{"id":99317,"date":"2021-03-03T10:22:34","date_gmt":"2021-03-03T08:22:34","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/reliz-openssh-8-5"},"modified":"2021-03-03T10:22:34","modified_gmt":"2021-03-03T08:22:34","slug":"reliz-openssh-8-5","status":"publish","type":"post","link":"https:\/\/prohoster.info\/no\/blog\/news\/reliz-openssh-8-5","title":{"rendered":"Utgivelsen av OpenSSH 8.5","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Etter fem m\u00e5neder med utvikling presenteres OpenSSH 8.5, en \u00e5pen implementering av klient og server for bruk med SSH 2.0- og SFTP-protokoller.    <\/p>\n<p>Utviklerne av OpenSSH har p\u00e5minnet om den forest\u00e5ende overf\u00f8ringen av algoritmer som bruker SHA-1-hash til kategorien utdaterte algoritmer, ettersom effektiviteten av kollisjonangrep med angitt prefiks har \u00f8kt (kostnaden for \u00e5 finne en kollisjon ansl\u00e5s til omtrent 50 000 dollar). I en av de kommende utgivelsene planlegger de \u00e5 deaktivere bruken av algoritmen for digitale signaturer med offentlig n\u00f8kkel \u00abssh-rsa\u00bb som nevnes i den originale RFC for SSH-protokollen og som fortsatt er mye brukt i praksis.    <\/p>\n<p>For \u00e5 sjekke bruken av ssh-rsa i systemene dine, kan du pr\u00f8ve \u00e5 koble til via ssh med alternativet \u00ab-oHostKeyAlgorithms=-ssh-rsa\u00bb. \u00c5 sl\u00e5 av digitale signaturer \u00abssh-rsa\u00bb som standard betyr ikke et fullstendig avslag p\u00e5 bruken av RSA-n\u00f8kler, siden SSH-protokollen tillater bruk av andre hash-algoritmer i tillegg til SHA-1. Spesielt vil det, i tillegg til \u00abssh-rsa\u00bb, fortsatt v\u00e6re mulig \u00e5 bruke \u00abrsa-sha2-256\u00bb (RSA\/SHA256) og \u00abrsa-sha2-512\u00bb (RSA\/SHA512).    <\/p>\n<p>For \u00e5 lette overgangen til nye algoritmer er innstillingen UpdateHostKeys aktivert som standard i OpenSSH 8.5, noe som lar klienter automatisk bytte til mer p\u00e5litelige algoritmer. Med denne innstillingen aktiveres en spesialprotokolet \u00abhostkeys@openssh.com\u00bb, som lar serveren informere klienten om alle tilgjengelige verts-n\u00f8kler etter autentisering. Klienten kan reflektere disse n\u00f8klene i sin fil ~\/ .ssh\/known_hosts, noe som legger til rette for oppdatering av verts-n\u00f8kler og forenkler bytte av n\u00f8kler. <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/no\/server\/dts-dronten\/\"   title=\"serveren\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"2618\">serveren<\/a>.     <\/p>\n<p>Bruken av UpdateHostKeys er begrenset av flere forbehold som kan bli opphevet i fremtiden: n\u00f8kkelen m\u00e5 nevnes i UserKnownHostsFile og ikke brukes i GlobalKnownHostsFile; n\u00f8kkelen m\u00e5 bare v\u00e6re til stede under ett navn; vertsn\u00f8kkelsertifikatet skal ikke brukes; det skal ikke brukes masker p\u00e5 vertsnavnet i known_hosts; innstillingen VerifyHostKeyDNS m\u00e5 v\u00e6re deaktivert; innstillingen UserKnownHostsFile m\u00e5 v\u00e6re aktivert.     <\/p>\n<p>Blant de anbefalte algoritmene for migrering er rsa-sha2-256\/512 basert p\u00e5 RFC8332 RSA SHA-2 (st\u00f8ttet fra OpenSSH 7.2 og brukt som standard), ssh-ed25519 (st\u00f8ttet fra OpenSSH 6.5) og ecdsa-sha2-nistp256\/384\/521 basert p\u00e5 RFC5656 ECDSA (st\u00f8ttet fra OpenSSH 5.7).           <\/p>\n<p>Andre endringar:  <\/p>\n<ul>\n<li class=\"l\"> Sikkerhetsrelaterte endringer:\n<ul>\n<li class=\"l\"> I ssh-agent er det rettet en s\u00e5rbarhet som er for\u00e5rsaket av dobbel frigj\u00f8ring av allerede frigitt minne (double-free). Problemet viste seg med utgivelsen av OpenSSH 8.2 og kan potensielt utnyttes hvis en angriper har tilgang til ssh-agent-uttaksstedet p\u00e5 det lokale systemet. Utnyttelse kompliseres av at bare root og den originale brukeren har tilgang til sockets. Det mest sannsynlige angrepsszenariet er \u00e5 omdirigere agenten til en konto som kontrolleres av angriperen, eller til en vert som angriperen har root-tilgang til.\n<li class=\"l\"> I sshd er det lagt til beskyttelse mot overf\u00f8ring av sv\u00e6rt store parametere med brukernavn til PAM-undermodulen, noe som gj\u00f8r det mulig \u00e5 blokkere s\u00e5rbarheter i systemmoduler for PAM (Pluggable Authentication Module). For eksempel forhindrer endringen bruken av sshd som en vektor for utnyttelse av en nylig oppdaget root-s\u00e5rbarhet i Solaris (CVE-2020-14871).      <\/ul>\n<li class=\"l\"> Endringer som potensielt bryter kompatibiliteten:\n<ul>\n<li class=\"l\"> I ssh og sshd er den eksperimentelle metoden for n\u00f8kkelutveksling, som er motstandsdyktig mot kvasarcomputere, omarbeidet. Kvasarcomputere l\u00f8ser problemet med \u00e5 faktorere naturlige tall i primtall radikalt raskere, noe som ligger til grunn for moderne asymmetriske krypteringsalgoritmer og er effektivt ul\u00f8selig p\u00e5 klassiske prosessorer. Den brukte metoden er basert p\u00e5 algoritmen NTRU Prime, utviklet for post-kvasarkryptosystemer, og n\u00f8kkelutvekslingsmetoden basert p\u00e5 elliptiske kurver X25519. I stedet for sntrup4591761x25519-sha512@tinyssh.org identifiseres metoden n\u00e5 som sntrup761x25519-sha512@openssh.com (algoritmen sntrup4591761 er erstattet med sntrup761).\n<li class=\"l\"> I ssh og sshd er rekkef\u00f8lgen for annonsering av st\u00f8ttede digitale signaturalgoritmer endret. ED25519 tilbys n\u00e5 f\u00f8rst i stedet for ECDSA.\n<li class=\"l\"> I ssh og sshd settes QoS TOS\/DSCP-parametrene for interaktive \u00f8kter n\u00e5 f\u00f8r TCP-forbindelsen etableres.\n<li class=\"l\"> I ssh og sshd er st\u00f8tten for chiffret rijndael-cbc@lysator.liu.se, som er identisk med aes256-cbc og ble brukt f\u00f8r RFC-4253 ble godkjent, avviklet.\n<li class=\"l\"> Parameteret CheckHostIP er som standard deaktivert, da fordelen av dette er ubetydelig, men bruken kompliserer betydelig rotasjonen av n\u00f8kler for verter bak lastbalansere.      <\/ul>\n<li class=\"l\"> I sshd er innstillingene PerSourceMaxStartups og PerSourceNetBlockSize lagt til for \u00e5 begrense intensiteten av oppstart av h\u00e5ndterere knyttet til klientens adresse. Disse parameterne gir mer presis kontroll over begrensningen av prosessoppstart sammenlignet med den generelle innstillingen MaxStartups.\n<li class=\"l\">  I ssh og sshd er en ny innstilling LogVerbose lagt til, som gj\u00f8r det mulig \u00e5 tvinge opp niv\u00e5et av loggf\u00f8rt feilmelding med mulighet for filtrering etter m\u00f8nstre, funksjoner og filer.\n<li class=\"l\"> I ssh vises alle vertsnavn og <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/no\/lir\/ipv4\/\"   title=\"IP-adresser\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"830\">IP-adresser<\/a>, assosiert med n\u00f8kkelen, n\u00e5r et nytt verts n\u00f8kkel tas i bruk.\n<li class=\"l\"> I ssh er det tillatt \u00e5 spesifisere alternativet UserKnownHostsFile=none for \u00e5 deaktivere bruken av known_hosts-filen ved identifikasjon av verts n\u00f8kler.\n<li class=\"l\"> I ssh_config for ssh er innstillingen KnownHostsCommand lagt til, som lar deg f\u00e5 data fra known_hosts fra utdataene til den angitte kommandoen.\n<li class=\"l\"> I ssh_config for ssh er alternativet PermitRemoteOpen lagt til, som tillater \u00e5 begrense destinasjonspunktet ved bruk av RemoteForward-alternativet med SOCKS.\n<li class=\"l\"> I ssh for FIDO keys, a request for the PIN is ensured in case of a failure in the digital signature operation due to an incorrect PIN and the absence of a PIN request from the user (for example, when it was not possible to obtain correct biometric data and the device reverted to manual PIN entry).\n<li class=\"l\"> In sshd, based on the seccomp-bpf process isolation mechanism on the Linux platform, support for additional system calls has been added.\n<li class=\"l\"> The contrib\/ssh-copy-id utility has been updated.          <\/ul>\n<p>Kilde: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=54690\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u043e\u0441\u043b\u0435 \u043f\u044f\u0442\u0438 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 OpenSSH 8.5, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430\u043c SSH 2.0 \u0438 SFTP. \u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 OpenSSH \u043d\u0430\u043f\u043e\u043c\u043d\u0438\u043b\u0438 \u043e \u0433\u0440\u044f\u0434\u0443\u0449\u0435\u043c \u043f\u0435\u0440\u0435\u0432\u043e\u0434\u0435 \u0432 \u0440\u0430\u0437\u0440\u044f\u0434 \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0438\u0445 \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c\u043e\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u0445\u0435\u0448\u0438 SHA-1, \u0432 \u0441\u0432\u044f\u0437\u0438 \u0441 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435\u043c \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u043a\u043e\u043b\u043b\u0438\u0437\u0438\u043e\u043d\u043d\u044b\u0445 \u0430\u0442\u0430\u043a \u0441 \u0437\u0430\u0434\u0430\u043d\u043d\u044b\u043c \u043f\u0440\u0435\u0444\u0438\u043a\u0441\u043e\u043c (\u0441\u0442\u043e\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0434\u0431\u043e\u0440\u0430 \u043a\u043e\u043b\u043b\u0438\u0437\u0438\u0438 \u043e\u0446\u0435\u043d\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e \u0432 50 \u0442\u044b\u0441\u044f\u0447 \u0434\u043e\u043b\u043b\u0430\u0440\u043e\u0432). \u0412 \u043e\u0434\u043d\u043e\u043c [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-99317","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.5 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u043e\u0441\u043b\u0435 \u043f\u044f\u0442\u0438 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 OpenSSH 8.5, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430\u043c SSH 2.0 \u0438 SFTP.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/no\/blog\/news\/reliz-openssh-8-5\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.5\" \/>\n\t\t<meta property=\"og:locale\" content=\"nn_NO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 OpenSSH 8.5 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u043e\u0441\u043b\u0435 \u043f\u044f\u0442\u0438 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 OpenSSH 8.5, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430\u043c SSH 2.0 \u0438 SFTP.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/no\/blog\/news\/reliz-openssh-8-5\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2021-03-03T08:22:34+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2021-03-03T08:22:34+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47OpenSSH 8.5 Release | ProHoster","description":"Etter fem m\u00e5neder med utvikling presenteres OpenSSH 8.5, en \u00e5pen implementering av klient og server for bruk med SSH 2.0- og SFTP-protokoller.","canonical_url":"https:\/\/prohoster.info\/no\/blog\/news\/reliz-openssh-8-5","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"nn_NO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 OpenSSH 8.5 | ProHoster","og:description":"\u041f\u043e\u0441\u043b\u0435 \u043f\u044f\u0442\u0438 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 OpenSSH 8.5, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430\u043c SSH 2.0 \u0438 SFTP.","og:url":"https:\/\/prohoster.info\/no\/blog\/news\/reliz-openssh-8-5","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-03-03T08:22:34+00:00","article:modified_time":"2021-03-03T08:22:34+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"99317","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-03 08:32:44","updated":"2026-02-09 21:38:09","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/posts\/99317","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/comments?post=99317"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/posts\/99317\/revisions"}],"predecessor-version":[{"id":159900,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/posts\/99317\/revisions\/159900"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/media?parent=99317"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/categories?post=99317"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/tags?post=99317"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}