{"id":101355,"date":"2021-09-21T16:22:37","date_gmt":"2021-09-21T14:22:38","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/google-opublikoval-hiba-nadstrojku-nad-openssh-dlya-avtorizaczii-na-osnove-sertifikatov"},"modified":"2021-09-21T16:22:37","modified_gmt":"2021-09-21T14:22:38","slug":"google-opublikoval-hiba-nadstrojku-nad-openssh-dlya-avtorizaczii-na-osnove-sertifikatov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/google-opublikoval-hiba-nadstrojku-nad-openssh-dlya-avtorizaczii-na-osnove-sertifikatov","title":{"rendered":"Google a publicat HIBA, un add-on pentru OpenSSH pentru autorizarea pe baza certificatelor.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Compania Google a publicat codurile surs\u0103 ale proiectului HIBA (Host Identity Based Authorization), care propune implementarea unui mecanism suplimentar de autorizare pentru organizarea accesului utilizatorilor prin SSH, legat de gazde (verific\u0103ri, dac\u0103 accesul la un anumit resurs este permis sau nu \u00een cadrul autentific\u0103rii cu chei publice). Integrarea cu OpenSSH se face prin specificarea handler-ului HIBA \u00een directiva AuthorizedPrincipalsCommand din \/etc\/ssh\/sshd_config. Codul proiectului este scris \u00een limbajul C \u0219i este distribuit sub licen\u021ba BSD. <\/p>\n

HIBA utilizeaz\u0103 mecanismele standard de autentificare bazate pe certificate OpenSSH pentru un management flexibil \u0219i centralizat al autoriz\u0103rii utilizatorilor legat de gazde, dar nu necesit\u0103 modificarea periodic\u0103 a fi\u0219ierelor authorized_keys \u0219i authorized_users pe gazdele la care se conecteaz\u0103. \u00cen loc s\u0103 p\u0103streze o list\u0103 de chei publice permise \u0219i condi\u021bii de acces \u00een fi\u0219ierele authorized_(keys|users), HIBA integreaz\u0103 informa\u021biile despre leg\u0103tura utilizatorilor cu gazdele direct \u00een certificate. \u00cen particular, sunt propuse extensii pentru certificatele gazdelor \u0219i certificatele utilizatorilor, care stocheaz\u0103 parametrii gazdelor \u0219i condi\u021biile de acordare a accesului utilizatorilor. <\/p>\n

Verificarea pe partea gazdei este ini\u021biat\u0103 prin apelarea handler-ului hiba-chk, specificat \u00een directiva AuthorizedPrincipalsCommand. Acest handler decodeaz\u0103 extensiile integrate \u00een certificate \u0219i pe baza lor ia decizia de a permite sau de a bloca accesul. Regulile de acces sunt definite centralizat la nivelul autorit\u0103\u021bii de certificare (CA) \u0219i sunt integrate \u00een certificate \u00een timpul gener\u0103rii acestora. <\/p>\n

Pe partea autorit\u0103\u021bii de certificare se men\u021bine o list\u0103 comun\u0103 a puterilor disponibile (gazde la care conectarea este permis\u0103) \u0219i o list\u0103 a utilizatorilor care au permisiunea de a utiliza aceste puteri. Pentru generarea certificatelor verificate cu informa\u021bii integrate despre puteri, este propus\u0103 utilitarul hiba-gen, iar func\u021bionalitatea necesar\u0103 pentru crearea unei autorit\u0103\u021bi de certificare a fost scoas\u0103 \u00eentr-un script iba-ca.sh. <\/p>\n

At the connection of the user, the credentials specified in the certificate are verified by the digital signature of the certification authority, allowing all checks to be performed entirely on the target host to which the connection is made, without referring to external services. The list of public keys of the certification authority that issues SSH certificates is specified through the TrustedUserCAKeys directive. <\/p>\n

In addition to directly linking users to hosts, HIBA allows for more flexible access rules. For example, information such as location and type of service can be linked to hosts, and when determining access rules for users, connections can be allowed to all hosts with a given type of service or to hosts in a specified location.

\"Google<\/center>
\"Google<\/center>
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0435 \u0442\u0435\u043a\u0441\u0442\u044b \u043f\u0440\u043e\u0435\u043a\u0442\u0430 HIBA (Host Identity Based Authorization), \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u044e\u0449\u0435\u0433\u043e \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044e \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043f\u043e SSH \u0432 \u043f\u0440\u0438\u0432\u044f\u0437\u043a\u0435 \u043a \u0445\u043e\u0441\u0442\u0430\u043c (\u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438, \u0440\u0430\u0437\u0440\u0435\u0448\u0451\u043d \u0438\u043b\u0438 \u043d\u0435\u0442 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u043c\u0443 \u0440\u0435\u0441\u0443\u0440\u0441\u0443 \u043f\u0440\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u043e \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c \u043a\u043b\u044e\u0447\u0430\u043c). \u0418\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u044f \u0441 OpenSSH \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 \u0443\u043a\u0430\u0437\u0430\u043d\u0438\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430 HIBA \u0432 \u0434\u0438\u0440\u0435\u043a\u0442\u0438\u0432\u0435 AuthorizedPrincipalsCommand \u0432 \/etc\/ssh\/sshd_config. \u041a\u043e\u0434 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u043d\u0430\u043f\u0438\u0441\u0430\u043d […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":101356,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101355","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Google published HIBA, an extension on OpenSSH for certificate-based authorization | ProHoster","description":"Google has published the source code for the HIBA (Host Identity Based Authorization) project, which offers an implementation of an additional authorization mechanism for organizing user access via SSH linked to.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/google-opublikoval-hiba-nadstrojku-nad-openssh-dlya-avtorizaczii-na-osnove-sertifikatov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Google \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b HIBA, \u043d\u0430\u0434\u0441\u0442\u0440\u043e\u0439\u043a\u0443 \u043d\u0430\u0434 OpenSSH \u0434\u043b\u044f \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0435 \u0442\u0435\u043a\u0441\u0442\u044b \u043f\u0440\u043e\u0435\u043a\u0442\u0430 HIBA (Host Identity Based Authorization), \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u044e\u0449\u0435\u0433\u043e \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044e \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043f\u043e SSH \u0432 \u043f\u0440\u0438\u0432\u044f\u0437\u043a\u0435 \u043a.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/google-opublikoval-hiba-nadstrojku-nad-openssh-dlya-avtorizaczii-na-osnove-sertifikatov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-09-21T14:22:38+00:00","article:modified_time":"2021-09-21T14:22:38+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101355","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-09-21 14:52:03","updated":"2022-10-02 02:36:14","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/101355","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=101355"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/101355\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/101356"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=101355"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=101355"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=101355"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}