{"id":95368,"date":"2020-09-28T13:42:14","date_gmt":"2020-09-28T11:42:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/reliz-openssh-8-4"},"modified":"2020-09-28T13:42:14","modified_gmt":"2020-09-28T11:42:14","slug":"reliz-openssh-8-4","status":"publish","type":"post","link":"https:\/\/prohoster.info\/lv\/blog\/news\/reliz-openssh-8-4","title":{"rendered":"OpenSSH 8.4 izlaidums","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>P\u0113c \u010detriem izstr\u0101des m\u0113ne\u0161iem <noindex><a rel=\"nofollow\" href=\"https:\/\/lists.mindrot.org\/pipermail\/openssh-unix-dev\/2020-September\/038826.html\">tika prezent\u0113ts<\/a><\/noindex> tika izdota OpenSSH 8.4, atv\u0113rt\u0101 klienta un servera realiz\u0101cija, kas darbojas p\u0113c SSH 2.0 un SFTP protokoliem.<\/p>\n<p>Galven\u0101s izmai\u0146as:<\/p>\n<ul>\n<li class=\"l\"> Izmai\u0146as, kas saist\u012btas ar dro\u0161\u012bbu:\n<ul>\n<li class=\"l\"> Tagad ssh-agent, izmantojot FIDO atsl\u0113gas, kuras nav izveidotas SSH autentifik\u0101cijai (atsl\u0113gas identifikators nes\u0101kas ar tekstu &#171;ssh:&#187;), p\u0101rbauda, vai zi\u0146ojums tiek parakst\u012bts, izmantojot SSH protokol\u0101 lietotos pa\u0146\u0113mienus. Izmai\u0146as ne\u013caus p\u0101rs\u016bt\u012bt ssh-agent uz att\u0101lin\u0101tiem hostiem ar FIDO atsl\u0113g\u0101m, lai nov\u0113rstu \u0161o atsl\u0113gu izmanto\u0161anu web autentifik\u0101cijas piepras\u012bjumu parakst\u012b\u0161anai (pret\u0113js gad\u012bjums, kad p\u0101rl\u016bks var parakst\u012bt SSH piepras\u012bjumu, s\u0101kotn\u0113ji ir izsl\u0113gts, izmantojot atsl\u0113gas identifikator\u0101 eso\u0161o prefiksu &#171;ssh:&#187;).\n<li class=\"l\"> ssh-keygen tagad atbalsta credProtect papla\u0161in\u0101juma pievieno\u0161anu, kas aprakst\u012bta FIDO 2.1 specifik\u0101cij\u0101, nodro\u0161inot papildu aizsardz\u012bbu atsl\u0113g\u0101m, pieprasot PIN koda ievadi pirms jebkuras oper\u0101cijas, kas var novest pie rezidenta atsl\u0113gas izvilk\u0161anas no tokenta.\n<\/ul>\n<li class=\"l\"> Izmai\u0146as, kas potenci\u0101li p\u0101rk\u0101pj sader\u012bbu:\n<ul>\n<li class=\"l\"> Lai atbalst\u012btu FIDO\/U2F, ieteicams izmantot libfido2 bibliot\u0113ku vismaz versij\u0101 1.5.0. Da\u013c\u0113ji ir ieviesta iesp\u0113ja izmantot ar\u012b vec\u0101kas versijas, ta\u010du \u0161aj\u0101 gad\u012bjum\u0101 b\u016bs nepieejamas t\u0101das funkcijas k\u0101 rezident\u0101s atsl\u0113gas, PIN piepras\u012bjums un vair\u0101ku tokentu savienojums.\n<li class=\"l\"> ssh-keygen tagad form\u0101t\u0101, kas ietver apstiprino\u0161o inform\u0101ciju, kas opcionaliz\u0113ti saglab\u0101ta atsl\u0113gas FIDO \u0123ener\u0113\u0161anas laik\u0101, ir iek\u013cauti dati par autentifikatoru, kas nepiecie\u0161ami, lai p\u0101rbaud\u012btu apstiprino\u0161\u0101s digit\u0101l\u0101s parakstus.\n<li class=\"l\"> Tika main\u012bts API, kas tiek lietots, saskaroties OpenSSH ar FIDO tokenda\u013cas starpniec\u012bbu.\n<li class=\"l\"> Veidojot p\u0101rn\u0113s\u0101jamo OpenSSH versiju, tagad nepiecie\u0161ams automake, lai \u0123ener\u0113tu configure skriptu un saist\u012bt\u0101s b\u016bvniec\u012bbas failus (ja b\u016bvniec\u012bba tiek veikta no public\u0113ta tar faila ar kodu, configure p\u0101rgener\u0113\u0161ana nav nepiecie\u0161ama).\n<\/ul>\n<li class=\"l\"> ssh un ssh-keygen tagad atbalsta FIDO atsl\u0113gas, kuras prasa apstiprin\u0101jumu, izmantojot PIN kodu. Lai \u0123ener\u0113tu atsl\u0113gas ar PIN, ssh-keygen ir pievienota opcija &#171;verify-required&#187;. Ja tiek izmantotas \u0161\u0101das atsl\u0113gas, pirms parakst\u012b\u0161anas oper\u0101cijas izpildes lietot\u0101jam tiek par\u0101d\u012bts piepras\u012bjums apstiprin\u0101t darb\u012bbu, ievadot PIN kodu.\n<li class=\"l\"> sshd authorized_keys konfigur\u0101cij\u0101 ir ieviesta opcija &#171;verify-required&#187;, kas prasa lietot\u0101ja kl\u0101tb\u016btnes verifik\u0101ciju oper\u0101ciju laik\u0101 ar tokenu. FIDO standarts paredz vair\u0101kas \u0161\u0101das verifik\u0101cijas iesp\u0113jas, ta\u010du pa\u0161laik OpenSSH atbalsta tikai verifik\u0101ciju, pamatojoties uz PIN kodu.\n<li class=\"l\"> SSHD un SSH-keygen ir pievienots digit\u0101lo parakstu p\u0101rbaudes atbalsts, kas atbilst FIDO Webauthn standartam, \u013caujot izmantot FIDO atsl\u0113gas t\u012bmek\u013ca p\u0101rl\u016bkos.\n<li class=\"l\"> SSH konfigur\u0101cij\u0101, izmantojot CertificateFile,<br \/>\n   ControlPath, IdentityAgent, IdentityFile, LocalForward un<br \/>\n   RemoteForward tagad at\u013cauj aizvietot v\u0113rt\u012bbas no vides main\u012bgajiem form\u0101t\u0101 &#171;${ENV}&#187;. <\/p>\n<li class=\"l\"> SSH un SSH-agent ir pievienots vides main\u012bgais $SSH_ASKPASS_REQUIRE, ko var izmantot, lai iesl\u0113gtu vai izsl\u0113gtu ssh-askpass izsaukumu.\n<li class=\"l\"> SSH konfigur\u0101cij\u0101 ssh_config ir pievienota iesp\u0113ja, kas ierobe\u017eo atsl\u0113gas der\u012bguma laiku direkt\u012bv\u0101 AddKeysToAgent. P\u0113c noteikt\u0101 termi\u0146a beig\u0101m atsl\u0113gas autom\u0101tiski tiek dz\u0113stas no SSH-agent.\n<li class=\"l\"> scp un sftp tagad ar &#171;-A&#187; flagu var skaidri at\u013caut p\u0101rs\u016bt\u012b\u0161anu, izmantojot ssh-agent (p\u0113c noklus\u0113juma p\u0101rs\u016bt\u012b\u0161ana ir aizliegta).\n<li class=\"l\"> ssh konfigur\u0101cij\u0101 pievienots atbalsts aizvieto\u0161anai &#8216;%k&#8217;, kas nosaka hosta atsl\u0113gas nosaukumu. \u0160o iesp\u0113ju var izmantot atsl\u0113gu sadal\u012b\u0161anai atsevi\u0161\u0137os failos (piem\u0113ram, &#171;UserKnownHostsFile ~\\\/ .ssh\\\/ known_hosts.d\\\/%k&#187;).\n<li class=\"l\"> At\u013cauts izmantot oper\u0101ciju &#171;ssh-add -d -&#187; atsl\u0113gu las\u012b\u0161anai no stdin, kuras ir j\u0101nov\u0113r\u0161.\n<li class=\"l\"> SSHD zi\u0146ojumos ir iek\u013cauta procesa, kas samazina savienojumus, regul\u0113to ar parametru MaxStartups, s\u0101kuma un pabeig\u0161anas laika atspogu\u013co\u0161ana.\n<\/ul>\n<p>OpenSSH izstr\u0101d\u0101t\u0101ji ar\u012b atg\u0101din\u0101ja par gaid\u0101mo p\u0101reju uz novecoju\u0161\u0101m algoritm\u0101m, kas izmanto SHA-1 hash, \u0146emot v\u0113r\u0101 <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=52149\">palielin\u0101\u0161anos<\/a><\/noindex> efektivit\u0101te kol\u012bzijas uzbrukumiem ar noteiktu prefiksu (kol\u012bzijas atra\u0161anas izmaksas tiek nov\u0113rt\u0113tas aptuveni 45 t\u016bksto\u0161i dol\u0101ru). Viens no tuv\u0101kajiem laidieniem pl\u0101no p\u0113c noklus\u0113juma atsl\u0113gt iesp\u0113ju izmantot \u00abssh-rsa\u00bb digit\u0101lo parakstu algoritmu, kas min\u0113ts ori\u0123in\u0101laj\u0101 RFC SSH protokolam un joproj\u0101m ir pla\u0161i izplat\u012bts praks\u0113 (lai p\u0101rbaud\u012btu ssh-rsa izmanto\u0161anu sav\u0101s sist\u0113m\u0101s, var m\u0113\u0123in\u0101t piesl\u0113gties ar ssh ar opciju \u00ab-oHostKeyAlgorithms=-ssh-rsa\u00bb).<\/p>\n<p>Lai nodro\u0161in\u0101tu vienm\u0113r\u012bgu p\u0101reju uz jaunajiem algoritmiem OpenSSH, n\u0101kamaj\u0101 laidien\u0101 p\u0113c noklus\u0113juma tiks iek\u013cauta iestat\u012bjuma UpdateHostKeys, kas autom\u0101tiski p\u0101rcels klientus uz dro\u0161\u0101kiem algoritmiem. Starp ieteiktajiem p\u0101rejas algoritmiem ir min\u0113ti rsa-sha2-256\/512, pamatojoties uz RFC8332 RSA SHA-2 (atbalsta s\u0101kot ar OpenSSH 7.2 un tiek izmantots p\u0113c noklus\u0113juma), ssh-ed25519 (atbalsta s\u0101kot ar OpenSSH 6.5) un ecdsa-sha2-nistp256\/384\/521, pamatojoties uz RFC5656 ECDSA (atbalsta s\u0101kot ar OpenSSH 5.7). <\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Avots: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=53793\">opennet.lv<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u043e\u0441\u043b\u0435 \u0447\u0435\u0442\u044b\u0440\u0451\u0445 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 OpenSSH 8.4, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430\u043c SSH 2.0 \u0438 SFTP. \u041e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f: \u0418\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e: \u0412 ssh-agent \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u043a\u043b\u044e\u0447\u0435\u0439 FIDO, \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u044b\u0445 \u043d\u0435 \u0434\u043b\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 SSH (\u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 \u043a\u043b\u044e\u0447\u0430 \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442\u0441\u044f \u043d\u0435 \u0441\u043e \u0441\u0442\u0440\u043e\u043a\u0438 &#171;ssh:&#187;), \u0442\u0435\u043f\u0435\u0440\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430, \u0447\u0442\u043e \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0435 \u0431\u0443\u0434\u0435\u0442 \u043f\u043e\u0434\u043f\u0438\u0441\u0430\u043d\u043e \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-95368","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.5 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u043e\u0441\u043b\u0435 \u0447\u0435\u0442\u044b\u0440\u0451\u0445 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 OpenSSH 8.4, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/lv\/blog\/news\/reliz-openssh-8-4\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.5\" \/>\n\t\t<meta property=\"og:locale\" content=\"lv_LV\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 OpenSSH 8.4 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u043e\u0441\u043b\u0435 \u0447\u0435\u0442\u044b\u0440\u0451\u0445 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 OpenSSH 8.4, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/lv\/blog\/news\/reliz-openssh-8-4\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-09-28T11:42:14+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-09-28T11:42:14+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47OpenSSH 8.4 izlaide | ProHoster","description":"P\u0113c \u010detriem izstr\u0101des m\u0113ne\u0161iem ir izlaista OpenSSH 8.4, atv\u0113rta realiz\u0101cija.","canonical_url":"https:\/\/prohoster.info\/lv\/blog\/news\/reliz-openssh-8-4","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"lv_LV","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 OpenSSH 8.4 | ProHoster","og:description":"\u041f\u043e\u0441\u043b\u0435 \u0447\u0435\u0442\u044b\u0440\u0451\u0445 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 OpenSSH 8.4, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438.","og:url":"https:\/\/prohoster.info\/lv\/blog\/news\/reliz-openssh-8-4","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-09-28T11:42:14+00:00","article:modified_time":"2020-09-28T11:42:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"95368","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 11:07:31","updated":"2022-10-03 18:22:53","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/95368","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/comments?post=95368"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/95368\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/media?parent=95368"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/categories?post=95368"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/tags?post=95368"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}