{"id":101355,"date":"2021-09-21T16:22:37","date_gmt":"2021-09-21T14:22:38","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/google-opublikoval-hiba-nadstrojku-nad-openssh-dlya-avtorizaczii-na-osnove-sertifikatov"},"modified":"2021-09-21T16:22:37","modified_gmt":"2021-09-21T14:22:38","slug":"google-opublikoval-hiba-nadstrojku-nad-openssh-dlya-avtorizaczii-na-osnove-sertifikatov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/news\/google-opublikoval-hiba-nadstrojku-nad-openssh-dlya-avtorizaczii-na-osnove-sertifikatov","title":{"rendered":"O Google publicou HIBA, uma extens\u00e3o do OpenSSH para autentica\u00e7\u00e3o baseada em certificados","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

A empresa Google publicou os textos fonte do projeto HIBA (Host Identity Based Authorization), que prop\u00f5e a implementa\u00e7\u00e3o de um mecanismo adicional de autoriza\u00e7\u00e3o para gerenciar o acesso de usu\u00e1rios via SSH vinculado a hosts (verifica\u00e7\u00e3o se o acesso a um recurso espec\u00edfico \u00e9 permitido ou n\u00e3o durante a autentica\u00e7\u00e3o por chaves p\u00fablicas). A integra\u00e7\u00e3o com o OpenSSH \u00e9 garantida atrav\u00e9s da especifica\u00e7\u00e3o do manipulador HIBA na diretiva AuthorizedPrincipalsCommand em \/etc\/ssh\/sshd_config. O c\u00f3digo do projeto est\u00e1 escrito em linguagem C e \u00e9 distribu\u00eddo sob a licen\u00e7a BSD. <\/p>\n

O HIBA utiliza os mecanismos de autentica\u00e7\u00e3o baseados em certificados do OpenSSH para gerenciar de forma flex\u00edvel e centralizada a autoriza\u00e7\u00e3o de usu\u00e1rios vinculados a hosts, mas n\u00e3o requer a altera\u00e7\u00e3o peri\u00f3dica dos arquivos authorized_keys e authorized_users nos hosts aos quais se conecta. Em vez de armazenar a lista de chaves p\u00fablicas permitidas e condi\u00e7\u00f5es de acesso nos arquivos authorized_(keys|users), o HIBA integra as informa\u00e7\u00f5es sobre a vincula\u00e7\u00e3o de usu\u00e1rios a hosts diretamente nos pr\u00f3prios certificados. Em particular, s\u00e3o propostas extens\u00f5es para certificados de hosts e de usu\u00e1rios, que armazenam par\u00e2metros dos hosts e condi\u00e7\u00f5es para a concess\u00e3o de acesso aos usu\u00e1rios. <\/p>\n

A verifica\u00e7\u00e3o do lado do host \u00e9 iniciada atrav\u00e9s da chamada ao manipulador hiba-chk, definido na diretiva AuthorizedPrincipalsCommand. Este manipulador decodifica as extens\u00f5es integradas nos certificados e, com base nisso, decide sobre a concess\u00e3o ou bloqueio do acesso. As regras de acesso s\u00e3o definidas de maneira centralizada no n\u00edvel da autoridade certificadora (CA) e integradas nos certificados durante a sua gera\u00e7\u00e3o. <\/p>\n

No lado da autoridade certificadora, \u00e9 mantida uma lista comum de poderes dispon\u00edveis (hosts aos quais a conex\u00e3o \u00e9 permitida) e uma lista de usu\u00e1rios que t\u00eam permiss\u00e3o para usar esses poderes. Para a gera\u00e7\u00e3o de certificados assinados com informa\u00e7\u00f5es integradas sobre os poderes, foi proposta a ferramenta hiba-gen, e a funcionalidade necess\u00e1ria para criar a autoridade certificadora foi transferida para o script iba-ca.sh. <\/p>\n

Durante a conex\u00e3o do usu\u00e1rio, as credenciais especificadas no certificado s\u00e3o confirmadas pela assinatura digital da autoridade certificadora, permitindo que todas as verifica\u00e7\u00f5es sejam realizadas inteiramente no lado do host de destino, sem a necessidade de recorrer a servi\u00e7os externos. A lista de chaves p\u00fablicas da autoridade certificadora que emite certificados SSH \u00e9 especificada atrav\u00e9s da diretiva TrustedUserCAKeys. <\/p>\n

Al\u00e9m do v\u00ednculo direto de usu\u00e1rios a hosts, o HIBA permite definir regras de acesso mais flex\u00edveis. Por exemplo, informa\u00e7\u00f5es como localiza\u00e7\u00e3o e tipo de servi\u00e7o podem ser vinculadas aos hosts, e ao estabelecer regras de acesso dos usu\u00e1rios, \u00e9 poss\u00edvel permitir a conex\u00e3o a todos os hosts com um tipo de servi\u00e7o especificado ou a hosts em um local determinado.

\"O<\/center>
\"O<\/center>
\n
Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0435 \u0442\u0435\u043a\u0441\u0442\u044b \u043f\u0440\u043e\u0435\u043a\u0442\u0430 HIBA (Host Identity Based Authorization), \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u044e\u0449\u0435\u0433\u043e \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044e \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043f\u043e SSH \u0432 \u043f\u0440\u0438\u0432\u044f\u0437\u043a\u0435 \u043a \u0445\u043e\u0441\u0442\u0430\u043c (\u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438, \u0440\u0430\u0437\u0440\u0435\u0448\u0451\u043d \u0438\u043b\u0438 \u043d\u0435\u0442 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u043c\u0443 \u0440\u0435\u0441\u0443\u0440\u0441\u0443 \u043f\u0440\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u043e \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c \u043a\u043b\u044e\u0447\u0430\u043c). \u0418\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u044f \u0441 OpenSSH \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 \u0443\u043a\u0430\u0437\u0430\u043d\u0438\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430 HIBA \u0432 \u0434\u0438\u0440\u0435\u043a\u0442\u0438\u0432\u0435 AuthorizedPrincipalsCommand \u0432 \/etc\/ssh\/sshd_config. \u041a\u043e\u0434 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u043d\u0430\u043f\u0438\u0441\u0430\u043d […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":101356,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101355","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Google lan\u00e7ou o HIBA, uma extens\u00e3o sobre o OpenSSH para autoriza\u00e7\u00e3o baseada em certificados | ProHoster","description":"A empresa Google publicou os c\u00f3digos fonte do projeto HIBA (Host Identity Based Authorization), que prop\u00f5e a implementa\u00e7\u00e3o de um mecanismo adicional de autoriza\u00e7\u00e3o para organizar o acesso dos usu\u00e1rios via SSH com base em.","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/google-opublikoval-hiba-nadstrojku-nad-openssh-dlya-avtorizaczii-na-osnove-sertifikatov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Google \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b HIBA, \u043d\u0430\u0434\u0441\u0442\u0440\u043e\u0439\u043a\u0443 \u043d\u0430\u0434 OpenSSH \u0434\u043b\u044f \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0435 \u0442\u0435\u043a\u0441\u0442\u044b \u043f\u0440\u043e\u0435\u043a\u0442\u0430 HIBA (Host Identity Based Authorization), \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u044e\u0449\u0435\u0433\u043e \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044e \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043f\u043e SSH \u0432 \u043f\u0440\u0438\u0432\u044f\u0437\u043a\u0435 \u043a.","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/google-opublikoval-hiba-nadstrojku-nad-openssh-dlya-avtorizaczii-na-osnove-sertifikatov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-09-21T14:22:38+00:00","article:modified_time":"2021-09-21T14:22:38+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101355","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-09-21 14:52:03","updated":"2022-10-02 02:36:14","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/101355","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=101355"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/101355\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media\/101356"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=101355"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=101355"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=101355"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}