{"id":95368,"date":"2020-09-28T13:42:14","date_gmt":"2020-09-28T11:42:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/reliz-openssh-8-4"},"modified":"2020-09-28T13:42:14","modified_gmt":"2020-09-28T11:42:14","slug":"reliz-openssh-8-4","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/reliz-openssh-8-4","title":{"rendered":"Lansarea OpenSSH 8.4","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Dup\u0103 patru luni de dezvoltare <noindex><a rel=\"nofollow\" href=\"https:\/\/lists.mindrot.org\/pipermail\/openssh-unix-dev\/2020-September\/038826.html\">la sf\u00e2r\u0219itul anului 2019. Pe l\u00e2ng\u0103 protocoalele ActivityPub \u0219i diaspora, Hubzilla se federeaz\u0103 \u00een cadrul re\u021belei prin propriul s\u0103u protocol<\/a><\/noindex> lansarea OpenSSH 8.4, o implementare deschis\u0103 a clientului \u0219i serverului pentru lucrul cu protocoalele SSH 2.0 \u0219i SFTP.<\/p>\n<p>Modific\u0103ri principale:<\/p>\n<ul>\n<li class=\"l\"> Modific\u0103ri legate de securitate:\n<ul>\n<li class=\"l\"> \u00cen ssh-agent, c\u00e2nd se utilizeaz\u0103 chei FIDO create pentru a nu autentifica prin SSH (identificatorul cheii nu \u00eencepe cu &#171;ssh:&#187;), acum se verific\u0103 c\u0103 mesajul va fi semnat folosind metodele aplicate \u00een protocolul SSH. Aceast\u0103 modificare va \u00eempiedica redirec\u021bionarea ssh-agent c\u0103tre gazde remote care au chei FIDO, bloc\u00e2nd utilizarea acestor chei pentru a genera semn\u0103turi de cereri pentru autentificarea web (cazul invers, c\u00e2nd browserul poate semna o cerere SSH, a fost ini\u021bial exclus, datorit\u0103 aplic\u0103rii prefixului &#171;ssh:&#187; \u00een identificatorul cheii).\n<li class=\"l\"> \u00cen ssh-keygen, la generarea unei chei rezidente, a fost inclus\u0103 suportul pentru extensia credProtect, descris\u0103 \u00een specifica\u021bia FIDO 2.1, care ofer\u0103 o protec\u021bie suplimentar\u0103 pentru chei printr-o solicitare obligatorie de introducere a unui cod PIN \u00eenainte de a efectua orice opera\u021biune care ar putea duce la extragerea cheii rezidente din token.\n<\/ul>\n<li class=\"l\"> Modific\u0103ri care ar putea afecta compatibilitatea:\n<ul>\n<li class=\"l\"> Pentru suport FIDO\/U2F, se recomand\u0103 utilizarea bibliotecii libfido2 de cel pu\u021bin versiunea 1.5.0. Este implementat\u0103 par\u021bial posibilitatea de a utiliza \u0219i versiuni anterioare, dar \u00een acest caz vor fi indisponibile func\u021bii precum cheile rezidente, solicitarea PIN \u0219i conectarea mai multor tokenuri.\n<li class=\"l\"> \u00cen ssh-keygen, \u00een formatul informa\u021biei de confirmare, op\u021bional p\u0103strat la generarea cheii FIDO, au fost ad\u0103ugate date pentru autentificator, necesare pentru verificarea semn\u0103turilor digitale de confirmare.\n<li class=\"l\"> API-ul utilizat pentru interac\u021biunea OpenSSH cu stratul pentru accesarea tokenurilor FIDO a fost modificat.\n<li class=\"l\"> La compilarea versiunii portabile a OpenSSH, acum este necesar automake pentru a genera scriptul configure \u0219i fi\u0219ierele de compilare asociate (dac\u0103 compilarea este efectuat\u0103 dintr-un fi\u0219ier tar publicat cu cod, regenerarea configure nu este necesar\u0103).\n<\/ul>\n<li class=\"l\"> \u00cen ssh \u0219i ssh-keygen a fost ad\u0103ugat\u0103 suportul pentru cheile FIDO care necesit\u0103 confirmare prin PIN. Pentru generarea cheilor cu PIN, ssh-keygen a fost ad\u0103ugat op\u021biunea &#171;verify-required&#187;. \u00cen cazul utiliz\u0103rii unor astfel de chei, \u00eenainte de a efectua opera\u021bia de creare a semn\u0103turii, utilizatorul va primi o solicitare care cere confirmarea ac\u021biunilor prin introducerea PIN-ului.\n<li class=\"l\"> \u00cen sshd, \u00een configurarea authorized_keys a fost implementat\u0103 op\u021biunea &#171;verify-required&#187;, care necesit\u0103 aplicarea verific\u0103rii prezen\u021bei utilizatorului \u00een timpul opera\u021biunilor cu tokenul. Standardul FIDO prevede mai multe op\u021biuni pentru o astfel de verificare, dar \u00een prezent, \u00een OpenSSH, este suportat\u0103 doar verificarea bazat\u0103 pe PIN.\n<li class=\"l\"> \u00cen sshd \u0219i ssh-keygen a fost ad\u0103ugat\u0103 suport pentru verificarea semn\u0103turilor digitale care corespund standardului FIDO Webauthn, permi\u021b\u00e2nd utilizarea cheilor FIDO \u00een browserele web.\n<li class=\"l\"> \u00cen ssh, \u00een set\u0103rile CertificateFile,<br \/>\n   ControlPath, IdentityAgent, IdentityFile, LocalForward \u0219i<br \/>\n   RemoteForward permite substituirea valorilor din variabilele de mediu, specificate \u00een formatul &#171;${ENV}&#187;. <\/p>\n<li class=\"l\"> \u00cen ssh \u0219i ssh-agent a fost ad\u0103ugat suport pentru variabila de mediu $SSH_ASKPASS_REQUIRE, care poate fi utilizat\u0103 pentru a activa sau dezactiva apelul ssh-askpass.\n<li class=\"l\"> \u00cen ssh, \u00een ssh_config, \u00een directiva AddKeysToAgent a fost ad\u0103ugat\u0103 posibilitatea de a limita durata de valabilitate a cheii. Dup\u0103 expirarea limitei specificate, cheile sunt \u0219terse automat din ssh-agent.\n<li class=\"l\"> \u00cen scp \u0219i sftp, prin utilizarea flagului &#171;-A&#187; poate fi permis\u0103 explicit redirec\u021bionarea \u00een scp \u0219i sftp folosind ssh-agent (de obicei, redirec\u021bionarea este interzis\u0103).\n<li class=\"l\"> \u00cen set\u0103rile ssh a fost ad\u0103ugat\u0103 suportul pentru substituirea &#8216;%k&#8217;, care define\u0219te numele cheii gazdei. Aceast\u0103 capacitate poate fi utilizat\u0103 pentru a separa cheile \u00een fi\u0219iere diferite (de exemplu, &#171;UserKnownHostsFile ~\\\/ .ssh\\\/known_hosts.d\\\/ %k&#187;).\n<li class=\"l\"> Este permis\u0103 utilizarea opera\u021biei &#171;ssh-add -d -&#187; pentru a citi din stdin cheile care urmeaz\u0103 s\u0103 fie eliminate.\n<li class=\"l\"> \u00cen sshd, a fost asigurat\u0103 reflectarea \u00een jurnal a \u00eenceputului \u0219i sf\u00e2r\u0219itului procesului de restr\u00e2ngere a conexiunilor, reglat prin parametrul MaxStartups.\n<\/ul>\n<p>Dezvoltatorii OpenSSH au reamintit, de asemenea, despre viitorul transfer al algoritmilor care folosesc hash-uri SHA-1 \u00een categoria celor \u00eenvechite, \u00een leg\u0103tur\u0103 cu <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=52149\">cre\u0219terea<\/a><\/noindex> eficien\u021ba atacurilor de coliziune cu un prefix dat (costul determin\u0103rii unei coliziuni este estimat la aproximativ 45.000 de dolari). \u00cen una dintre urm\u0103toarele versiuni, se preconizeaz\u0103 dezactivarea, implicit, a utiliz\u0103rii algoritmului de semn\u0103tur\u0103 digital\u0103 bazat pe cheie public\u0103 \u201essh-rsa\u201d, men\u021bionat \u00een RFC original pentru protocolul SSH \u0219i care r\u0103m\u00e2ne pe scar\u0103 larg\u0103 folosit \u00een practic\u0103 (pentru a verifica utilizarea ssh-rsa \u00een sistemele proprii, se poate \u00eencerca conectarea prin ssh cu op\u021biunea \u201e-oHostKeyAlgorithms=-ssh-rsa\u201d).<\/p>\n<p>Pentru a facilita tranzi\u021bia la noile algoritmi \u00een OpenSSH, \u00een urm\u0103toarea versiune va fi activat\u0103 implicit configura\u021bia UpdateHostKeys, care va permite clien\u021bilor s\u0103 treac\u0103 automat la algoritmi mai siguri. Printre algoritmii recomanda\u021bi pentru migrare se num\u0103r\u0103 rsa-sha2-256\/512 bazat pe RFC8332 RSA SHA-2 (acceptat din OpenSSH 7.2 \u0219i utilizat implicit), ssh-ed25519 (acceptat din OpenSSH 6.5) \u0219i ecdsa-sha2-nistp256\/384\/521 bazat pe RFC5656 ECDSA (acceptat din OpenSSH 5.7). <\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Sursa: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=53793\">opennet.ro<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u043e\u0441\u043b\u0435 \u0447\u0435\u0442\u044b\u0440\u0451\u0445 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 OpenSSH 8.4, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430\u043c SSH 2.0 \u0438 SFTP. \u041e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f: \u0418\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e: \u0412 ssh-agent \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u043a\u043b\u044e\u0447\u0435\u0439 FIDO, \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u044b\u0445 \u043d\u0435 \u0434\u043b\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 SSH (\u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 \u043a\u043b\u044e\u0447\u0430 \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442\u0441\u044f \u043d\u0435 \u0441\u043e \u0441\u0442\u0440\u043e\u043a\u0438 &#171;ssh:&#187;), \u0442\u0435\u043f\u0435\u0440\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430, \u0447\u0442\u043e \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0435 \u0431\u0443\u0434\u0435\u0442 \u043f\u043e\u0434\u043f\u0438\u0441\u0430\u043d\u043e \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-95368","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u043e\u0441\u043b\u0435 \u0447\u0435\u0442\u044b\u0440\u0451\u0445 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 OpenSSH 8.4, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/news\/reliz-openssh-8-4\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 OpenSSH 8.4 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u043e\u0441\u043b\u0435 \u0447\u0435\u0442\u044b\u0440\u0451\u0445 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 OpenSSH 8.4, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/news\/reliz-openssh-8-4\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-09-28T11:42:14+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-09-28T11:42:14+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Lansarea OpenSSH 8.4 | ProHoster","description":"Dup\u0103 patru luni de dezvoltare, a fost lansat\u0103 versiunea OpenSSH 8.4, o implementare deschis\u0103.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/reliz-openssh-8-4","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 OpenSSH 8.4 | ProHoster","og:description":"\u041f\u043e\u0441\u043b\u0435 \u0447\u0435\u0442\u044b\u0440\u0451\u0445 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 OpenSSH 8.4, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/reliz-openssh-8-4","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-09-28T11:42:14+00:00","article:modified_time":"2020-09-28T11:42:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"95368","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 11:07:31","updated":"2022-10-03 18:22:53","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/95368","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=95368"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/95368\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=95368"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=95368"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=95368"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}