{"id":95368,"date":"2020-09-28T13:42:14","date_gmt":"2020-09-28T11:42:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/reliz-openssh-8-4"},"modified":"2020-09-28T13:42:14","modified_gmt":"2020-09-28T11:42:14","slug":"reliz-openssh-8-4","status":"publish","type":"post","link":"https:\/\/prohoster.info\/nl\/blog\/news\/reliz-openssh-8-4","title":{"rendered":"De release van OpenSSH 8.4","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Na vier maanden ontwikkeling <noindex><a rel=\"nofollow\" href=\"https:\/\/lists.mindrot.org\/pipermail\/openssh-unix-dev\/2020-September\/038826.html\">is gepresenteerd<\/a><\/noindex> Release van OpenSSH 8.4, een open-source implementatie van de client en server voor het werken met de SSH 2.0 en SFTP protocollen.<\/p>\n<p>Belangrijkste wijzigingen:<\/p>\n<ul>\n<li class=\"l\"> Veranderingen met betrekking tot beveiliging:\n<ul>\n<li class=\"l\"> Bij ssh-agent, wanneer gebruik wordt gemaakt van FIDO-sleutels die niet zijn gemaakt voor authenticatie via SSH (de sleutelidentificator begint niet met de string 'ssh:'), wordt nu gecontroleerd of het bericht zal worden ondertekend met behulp van de methoden die in het SSH-protocol worden toegepast. Deze wijziging voorkomt dat ssh-agent wordt omgeleid naar externe hosts die FIDO-sleutels hebben, om te voorkomen dat deze sleutels worden gebruikt voor het ondertekenen van web-authenticatieverzoeken (de omgekeerde situatie, waarbij een browser een SSH-verzoek kan ondertekenen, is oorspronkelijk uitgesloten dankzij het gebruik van de prefix 'ssh:' in de sleutelidentificator).\n<li class=\"l\"> In ssh-keygen is er ondersteuning toegevoegd voor de credProtect-extensie, zoals beschreven in de FIDO 2.1-specificatie, die extra bescherming biedt voor sleutels door een verplichte PIN-code invoer te vereisen voordat enige operatie kan worden uitgevoerd die kan leiden tot het extraheren van de residenti\u00eble sleutel uit de token.\n<\/ul>\n<li class=\"l\"> Wijzigingen die mogelijk de compatibiliteit verstoren:\n<ul>\n<li class=\"l\"> Voor ondersteuning van FIDO\/U2F wordt aanbevolen om de libfido2-bibliotheek te gebruiken van ten minste versie 1.5.0. Er is gedeeltelijke ondersteuning voor oudere versies ge\u00efmplementeerd, maar in dat geval zullen functies zoals residenti\u00eble sleutels, PIN-aanvragen en het aansluiten van meerdere tokens niet beschikbaar zijn.\n<li class=\"l\"> In ssh-keygen zijn gegevens voor de authenticator toegevoegd aan het bevestigingsinformatieformaat, dat optioneel kan worden opgeslagen bij het genereren van een FIDO-sleutel, wat nodig is voor de verificatie van de bevestigende digitale handtekeningen.\n<li class=\"l\"> De API die wordt gebruikt voor de interactie van OpenSSH met de laag voor toegang tot FIDO-tokens is gewijzigd.\n<li class=\"l\"> Bij het bouwen van de draagbare versie van OpenSSH is nu automake vereist voor het genereren van het configure-script en de bijbehorende bouwbestanden (als de bouw wordt uitgevoerd vanuit een gepubliceerde tar-file met de code, is regeneratie van configure niet vereist).\n<\/ul>\n<li class=\"l\"> Ondersteuning voor FIDO-sleutels die bevestiging vereisen via een PIN-code is toegevoegd aan ssh en ssh-keygen. Voor het genereren van sleutels met een PIN is de optie 'verify-required' toegevoegd aan ssh-keygen. Bij het gebruik van dergelijke sleutels verschijnt er een prompt aan de gebruiker voordat de ondertekeningsactie wordt uitgevoerd, waarin wordt gevraagd de actie te bevestigen door de PIN-code in te voeren.\n<li class=\"l\"> In sshd is de optie 'verify-required' ge\u00efmplementeerd in de configuratie van authorized_keys, die vereist dat de mogelijkheden voor verificatie van de aanwezigheid van een gebruiker tijdens tokenoperaties worden toegepast. De FIDO-standaard voorziet in verschillende opties voor dergelijke verificatie, maar momenteel ondersteunt OpenSSH alleen verificatie op basis van een PIN-code.\n<li class=\"l\"> Support for verifying digital signatures that comply with the FIDO Webauthn standard has been added to sshd and ssh-keygen, allowing the use of FIDO keys in web browsers.\n<li class=\"l\"> In ssh under CertificateFile settings,<br \/>\n   ControlPath, IdentityAgent, IdentityFile, LocalForward, and<br \/>\n   Bij RemoteForward is nu substitutie van waarden uit omgevingsvariabelen toegestaan, aangegeven in de vorm '${ENV}'. <\/p>\n<li class=\"l\"> Support for the environment variable $SSH_ASKPASS_REQUIRE has been added to ssh and ssh-agent, which can be used to enable or disable the call to ssh-askpass.\n<li class=\"l\"> In ssh, the ssh_config directive AddKeysToAgent now allows limiting the key's validity period. After the specified limit expires, keys are automatically removed from the ssh-agent.\n<li class=\"l\"> In scp en sftp kan nu met de vlag '-A' expliciet omleiding in scp en sftp met behulp van ssh-agent worden toegestaan (standaard is omleiding verboden).\n<li class=\"l\"> In de ssh-instellingen is ondersteuning toegevoegd voor substitutie '%k', die de naam van de hostsleutel definieert. Deze mogelijkheid kan worden gebruikt om sleutels in afzonderlijke bestanden onder te brengen (bijvoorbeeld 'UserKnownHostsFile ~\/.ssh\/known_hosts.d\/%k').\n<li class=\"l\"> Het is toegestaan om de operatie 'ssh-add -d -' te gebruiken om sleutels die verwijderd moeten worden uit stdin te lezen.\n<li class=\"l\"> In sshd, the logging of the start and end of the connection trimming process, regulated by the MaxStartups parameter, has been implemented.\n<\/ul>\n<p>OpenSSH developers also reminded about the upcoming categorization of algorithms utilizing SHA-1 hashes as deprecated, due to <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=52149\">de toename<\/a><\/noindex> effectiviteit van collision attacks with a given prefix (the cost of finding a collision is estimated at around 45 thousand dollars). In one of the upcoming releases, the ability to use the public key signature algorithm \u2018ssh-rsa\u2019 will be disabled by default, which is mentioned in the original RFC for the SSH protocol and remains widely used in practice (to check for the implementation of ssh-rsa in your systems, you can try to connect via ssh with the option \u2018-oHostKeyAlgorithms=-ssh-rsa\u2019).<\/p>\n<p>To smooth the transition to new algorithms in OpenSSH, the next release will enable the UpdateHostKeys setting by default, which will automatically transition clients to more secure algorithms. Recommended algorithms for migration include rsa-sha2-256\/512 based on RFC8332 RSA SHA-2 (supported since OpenSSH 7.2 and used by default), ssh-ed25519 (supported since OpenSSH 6.5), and ecdsa-sha2-nistp256\/384\/521 based on RFC5656 ECDSA (supported since OpenSSH 5.7). <\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Bron: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=53793\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u043e\u0441\u043b\u0435 \u0447\u0435\u0442\u044b\u0440\u0451\u0445 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 OpenSSH 8.4, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430\u043c SSH 2.0 \u0438 SFTP. \u041e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f: \u0418\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e: \u0412 ssh-agent \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u043a\u043b\u044e\u0447\u0435\u0439 FIDO, \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u044b\u0445 \u043d\u0435 \u0434\u043b\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 SSH (\u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 \u043a\u043b\u044e\u0447\u0430 \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442\u0441\u044f \u043d\u0435 \u0441\u043e \u0441\u0442\u0440\u043e\u043a\u0438 &#171;ssh:&#187;), \u0442\u0435\u043f\u0435\u0440\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430, \u0447\u0442\u043e \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0435 \u0431\u0443\u0434\u0435\u0442 \u043f\u043e\u0434\u043f\u0438\u0441\u0430\u043d\u043e \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-95368","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u043e\u0441\u043b\u0435 \u0447\u0435\u0442\u044b\u0440\u0451\u0445 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 OpenSSH 8.4, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/nl\/blog\/news\/reliz-openssh-8-4\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"nl_NL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 OpenSSH 8.4 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u043e\u0441\u043b\u0435 \u0447\u0435\u0442\u044b\u0440\u0451\u0445 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 OpenSSH 8.4, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/nl\/blog\/news\/reliz-openssh-8-4\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-09-28T11:42:14+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-09-28T11:42:14+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Release of OpenSSH 8.4 | ProHoster","description":"After four months of development, OpenSSH 8.4 has been released, the open implementation.","canonical_url":"https:\/\/prohoster.info\/nl\/blog\/news\/reliz-openssh-8-4","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"nl_NL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 OpenSSH 8.4 | ProHoster","og:description":"\u041f\u043e\u0441\u043b\u0435 \u0447\u0435\u0442\u044b\u0440\u0451\u0445 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 OpenSSH 8.4, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438.","og:url":"https:\/\/prohoster.info\/nl\/blog\/news\/reliz-openssh-8-4","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-09-28T11:42:14+00:00","article:modified_time":"2020-09-28T11:42:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"95368","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 11:07:31","updated":"2022-10-03 18:22:53","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts\/95368","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/comments?post=95368"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts\/95368\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/media?parent=95368"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/categories?post=95368"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/tags?post=95368"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}