">. U digitalni potpis ugra\u0111uju se informacije o prostoru imena kako bi se izbjegla zabuna prilikom primjene u razli\u010ditim domenama (npr. za email i datoteke);<\/a><\/noindex>ssh-keygen je po defaultu preba\u010den na kori\u0161tenje algoritma rsa-sha2-512 prilikom ovjere certifikata digitalnim potpisom temeljenim na RSA klju\u010du (prilikom rada u CA modu). Ovi certifikati nisu kompatibilni s izdanjima prije OpenSSH 7.2 (za o\u010duvanje kompatibilnosti potrebno je predefinirati tip algoritma, na primjer pozivom \u201essh-keygen -t ssh-rsa -s \u2026\u201c);\n<li class=\"l\"> ssh-keygen je prema zadanim postavkama preba\u010den na kori\u0161tenje algoritma rsa-sha2-512 prilikom potpisivanja certifikata digitalnim potpisom temeljenim na RSA klju\u010du (u radu u CA na\u010dinu). Takvi certifikati nisu kompatibilni s izdanjima prije OpenSSH 7.2 (za osiguranje kompatibilnosti potrebno je ponovo definirati tip algoritma, na primjer putem poziva &#171;ssh-keygen -t ssh-rsa -s &#8230;&#187;);\n<li class=\"l\"> U ssh-u, u izrazu ProxyCommand implementirana je podr\u0161ka za razvijanje podzastupljenog &#171;%n&#187; (navedeno u adresnoj traci ime doma\u0107ina);\n<li class=\"l\"> U popisima algoritama \u0161ifriranja za ssh i sshd za uklju\u010divanje predlo\u017eenih zadatih algoritama sada mo\u017ee se koristiti simbol &#171;^&#187;. Na primjer, za dodavanje ssh-ed25519 u zadani popis mo\u017ee se navesti &#171;HostKeyAlgorithms ^ssh-ed25519&#187;;\n<li class=\"l\"> U ssh-keygen osiguran je ispis komentara prilo\u017eenog uz klju\u010d prilikom izdvajanja javnog klju\u010da iz privatnog;\n<li class=\"l\"> U ssh-keygen dodana je mogu\u0107nost kori\u0161tenja zastavice &#171;-v&#187; prilikom izvo\u0111enja operacija pretra\u017eivanja klju\u010deva (na primjer, &#171;ssh-keygen -vF host&#187;), \u010dije navo\u0111enje rezultira ispisom vizualnog potpisa doma\u0107ina;\n<li class=\"l\"> Dodana je mogu\u0107nost kori\u0161tenja <noindex><a rel=\"nofollow\" href=\"https:\/\/en.wikipedia.org\/wiki\/PKCS_8\">PKCS8<\/a><\/noindex> kao alternativni format za pohranu privatnih klju\u010deva na disku. Prema zadanim postavkama i dalje se koristi PEM format, dok PKCS8 mo\u017ee biti koristan za postizanje kompatibilnosti s aplikacijama tre\u0107ih strana.\n<\/ul>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Izvor: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=51640\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u043e\u0441\u043b\u0435 \u0448\u0435\u0441\u0442\u0438 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 OpenSSH 8.1, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430\u043c SSH 2.0 \u0438 SFTP. \u041e\u0442\u0434\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u044f \u0432 \u043d\u043e\u0432\u043e\u043c \u0432\u044b\u043f\u0443\u0441\u043a\u0435 \u0437\u0430\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u0435\u0442 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0435\u0439 ssh, sshd, ssh-add \u0438 ssh-keygen. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u043a\u043e\u0434\u0435 \u043f\u0430\u0440\u0441\u0438\u043d\u0433\u0430 \u0437\u0430\u043a\u0440\u044b\u0442\u044b\u0445 \u043a\u043b\u044e\u0447\u0435\u0439 \u0441 \u0442\u0438\u043f\u043e\u043c XMSS \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0438\u043d\u0438\u0446\u0438\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0446\u0435\u043b\u043e\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u043e\u0435 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0442\u043c\u0435\u0447\u0435\u043d\u0430 \u043a\u0430\u043a \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0430\u044f, [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-38754","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u043e\u0441\u043b\u0435 \u0448\u0435\u0441\u0442\u0438 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/hr\/blog\/news\/reliz-openssh-8-1\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"hr_HR\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 OpenSSH 8.1 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u043e\u0441\u043b\u0435 \u0448\u0435\u0441\u0442\u0438 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/hr\/blog\/news\/reliz-openssh-8-1\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:25:45+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:25:45+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Izdanje OpenSSH 8.1 | ProHoster","description":"Nakon \u0161est mjeseci razvoja objavljen je izdanak","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/news\/reliz-openssh-8-1","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 OpenSSH 8.1 | ProHoster","og:description":"\u041f\u043e\u0441\u043b\u0435 \u0448\u0435\u0441\u0442\u0438 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437","og:url":"https:\/\/prohoster.info\/hr\/blog\/news\/reliz-openssh-8-1","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:25:45+00:00","article:modified_time":"2019-10-31T19:25:45+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"38754","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 23:17:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:04:29","updated":"2026-01-23 23:17:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/38754","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=38754"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/38754\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=38754"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=38754"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=38754"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}