Opublikowano wydanie OpenSSH 8.8, otwartej implementacji klienta i serwera do obs\u0142ugi protoko\u0142\u00f3w SSH 2.0 i SFTP. Wydanie to wyr\u00f3\u017cnia si\u0119 domy\u015blnym wy\u0142\u0105czeniem mo\u017cliwo\u015bci korzystania z podpis\u00f3w cyfrowych opartych na kluczach RSA z hashem SHA-1 («ssh-rsa»). <\/p>\n
Zaprzestanie wsparcia dla podpis\u00f3w «ssh-rsa» wynika z rosn\u0105cej skuteczno\u015bci atak\u00f3w kolizyjnych z okre\u015blonym prefiksem (koszt znalezienia kolizji szacowany jest na oko\u0142o 50 tysi\u0119cy dolar\u00f3w). Aby sprawdzi\u0107 zastosowanie ssh-rsa w swoich systemach, mo\u017cna spr\u00f3bowa\u0107 po\u0142\u0105czy\u0107 si\u0119 przez ssh z opcj\u0105 «-oHostKeyAlgorithms=-ssh-rsa». Wsparcie dla podpis\u00f3w RSA z haszami SHA-256 i SHA-512 (rsa-sha2-256\/512), kt\u00f3re s\u0105 wspierane od OpenSSH 7.2, pozosta\u0142o bez zmian. <\/p>\n
W wi\u0119kszo\u015bci przypadk\u00f3w zaprzestanie wsparcia dla «ssh-rsa» nie wymaga od u\u017cytkownik\u00f3w \u017cadnych dzia\u0142a\u0144 r\u0119cznych, poniewa\u017c w OpenSSH wcze\u015bniej domy\u015blnie w\u0142\u0105czona by\u0142a opcja UpdateHostKeys, kt\u00f3ra automatycznie przekierowuje klient\u00f3w na bardziej niezawodne algorytmy. Do migracji stosowane jest rozszerzenie protoko\u0142u «hostkeys@openssh.com», kt\u00f3re umo\u017cliwia serwera<\/a> po przej\u015bciu procesu uwierzytelnienia poinformowanie klienta o wszystkich dost\u0119pnych kluczach hosta. Przy \u0142\u0105czeniu si\u0119 z hostami maj\u0105cymi bardzo stare wersje OpenSSH po stronie klienta, mo\u017cna selektywnie przywr\u00f3ci\u0107 mo\u017cliwo\u015b\u0107 korzystania z podpis\u00f3w «ssh-rsa», dodaj\u0105c do ~\/.ssh\/config: Host nazwa_starego_hosta HostkeyAlgorithms +ssh-rsa \tPubkeyAcceptedAlgorithms +ssh-rsa <\/p>\n W nowej wersji rozwi\u0105zano r\u00f3wnie\u017c problem z bezpiecze\u0144stwem, spowodowany tym, \u017ce w sshd, pocz\u0105wszy od wersji OpenSSH 6.2, niepoprawnie inicjowano grup\u0119 u\u017cytkownika w trakcie wykonywania polece\u0144 okre\u015blonych w dyrektywach AuthorizedKeysCommand i AuthorizedPrincipalsCommand. Podane dyrektywy powinny zapewni\u0107 wykonywanie polece\u0144 jako inny u\u017cytkownik, ale w praktyce dziedziczy\u0142y one list\u0119 grup u\u017cywanych przy uruchamianiu sshd. Takie zachowanie, przy pewnych ustawieniach systemowych, potencjalnie mog\u0142o umo\u017cliwi\u0107 uruchomionemu procesowi uzyskanie dodatkowych przywilej\u00f3w w systemie. <\/p>\n W uwadze do nowego wydania opublikowano r\u00f3wnie\u017c ostrze\u017cenie o zamiarze domy\u015blnego przej\u015bcia narz\u0119dzia scp na u\u017cycie SFTP zamiast przestarza\u0142ego protoko\u0142u SCP\/RCP. SFTP wykorzystuje bardziej przewidywalne metody obs\u0142ugi nazw i nie stosuje przetwarzania wzorc\u00f3w glob w nazwach plik\u00f3w przez shell na zdalnym ho\u015bcie, co stwarza problemy z bezpiecze\u0144stwem. W szczeg\u00f3lno\u015bci, gdy stosuje si\u0119 SCP i RCP serwer<\/a> podejmuje decyzj\u0119, kt\u00f3re pliki i katalogi wys\u0142a\u0107 do klienta, a klient jedynie sprawdza poprawno\u015b\u0107 zwr\u00f3conych nazw obiekt\u00f3w, co w przypadku braku odpowiednich kontrol na stronie klienta pozwala serwerowi przes\u0142a\u0107 inne nazwy plik\u00f3w, r\u00f3\u017cni\u0105ce si\u0119 od \u017c\u0105danych. Protok\u00f3\u0142 SFTP nie ma tych problem\u00f3w, ale nie obs\u0142uguje ujawniania specjalnych \u015bcie\u017cek, takich jak «~». Aby wyeliminowa\u0107 t\u0119 r\u00f3\u017cnic\u0119, w ostatnim wydaniu OpenSSH zaproponowano nowe rozszerzenie protoko\u0142u SFTP do ujawniania \u015bcie\u017cek ~ oraz ~user\/. \u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 OpenSSH 8.8, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430\u043c SSH 2.0 \u0438 SFTP. \u0412\u044b\u043f\u0443\u0441\u043a \u043f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u0435\u043d \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435\u043c \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0446\u0438\u0444\u0440\u043e\u0432\u044b\u0445 \u043f\u043e\u0434\u043f\u0438\u0441\u0435\u0439 \u043d\u0430 \u0431\u0430\u0437\u0435 RSA-\u043a\u043b\u044e\u0447\u0435\u0439 \u0441 \u0445\u044d\u0448\u0435\u043c SHA-1 («ssh-rsa»). \u041f\u0440\u0435\u043a\u0440\u0430\u0449\u0435\u043d\u0438\u0435 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u043f\u043e\u0434\u043f\u0438\u0441\u0435\u0439 «ssh-rsa» \u043e\u0431\u0443\u0441\u043b\u043e\u0432\u043b\u0435\u043d\u043e \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435\u043c \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u043a\u043e\u043b\u043b\u0438\u0437\u0438\u043e\u043d\u043d\u044b\u0445 \u0430\u0442\u0430\u043a \u0441 \u0437\u0430\u0434\u0430\u043d\u043d\u044b\u043c \u043f\u0440\u0435\u0444\u0438\u043a\u0441\u043e\u043c (\u0441\u0442\u043e\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0434\u0431\u043e\u0440\u0430 \u043a\u043e\u043b\u043b\u0438\u0437\u0438\u0438 \u043e\u0446\u0435\u043d\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e \u0432 50 \u0442\u044b\u0441\u044f\u0447 \u0434\u043e\u043b\u043b\u0430\u0440\u043e\u0432). \u0414\u043b\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101430","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Wydanie OpenSSH 8.8 z wy\u0142\u0105czeniem wsparcia dla cyfrowych podpis\u00f3w rsa-sha | ProHoster","description":"Opublikowano wersj\u0119 OpenSSH 8.8, otwartej implementacji klienta i serwera do pracy z protoko\u0142ami SSH 2.0 i SFTP.","canonical_url":"https:\/\/prohoster.info\/pl\/blog\/news\/reliz-openssh-8-8-s-otklyucheniem-podderzhki-czifrovyh-podpisej-rsa-sha","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pl_PL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 OpenSSH 8.8 \u0441 \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435\u043c \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u0446\u0438\u0444\u0440\u043e\u0432\u044b\u0445 \u043f\u043e\u0434\u043f\u0438\u0441\u0435\u0439 rsa-sha | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 OpenSSH 8.8, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430\u043c SSH 2.0 \u0438 SFTP.","og:url":"https:\/\/prohoster.info\/pl\/blog\/news\/reliz-openssh-8-8-s-otklyucheniem-podderzhki-czifrovyh-podpisej-rsa-sha","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-09-26T20:22:36+00:00","article:modified_time":"2021-09-26T20:22:36+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101430","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-09-26 20:28:50","updated":"2026-02-09 21:42:00","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/101430","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/comments?post=101430"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/101430\/revisions"}],"predecessor-version":[{"id":172943,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/101430\/revisions\/172943"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media?parent=101430"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/categories?post=101430"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/tags?post=101430"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
\u0179r\u00f3d\u0142o: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"