{"id":95368,"date":"2020-09-28T13:42:14","date_gmt":"2020-09-28T11:42:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/reliz-openssh-8-4"},"modified":"2020-09-28T13:42:14","modified_gmt":"2020-09-28T11:42:14","slug":"reliz-openssh-8-4","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/news\/reliz-openssh-8-4","title":{"rendered":"Lan\u00e7amento do OpenSSH 8.4","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Ap\u00f3s quatro meses de desenvolvimento <noindex><a rel=\"nofollow\" href=\"https:\/\/lists.mindrot.org\/pipermail\/openssh-unix-dev\/2020-September\/038826.html\">apresentado<\/a><\/noindex> Lan\u00e7amento do OpenSSH 8.4, uma implementa\u00e7\u00e3o aberta de cliente e servidor para opera\u00e7\u00e3o com os protocolos SSH 2.0 e SFTP.<\/p>\n<p>Principais mudan\u00e7as:<\/p>\n<ul>\n<li class=\"l\"> Mudan\u00e7as relacionadas \u00e0 seguran\u00e7a:\n<ul>\n<li class=\"l\"> No ssh-agent, ao usar chaves FIDO que n\u00e3o foram criadas para autentica\u00e7\u00e3o via SSH (o identificador da chave n\u00e3o come\u00e7a com a string 'ssh:'), agora \u00e9 realizada uma verifica\u00e7\u00e3o para garantir que a mensagem ser\u00e1 assinada com os m\u00e9todos utilizados no protocolo SSH. Essa mudan\u00e7a impedir\u00e1 o redirecionamento do ssh-agent para hosts remotos com chaves FIDO, bloqueando a possibilidade de usar essas chaves para assinar solicita\u00e7\u00f5es de autentica\u00e7\u00e3o web (o caso inverso, quando o navegador pode assinar uma solicita\u00e7\u00e3o SSH, foi inicialmente exclu\u00eddo devido \u00e0 aplica\u00e7\u00e3o do prefixo 'ssh:' no identificador da chave).\n<li class=\"l\"> No ssh-keygen, ao gerar uma chave residente, foi adicionada a compatibilidade com a extens\u00e3o credProtect, descrita na especifica\u00e7\u00e3o FIDO 2.1, que fornece prote\u00e7\u00e3o adicional para chaves atrav\u00e9s da exig\u00eancia obrigat\u00f3ria de inser\u00e7\u00e3o de PIN antes de qualquer opera\u00e7\u00e3o que possa levar \u00e0 extra\u00e7\u00e3o da chave residente do token.\n<\/ul>\n<li class=\"l\"> Mudan\u00e7as que podem interromper a compatibilidade:\n<ul>\n<li class=\"l\"> Para suporte a FIDO\/U2F, \u00e9 recomendado usar a biblioteca libfido2 na vers\u00e3o 1.5.0 ou superior. Foi parcialmente implementada a capacidade de usar vers\u00f5es anteriores, mas nesse caso, recursos como chaves residentes, solicita\u00e7\u00e3o de PIN e conex\u00e3o de m\u00faltiplos tokens estar\u00e3o indispon\u00edveis.\n<li class=\"l\"> No ssh-keygen, o formato da informa\u00e7\u00e3o de confirma\u00e7\u00e3o, opcionalmente salva ao gerar a chave FIDO, agora inclui dados do autenticador necess\u00e1rios para verificar as assinaturas digitais de confirma\u00e7\u00e3o.\n<li class=\"l\"> A API utilizada na intera\u00e7\u00e3o do OpenSSH com a camada de acesso aos tokens FIDO foi alterada.\n<li class=\"l\"> Ao compilar a vers\u00e3o port\u00e1til do OpenSSH, agora \u00e9 necess\u00e1rio o automake para formar o script configure e os arquivos de compila\u00e7\u00e3o associados (se a compila\u00e7\u00e3o for feita a partir de um arquivo tar publicado com o c\u00f3digo, a regenera\u00e7\u00e3o do configure n\u00e3o \u00e9 necess\u00e1ria).\n<\/ul>\n<li class=\"l\"> No ssh e ssh-keygen, foi adicionada a suporte a chaves FIDO que requerem confirma\u00e7\u00e3o atrav\u00e9s de um c\u00f3digo PIN. Para gerar chaves com PIN no ssh-keygen, foi adicionada a op\u00e7\u00e3o 'verify-required'. Ao usar tais chaves, antes de realizar a opera\u00e7\u00e3o de assinatura, uma solicita\u00e7\u00e3o \u00e9 exibida ao usu\u00e1rio, exigindo que ele confirme sua a\u00e7\u00e3o digitando o PIN.\n<li class=\"l\"> No sshd, na configura\u00e7\u00e3o de authorized_keys, foi implementada a op\u00e7\u00e3o 'verify-required', que exige a aplica\u00e7\u00e3o de funcionalidades para verificar a presen\u00e7a do usu\u00e1rio durante opera\u00e7\u00f5es com o token. O padr\u00e3o FIDO prev\u00ea v\u00e1rias formas de verifica\u00e7\u00e3o, mas atualmente no OpenSSH apenas a verifica\u00e7\u00e3o baseada em PIN \u00e9 suportada.\n<li class=\"l\"> O sshd e o ssh-keygen agora suportam a verifica\u00e7\u00e3o de assinaturas digitais que est\u00e3o em conformidade com o padr\u00e3o FIDO Webauthn, permitindo o uso de chaves FIDO em navegadores da web.\n<li class=\"l\"> No ssh, nas configura\u00e7\u00f5es CertificateFile,<br \/>\n   ControlPath, IdentityAgent, IdentityFile, LocalForward e<br \/>\n   RemoteForward permite a substitui\u00e7\u00e3o de valores de vari\u00e1veis de ambiente indicadas no formato '${ENV}'. <\/p>\n<li class=\"l\"> No ssh e ssh-agent, foi adicionada a vari\u00e1vel de ambiente $SSH_ASKPASS_REQUIRE, que pode ser usada para habilitar ou desabilitar a chamada do ssh-askpass.\n<li class=\"l\"> No ssh, na configura\u00e7\u00e3o ssh_config, na diretiva AddKeysToAgent, foi adicionada a possibilidade de limitar a dura\u00e7\u00e3o da chave. Ap\u00f3s o prazo definido, as chaves s\u00e3o automaticamente removidas do ssh-agent.\n<li class=\"l\"> No scp e sftp, agora \u00e9 poss\u00edvel, usando a flag '-A', habilitar explicitamente o redirecionamento no scp e sftp com o ssh-agent (por padr\u00e3o, o redirecionamento \u00e9 desabilitado).\n<li class=\"l\"> Nas configura\u00e7\u00f5es do ssh, foi adicionada a suporte para a substitui\u00e7\u00e3o '%k', que determina o nome da chave do host. Essa funcionalidade pode ser utilizada para distribuir chaves em arquivos separados (por exemplo, 'UserKnownHostsFile ~\/.ssh\/known_hosts.d\/%k').\n<li class=\"l\"> \u00c9 permitido usar a opera\u00e7\u00e3o 'ssh-add -d -' para ler do stdin chaves que devem ser removidas.\n<li class=\"l\"> No sshd, foi implementado o registro em log do in\u00edcio e t\u00e9rmino do processo de limita\u00e7\u00e3o de conex\u00f5es, controlado pelo par\u00e2metro MaxStartups.\n<\/ul>\n<p>Os desenvolvedores do OpenSSH tamb\u00e9m lembraram sobre a iminente descontinua\u00e7\u00e3o dos algoritmos que utilizam hashes SHA-1, devido a <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=52149\">aumento<\/a><\/noindex> a efic\u00e1cia dos ataques de colis\u00e3o com um prefixo definido (o custo de encontrar uma colis\u00e3o \u00e9 estimado em cerca de 45 mil d\u00f3lares). Uma das pr\u00f3ximas vers\u00f5es planeja desativar por padr\u00e3o a possibilidade de usar o algoritmo de assinatura digital de chave p\u00fablica &#171;ssh-rsa&#187;, que \u00e9 mencionado no RFC original para o protocolo SSH e continua amplamente utilizado na pr\u00e1tica (para verificar a aplica\u00e7\u00e3o do ssh-rsa em seus sistemas, voc\u00ea pode tentar se conectar via ssh com a op\u00e7\u00e3o &#171;-oHostKeyAlgorithms=-ssh-rsa&#187;).<\/p>\n<p>Para suavizar a transi\u00e7\u00e3o para novos algoritmos no OpenSSH, na pr\u00f3xima vers\u00e3o, a configura\u00e7\u00e3o UpdateHostKeys ser\u00e1 ativada por padr\u00e3o, permitindo que os clientes sejam automaticamente migrados para algoritmos mais seguros. Entre os algoritmos recomendados para migra\u00e7\u00e3o est\u00e3o rsa-sha2-256\/512 baseado na RFC8332 RSA SHA-2 (suportado desde o OpenSSH 7.2 e utilizado por padr\u00e3o), ssh-ed25519 (suportado desde o OpenSSH 6.5) e ecdsa-sha2-nistp256\/384\/521 baseado na RFC5656 ECDSA (suportado desde o OpenSSH 5.7). <\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Fonte: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=53793\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u043e\u0441\u043b\u0435 \u0447\u0435\u0442\u044b\u0440\u0451\u0445 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 OpenSSH 8.4, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430\u043c SSH 2.0 \u0438 SFTP. \u041e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f: \u0418\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e: \u0412 ssh-agent \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u043a\u043b\u044e\u0447\u0435\u0439 FIDO, \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u044b\u0445 \u043d\u0435 \u0434\u043b\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 SSH (\u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 \u043a\u043b\u044e\u0447\u0430 \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442\u0441\u044f \u043d\u0435 \u0441\u043e \u0441\u0442\u0440\u043e\u043a\u0438 &#171;ssh:&#187;), \u0442\u0435\u043f\u0435\u0440\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430, \u0447\u0442\u043e \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0435 \u0431\u0443\u0434\u0435\u0442 \u043f\u043e\u0434\u043f\u0438\u0441\u0430\u043d\u043e \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-95368","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u043e\u0441\u043b\u0435 \u0447\u0435\u0442\u044b\u0440\u0451\u0445 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 OpenSSH 8.4, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/pt\/blog\/news\/reliz-openssh-8-4\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"pt_PT\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 OpenSSH 8.4 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u043e\u0441\u043b\u0435 \u0447\u0435\u0442\u044b\u0440\u0451\u0445 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 OpenSSH 8.4, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/pt\/blog\/news\/reliz-openssh-8-4\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-09-28T11:42:14+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-09-28T11:42:14+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Lan\u00e7amento do OpenSSH 8.4 | ProHoster","description":"Ap\u00f3s quatro meses de desenvolvimento, foi lan\u00e7ado o OpenSSH 8.4, uma implementa\u00e7\u00e3o de c\u00f3digo aberto.","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/reliz-openssh-8-4","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 OpenSSH 8.4 | ProHoster","og:description":"\u041f\u043e\u0441\u043b\u0435 \u0447\u0435\u0442\u044b\u0440\u0451\u0445 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 OpenSSH 8.4, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438.","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/reliz-openssh-8-4","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-09-28T11:42:14+00:00","article:modified_time":"2020-09-28T11:42:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"95368","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 11:07:31","updated":"2022-10-03 18:22:53","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/95368","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=95368"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/95368\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=95368"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=95368"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=95368"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}