{"id":99317,"date":"2021-03-03T10:22:34","date_gmt":"2021-03-03T08:22:34","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/reliz-openssh-8-5"},"modified":"2021-03-03T10:22:34","modified_gmt":"2021-03-03T08:22:34","slug":"reliz-openssh-8-5","status":"publish","type":"post","link":"https:\/\/prohoster.info\/nl\/blog\/news\/reliz-openssh-8-5","title":{"rendered":"Release van OpenSSH 8.5","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Na vijf maanden ontwikkeling is de release van OpenSSH 8.5 gepresenteerd, een open implementatie van de client en server voor werken met de SSH 2.0 en SFTP-protocollen.    <\/p>\n<p>De ontwikkelaars van OpenSSH hebben herinnerd aan de nakende overgang van algoritmen die SHA-1-hashes gebruiken naar de verouderde categorie, in verband met de toegenomen effectiviteit van collision attacks met een vast prefix (de kosten voor het genereren van een collision worden geschat op ongeveer 50.000 dollar). In een van de komende versies is het de bedoeling om standaard de mogelijkheid tot gebruik van het digitale handtekeningalgoritme voor openbare sleutels 'ssh-rsa' uit te schakelen, dat wordt genoemd in de oorspronkelijke RFC voor het SSH-protocol en dat nog steeds wijdverspreid is in de praktijk.    <\/p>\n<p>Om te controleren of ssh-rsa in je systemen wordt toegepast, kun je proberen verbinding te maken via ssh met de optie '-oHostKeyAlgorithms=-ssh-rsa'. Het standaard uitschakelen van digitale handtekeningen 'ssh-rsa' betekent echter niet een volledige afwijzing van het gebruik van RSA-sleutels, aangezien het SSH-protocol naast SHA-1 ook andere hash-algoritmen toestaat. Concreet blijft naast 'ssh-rsa' de mogelijkheid bestaan om gebruik te maken van de combinaties 'rsa-sha2-256' (RSA\/SHA256) en 'rsa-sha2-512' (RSA\/SHA512).    <\/p>\n<p>Om de overgang naar nieuwe algoritmen in OpenSSH 8.5 te vergemakkelijken, is de instelling UpdateHostKeys standaard ingeschakeld, waarmee klanten automatisch worden overgezet naar meer betrouwbare algoritmen. Met deze instelling wordt een speciale uitbreiding van het protocol 'hostkeys@openssh.com' geactiveerd, waarmee de server na de authenticatie de klant kan informeren over alle beschikbare host-sleutels. De klant kan deze sleutels in zijn bestand ~\/ .ssh\/known_hosts weergeven, wat het mogelijk maakt om host-sleutels bij te werken en het wijzigen van sleutels te vergemakkelijken. <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/nl\/server\/dts-dronten\/\"   title=\"de server\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"2618\">de server<\/a>.     <\/p>\n<p>Het gebruik van UpdateHostKeys is beperkt tot enkele voorwaarden, die in de toekomst kunnen worden opgeheven: de sleutel moet worden vermeld in UserKnownHostsFile en mag niet worden gebruikt in GlobalKnownHostsFile; de sleutel moet slechts onder \u00e9\u00e9n naam aanwezig zijn; er mag geen hostkey-certificaat worden toegepast; er mogen geen hostnaammaskers in known_hosts worden gebruikt; de instelling VerifyHostKeyDNS moet uitgeschakeld zijn; de parameter UserKnownHostsFile moet actief zijn.     <\/p>\n<p>Onder de aanbevolen algoritmen voor migratie worden rsa-sha2-256\/512 genoemd, gebaseerd op RFC8332 RSA SHA-2 (ondersteund sinds OpenSSH 7.2 en standaard gebruikt), ssh-ed25519 (ondersteund sinds OpenSSH 6.5) en ecdsa-sha2-nistp256\/384\/521 op basis van RFC5656 ECDSA (ondersteund sinds OpenSSH 5.7).           <\/p>\n<p>Andere wijzigingen:  <\/p>\n<ul>\n<li class=\"l\"> Veranderingen met betrekking tot beveiliging:\n<ul>\n<li class=\"l\"> In ssh-agent is een kwetsbaarheid opgelost die is veroorzaakt door het dubbel vrijgeven van al vrijgegeven geheugen (double-free). Dit probleem is waargenomen sinds de release van OpenSSH 8.2 en kan potentieel worden uitgebuit wanneer de aanvaller toegang heeft tot de ssh-agent socket op het lokale systeem. De exploitatie wordt bemoeilijkt omdat alleen root en de oorspronkelijke gebruiker toegang hebben tot de socket. Het meest waarschijnlijke aanvalsscenario is dat de agent wordt omgeleid naar een account die onder controle staat van de aanvaller, of naar een host waarop de aanvaller root-toegang heeft.\n<li class=\"l\"> In sshd is bescherming toegevoegd tegen het doorgeven van zeer grote parameters met de gebruikersnaam naar de PAM-subsystemen, wat kwetsbaarheden in de PAM (Pluggable Authentication Module) systeemmodules kan blokkeren. Deze wijziging helpt bijvoorbeeld te voorkomen dat sshd wordt gebruikt als een vector voor het exploiteren van een recent ontdekte root-kwetsbaarheid in Solaris (CVE-2020-14871).      <\/ul>\n<li class=\"l\"> Wijzigingen die mogelijk de compatibiliteit verstoren:\n<ul>\n<li class=\"l\"> In ssh and sshd, an experimental key exchange method resilient to quantum computing attacks has been revamped. Quantum computers solve the problem of factoring natural numbers into prime factors much faster, which underpins modern asymmetric encryption algorithms and is effectively unsolvable on classical processors. The method used is based on the NTRU Prime algorithm, developed for post-quantum cryptosystems, and the key exchange method based on elliptic curves X25519. The method is now identified as sntrup761x25519-sha512@openssh.com instead of sntrup4591761x25519-sha512@tinyssh.org (the sntrup4591761 algorithm has been replaced with sntrup761).\n<li class=\"l\"> In ssh and sshd, the order of announcing supported digital signature algorithms has changed. ED25519 is now proposed first instead of ECDSA.\n<li class=\"l\"> In ssh and sshd, setting the TOS\/DSCP quality of service parameters for interactive sessions is now done before establishing a TCP connection.\n<li class=\"l\"> Support for the rijndael-cbc@lysator.liu.se cipher in ssh and sshd has been discontinued, as it is identical to aes256-cbc and was used until the approval of RFC-4253.\n<li class=\"l\"> By default, the CheckHostIP parameter is disabled, as its benefits are minimal, but its use complicates key rotation for hosts behind load balancers.      <\/ul>\n<li class=\"l\"> In sshd, PerSourceMaxStartups and PerSourceNetBlockSize settings have been added to limit the intensity of handler startups tied to the client\u2019s address. These parameters allow for finer control of process launch limits compared to the global MaxStartups setting.\n<li class=\"l\">  In ssh and sshd, a new LogVerbose setting has been added, which allows for forcibly increasing the level of debug information logged, with filtering options by patterns, functions, and files.\n<li class=\"l\"> In ssh, when accepting a new host key, all host names associated with the key are displayed. <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/nl\/lir\/ipv4\/\"   title=\"IP-adressen\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"830\">IP-adressen<\/a>, associated with the key.\n<li class=\"l\"> In ssh, the UserKnownHostsFile=none option is allowed to disable the use of the known_hosts file when identifying host keys.\n<li class=\"l\"> In ssh_config for ssh, the KnownHostsCommand setting has been added, allowing known_hosts data to be retrieved from the output of a specified command.\n<li class=\"l\"> In ssh_config for ssh, the PermitRemoteOpen option has been added, allowing the destination to be restricted when using the RemoteForward option with SOCKS.\n<li class=\"l\"> In SSH is voor FIDO-sleutels een herhaalde PIN-aanroep voorzien in geval van een fout bij de digitale handtekening door een onjuiste PIN en gebrek aan PIN-aanroep van de gebruiker (bijvoorbeeld wanneer het niet is gelukt om juiste biometrische gegevens te verkrijgen en het apparaat teruggevallen is op handmatige invoer van de PIN).\n<li class=\"l\"> In SSHD is ondersteuning voor extra systeemoproepen toegevoegd aan het seccomp-bpf-gebaseerde procesisolatiemechanisme op het Linux-platform.\n<li class=\"l\"> Het hulpprogramma contrib\/ssh-copy-id is bijgewerkt.          <\/ul>\n<p>Bron: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=54690\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u043e\u0441\u043b\u0435 \u043f\u044f\u0442\u0438 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 OpenSSH 8.5, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430\u043c SSH 2.0 \u0438 SFTP. \u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 OpenSSH \u043d\u0430\u043f\u043e\u043c\u043d\u0438\u043b\u0438 \u043e \u0433\u0440\u044f\u0434\u0443\u0449\u0435\u043c \u043f\u0435\u0440\u0435\u0432\u043e\u0434\u0435 \u0432 \u0440\u0430\u0437\u0440\u044f\u0434 \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0438\u0445 \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c\u043e\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u0445\u0435\u0448\u0438 SHA-1, \u0432 \u0441\u0432\u044f\u0437\u0438 \u0441 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435\u043c \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u043a\u043e\u043b\u043b\u0438\u0437\u0438\u043e\u043d\u043d\u044b\u0445 \u0430\u0442\u0430\u043a \u0441 \u0437\u0430\u0434\u0430\u043d\u043d\u044b\u043c \u043f\u0440\u0435\u0444\u0438\u043a\u0441\u043e\u043c (\u0441\u0442\u043e\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0434\u0431\u043e\u0440\u0430 \u043a\u043e\u043b\u043b\u0438\u0437\u0438\u0438 \u043e\u0446\u0435\u043d\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e \u0432 50 \u0442\u044b\u0441\u044f\u0447 \u0434\u043e\u043b\u043b\u0430\u0440\u043e\u0432). \u0412 \u043e\u0434\u043d\u043e\u043c [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-99317","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u043e\u0441\u043b\u0435 \u043f\u044f\u0442\u0438 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 OpenSSH 8.5, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430\u043c SSH 2.0 \u0438 SFTP.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/nl\/blog\/news\/reliz-openssh-8-5\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"nl_NL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 OpenSSH 8.5 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u043e\u0441\u043b\u0435 \u043f\u044f\u0442\u0438 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 OpenSSH 8.5, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430\u043c SSH 2.0 \u0438 SFTP.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/nl\/blog\/news\/reliz-openssh-8-5\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2021-03-03T08:22:34+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2021-03-03T08:22:34+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47OpenSSH 8.5-release | ProHoster","description":"Na vijf maanden ontwikkeling is de release van OpenSSH 8.5 gepresenteerd, een open implementatie van de client en server voor werken met de SSH 2.0 en SFTP-protocollen.","canonical_url":"https:\/\/prohoster.info\/nl\/blog\/news\/reliz-openssh-8-5","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"nl_NL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 OpenSSH 8.5 | ProHoster","og:description":"\u041f\u043e\u0441\u043b\u0435 \u043f\u044f\u0442\u0438 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 OpenSSH 8.5, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430\u043c SSH 2.0 \u0438 SFTP.","og:url":"https:\/\/prohoster.info\/nl\/blog\/news\/reliz-openssh-8-5","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-03-03T08:22:34+00:00","article:modified_time":"2021-03-03T08:22:34+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"99317","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-03 08:32:44","updated":"2026-02-09 21:38:09","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts\/99317","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/comments?post=99317"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts\/99317\/revisions"}],"predecessor-version":[{"id":159900,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts\/99317\/revisions\/159900"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/media?parent=99317"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/categories?post=99317"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/tags?post=99317"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}