Ka tohua e matou he tikanga mo te uru ohorere ki nga kaihautu SSH me nga taviri taputapu

I tenei pou, ka whakawhanakehia e matou he tikanga mo te uru ohorere ki nga kaihautu SSH ma te whakamahi i nga taviri haumarutanga taputapu tuimotu. He huarahi kotahi noa tenei, ka taea e koe te urutau kia rite ki o hiahia. Ka penapenahia e matou te mana tiwhikete SSH mo o matou kaihautu i runga i te matua haumaru taputapu. Ka mahi tenei kaupapa ki runga tata ki tetahi OpenSSH, tae atu ki te SSH me te hainatanga kotahi.

He aha tenei katoa? Ana, koinei te waahanga whakamutunga. He kuaha tuara tenei ka taea e koe te uru atu ki to tuumau karekau e mahi.

He aha te take ka whakamahi i nga tiwhikete hei utu mo nga taviri a te iwi/tangata mo te uru ohorere?

• Kaore i rite ki nga taviri a te iwi, he poto rawa te roa o nga tiwhikete. Ka taea e koe te whakaputa i tetahi tiwhikete e tika ana mo te 1 meneti me te 5 hēkona ranei. Whai muri i tenei waa, ka kore e taea te whakamahi te tiwhikete mo nga hononga hou. He pai tenei mo te uru ohorere.
• Ka taea e koe te hanga tiwhikete mo tetahi kaute i runga i o kaihautu, a, ki te tika, tukuna nga tiwhikete "kotahi-wa" ki o hoa mahi.

Nga mea e hiahia ana koe

• Nga taviri haumarutanga taputapu e tautoko ana i nga taviri noho.
  Ko nga taviri noho he mau taviri tuhi ka penapena katoa ki roto i te ki haumarutanga. I etahi wa ka tiakina e te PIN alphanumeric. Ko te waahanga whanui o te ki noho ka taea te kaweake mai i te ki haumarutanga, me te kowhiringa me te kakau matua motuhake. Hei tauira, ko nga taviri USB raupapa Yubikey 5 e tautoko ana i nga taviri noho. Mo tenei pou ka whakamahi au i tetahi taviri, engari me whai taapiri koe mo te taapiri.
• He waahi haumaru hei penapena i aua ki.
• OpenSSH putanga 8.2 teitei ake ranei i runga i to rorohiko o to rohe me nga kaitoro e hiahia ana koe ki te uru ohorere. Ka tukuna a Ubuntu 20.04 me OpenSSH 8.2.
• (he kōwhiringa, engari e taunaki ana) He taputapu CLI hei tirotiro i nga tiwhikete.

Whakangungu

Tuatahi, me hanga e koe he mana tiwhikete ka tu ki runga i te matua haumarutanga taputapu. Kōkuhu te kī ka whakahaere:

$ ssh-keygen -t ecdsa-sk -f sk-user-ca -O resident -C [security key ID]

Hei korero (-C) i tohu ahau [email tiakina]kia kore koe e wareware ko wai te ki haumarutanga no tenei mana tiwhikete.

I tua atu i te taapiri i te ki ki te Yubikey, e rua nga konae ka hangaia i te rohe:

1. sk-user-ca, he kakau matua e tohu ana ki te taviri tūmataiti kei roto i te ki haumarutanga,
2. sk-user-ca.pub, ka noho hei matua mo to mana tiwhikete.

Engari kaua e manukanuka, kei te rongoahia e te Yubikey tetahi atu taviri motuhake kaore e taea te tiki. Na reira, he pono nga mea katoa i konei.

I runga i nga kaihautu, hei pakiaka, taapirihia (mehemea kaore ano koe) nga mea e whai ake nei ki to whirihoranga SSHD (/etc/ssh/sshd_config):

TrustedUserCAKeys /etc/ssh/ca.pub

Na i runga i te kaihautu, tāpirihia te kī tūmatanui (sk-user-ca.pub) ki /etc/ssh/ca.pub

Tīmataria anō te daemon:

# /etc/init.d/ssh restart

Inaianei ka taea e taatau te uru atu ki te kaihautu. Engari i te tuatahi me whai tiwhikete. Waihangahia he takirua matua ka hono ki te tiwhikete:

$ ssh-keygen -t ecdsa -f emergency

Tiwhikete me nga takirua SSH
I etahi wa he mea whakamatautau ki te whakamahi i tetahi tiwhikete hei whakakapi mo te takirua matua mo te iwi / motuhake. Engari ko te tiwhikete anake kaore e ranea hei whakamotuhēhē i te kaiwhakamahi. Kei ia tiwhikete he kī tūmataiti e hono ana ki a ia. Koinei te take me hanga e tatou tenei takirua matua "ohotata" i mua i to tuku tiwhikete. Ko te mea nui ko te whakaatu i te tiwhikete kua hainatia ki te tūmau, e tohu ana i te takirua matua kei a matou he kī tūmataiti.

No reira kei te ora tonu te whakawhitinga matua a te iwi. Ka mahi tenei ahakoa me nga tiwhikete. Ko nga Tiwhikete ka whakakore noa i te hiahia mo te tūmau ki te rokiroki i nga taviri a te iwi.

Muri iho, hangahia te tiwhikete ake. Kei te hiahia ahau ki te whakamana a ubuntu i roto i nga meneti 10. Ka taea e koe te mahi i to ara.

$ ssh-keygen -s sk-user-ca -I test-key -n ubuntu -V -5m:+5m emergency

Ka tonoa koe ki te haina i te tiwhikete ma te whakamahi i to matimati. Ka taea e koe te taapiri i etahi atu ingoa ingoa kua wehea e nga piko, hei tauira -n ubuntu,carl,ec2-kaiwhakamahi

Koia, inaianei kua whai tiwhikete koe! I muri mai me tohu e koe nga whakaaetanga tika:

$ chmod 600 emergency-cert.pub

I muri i tenei, ka taea e koe te tiro i nga ihirangi o to tiwhikete:

$ step ssh inspect emergency-cert.pub

Koinei te ahua o taku:

emergency-cert.pub
        Type: [email protected] user certificate
        Public key: ECDSA-CERT SHA256:EJSfzfQv1UK44/LOKhBbuh5oRMqxXGBSr+UAzA7cork
        Signing CA: SK-ECDSA SHA256:kLJ7xfTTPQN0G/IF2cq5TB3EitaV4k3XczcBZcLPQ0E
        Key ID: "test-key"
        Serial: 0
        Valid: from 2020-06-24T16:53:03 to 2020-06-24T17:03:03
        Principals:
                ubuntu
        Critical Options: (none)
        Extensions:
                permit-X11-forwarding
                permit-agent-forwarding
                permit-port-forwarding
                permit-pty
                permit-user-rc

Anei te kī tūmatanui ko te kī ohorere i hangaia e mātou, ā, e hono ana a sk-user-ca ki te mana tohu.

Ka mutu kua rite taatau ki te whakahaere i te whakahau SSH:

$ ssh -i emergency ubuntu@my-hostname
ubuntu@my-hostname:~$

1. Ka taea e koe te hanga tiwhikete mo tetahi kaiwhakamahi i runga i te kaihautu e whakawhirinaki ana ki to mana tiwhikete.
2. Ka taea e koe te tango ohorere. Ka taea e koe te tiaki i te sk-user-ca, engari kaore koe e hiahia na te mea kei runga ano i te kii haumaru. Ka hiahia pea koe ki te tango i te Kī tūmatanui PEM taketake mai i o kaihautu (hei tauira i ~/.ssh/authorized_keys mo te kaiwhakamahi ubuntu) mena ka whakamahia e koe mo te uru ohorere.

Uru ohorere: Mahere Mahi

Whakapirihia te kī haumarutanga ka whakahaere i te whakahau:

$ ssh-add -K

Ma tenei ka taapiri i te kii whanui a te mana tiwhikete me te whakamaarama matua ki te kaihoko SSH.

Inaianei kaweake i te taviri tūmatanui ki te hanga tiwhikete:

$ ssh-add -L | tail -1 > sk-user-ca.pub

Waihangatia he tiwhikete me te ra paunga o, hei tauira, kaua e neke ake i te haora:

$ ssh-keygen -t ecdsa -f emergency
$ ssh-keygen -Us sk-user-ca.pub -I test-key -n [username] -V -5m:+60m emergency
$ chmod 600 emergency-cert.pub

Na inaianei ko SSH ano:

$ ssh -i emergency username@host

Mena kei te raru to konae .ssh/config i te wa e hono ana, ka taea e koe te whakahaere i te ssh me te -F kore kowhiringa hei karo. Mena ka hiahia koe ki te tuku tiwhikete ki tetahi hoa mahi, ko te huarahi ngawari me te tino haumaru Puawai makutu. Ki te mahi i tenei, me rua noa nga konae - i roto i ta maatau take, ohorere me te ohorere-cert.pub.

Ko taku pai ki tenei huarahi ko te tautoko taputapu. Ka taea e koe te whakauru i o taviri haumaru ki roto i te waahi haumaru ka kore e haere ki hea.

I runga i nga Tika Tika

Tūmau hautoa Ko VPS iti me nga tukatuka kaha mai i te AMD, te auau matua PTM ki te 3.4 GHz. Ko te whirihoranga teitei ka taea e koe te whakaoti i nga raru katoa - 128 CPU cores, 512 GB RAM, 4000 GB NVMe. Hono mai!

Source: will.com