{"id":101355,"date":"2021-09-21T16:22:37","date_gmt":"2021-09-21T14:22:38","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/google-opublikoval-hiba-nadstrojku-nad-openssh-dlya-avtorizaczii-na-osnove-sertifikatov"},"modified":"2021-09-21T16:22:37","modified_gmt":"2021-09-21T14:22:38","slug":"google-opublikoval-hiba-nadstrojku-nad-openssh-dlya-avtorizaczii-na-osnove-sertifikatov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/google-opublikoval-hiba-nadstrojku-nad-openssh-dlya-avtorizaczii-na-osnove-sertifikatov","title":{"rendered":"Google zverejnil HIBA, nadstavbu nad OpenSSH pre autoriz\u00e1ciu na z\u00e1klade certifik\u00e1tov","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Spolo\u010dnos\u0165 Google zverejnila zdrojov\u00e9 texty projektu HIBA (Host Identity Based Authorization), ktor\u00fd pon\u00faka implement\u00e1ciu dodato\u010dn\u00e9ho mechanizmu autoriz\u00e1cie na organizovanie pr\u00edstupu pou\u017e\u00edvate\u013eov cez SSH viazan\u00edm na hostite\u013eov (overovanie, \u010di je pr\u00edstup k ur\u010dit\u00e9mu zdroju povolen\u00fd alebo nie pri autentifik\u00e1cii pomocou verejn\u00fdch k\u013e\u00fa\u010dov). Integr\u00e1cia s OpenSSH je zabezpe\u010den\u00e1 prostredn\u00edctvom ur\u010denia spracovate\u013ea HIBA v direkt\u00edve AuthorizedPrincipalsCommand v \/etc\/ssh\/sshd_config. K\u00f3d projektu je nap\u00edsan\u00fd v jazyku C a je distribuovan\u00fd pod licenciou BSD. <\/p>\n

HIBA vyu\u017e\u00edva \u0161tandardn\u00e9 mechanizmy autentifik\u00e1cie zalo\u017een\u00e9 na certifik\u00e1toch OpenSSH na flexibiln\u00e9 a centralizovan\u00e9 riadenie autoriz\u00e1cie pou\u017e\u00edvate\u013eov viazanej na hostite\u013eov, nevy\u017eaduje v\u0161ak periodick\u00fa zmenu s\u00faborov authorized_keys a authorized_users na strane hostite\u013eov, ku ktor\u00fdm sa prip\u00e1ja. Namiesto ukladania zoznamu povolen\u00fdch verejn\u00fdch k\u013e\u00fa\u010dov a podmienok pr\u00edstupu v s\u00faboroch authorized_(keys|users) HIBA integruje inform\u00e1cie o viazan\u00ed pou\u017e\u00edvate\u013eov na hostite\u013eov priamo do samotn\u00fdch certifik\u00e1tov. Mimo in\u00e9ho s\u00fa navrhnut\u00e9 roz\u0161\u00edrenia pre certifik\u00e1ty hostite\u013eov a certifik\u00e1ty pou\u017e\u00edvate\u013eov, v ktor\u00fdch s\u00fa ulo\u017een\u00e9 parametre hostite\u013eov a podmienky poskytovania pr\u00edstupu pou\u017e\u00edvate\u013eov. <\/p>\n

Overenie na strane hostite\u013ea sa iniciuje prostredn\u00edctvom volania spracovate\u013ea hiba-chk, ktor\u00fd je ur\u010den\u00fd v direkt\u00edve AuthorizedPrincipalsCommand. Tento spracovate\u013e dek\u00f3duje integrovan\u00e9 roz\u0161\u00edrenia v certifik\u00e1toch a na ich z\u00e1klade rozhoduje o poskytnut\u00ed alebo blokovan\u00ed pr\u00edstupu. Pravidl\u00e1 pr\u00edstupu s\u00fa definovan\u00e9 centralizovane na \u00farovni certifika\u010dn\u00e9ho \u00faradu (CA) a integruj\u00fa sa do certifik\u00e1tov v etape ich generovania. <\/p>\n

Na strane certifika\u010dn\u00e9ho \u00faradu sa vedie spolo\u010dn\u00fd zoznam dostupn\u00fdch opr\u00e1vnen\u00ed (hostite\u013eov, ku ktor\u00fdm je povolen\u00e9 pripojenie) a zoznam pou\u017e\u00edvate\u013eov, ktor\u00fdm je povolen\u00e9 vyu\u017e\u00edva\u0165 tieto opr\u00e1vnenia. Pre generovanie osved\u010den\u00fdch certifik\u00e1tov s integrovan\u00fdmi inform\u00e1ciami o opr\u00e1vneniach je navrhnut\u00fd n\u00e1stroj hiba-gen, a funkcionalita potrebn\u00e1 na vytvorenie certifika\u010dn\u00e9ho \u00faradu je zahrnut\u00e1 v skripte iba-ca.sh. <\/p>\n

Pri pripojen\u00ed pou\u017e\u00edvate\u013ea sa opr\u00e1vnenia uveden\u00e9 v certifik\u00e1te overuj\u00fa digit\u00e1lnym podpisom certifika\u010dnej autority, \u010do umo\u017e\u0148uje vykona\u0165 v\u0161etky kontroly \u00faplne na strane cie\u013eov\u00e9ho hostite\u013ea, ku ktor\u00e9mu sa pripojujete, bez kontaktovania vonkaj\u0161\u00edch slu\u017eieb. Zoznam verejn\u00fdch k\u013e\u00fa\u010dov certifika\u010dnej autority, ktor\u00e1 osved\u010duje SSH certifik\u00e1ty, sa uv\u00e1dza pomocou direkt\u00edvy TrustedUserCAKeys. <\/p>\n

Okrem priameho prepojenia pou\u017e\u00edvate\u013eov na hostite\u013eov, HIBA umo\u017e\u0148uje definova\u0165 flexibilnej\u0161ie pravidl\u00e1 pr\u00edstupu. Napr\u00edklad, k hostite\u013eom je mo\u017en\u00e9 priradi\u0165 inform\u00e1cie ako poloha a typ slu\u017eby, a pri definovan\u00ed pravidiel pr\u00edstupu pou\u017e\u00edvate\u013eov povoli\u0165 pripojenie ku v\u0161etk\u00fdm hostite\u013eom s dan\u00fdm typom slu\u017eby alebo k hostite\u013eom na ur\u010denom mieste.

\"Google<\/center>
\"Google<\/center>
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0435 \u0442\u0435\u043a\u0441\u0442\u044b \u043f\u0440\u043e\u0435\u043a\u0442\u0430 HIBA (Host Identity Based Authorization), \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u044e\u0449\u0435\u0433\u043e \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044e \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043f\u043e SSH \u0432 \u043f\u0440\u0438\u0432\u044f\u0437\u043a\u0435 \u043a \u0445\u043e\u0441\u0442\u0430\u043c (\u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438, \u0440\u0430\u0437\u0440\u0435\u0448\u0451\u043d \u0438\u043b\u0438 \u043d\u0435\u0442 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u043c\u0443 \u0440\u0435\u0441\u0443\u0440\u0441\u0443 \u043f\u0440\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u043e \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c \u043a\u043b\u044e\u0447\u0430\u043c). \u0418\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u044f \u0441 OpenSSH \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 \u0443\u043a\u0430\u0437\u0430\u043d\u0438\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430 HIBA \u0432 \u0434\u0438\u0440\u0435\u043a\u0442\u0438\u0432\u0435 AuthorizedPrincipalsCommand \u0432 \/etc\/ssh\/sshd_config. \u041a\u043e\u0434 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u043d\u0430\u043f\u0438\u0441\u0430\u043d […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":101356,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101355","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Google zverejnil HIBA, roz\u0161\u00edrenie nad OpenSSH pre autoriz\u00e1ciu na z\u00e1klade certifik\u00e1tov | ProHoster","description":"Spolo\u010dnos\u0165 Google zverejnila zdrojov\u00e9 k\u00f3dy projektu HIBA (Host Identity Based Authorization), ktor\u00fd pon\u00faka implement\u00e1ciu dodato\u010dn\u00e9ho mechanizmu autoriz\u00e1cie na organizovanie pr\u00edstupu pou\u017e\u00edvate\u013eov cez SSH na z\u00e1klade.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/google-opublikoval-hiba-nadstrojku-nad-openssh-dlya-avtorizaczii-na-osnove-sertifikatov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Google \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b HIBA, \u043d\u0430\u0434\u0441\u0442\u0440\u043e\u0439\u043a\u0443 \u043d\u0430\u0434 OpenSSH \u0434\u043b\u044f \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0435 \u0442\u0435\u043a\u0441\u0442\u044b \u043f\u0440\u043e\u0435\u043a\u0442\u0430 HIBA (Host Identity Based Authorization), \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u044e\u0449\u0435\u0433\u043e \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044e \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043f\u043e SSH \u0432 \u043f\u0440\u0438\u0432\u044f\u0437\u043a\u0435 \u043a.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/google-opublikoval-hiba-nadstrojku-nad-openssh-dlya-avtorizaczii-na-osnove-sertifikatov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-09-21T14:22:38+00:00","article:modified_time":"2021-09-21T14:22:38+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101355","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-09-21 14:52:03","updated":"2022-10-02 02:36:14","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/101355","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=101355"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/101355\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/101356"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=101355"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=101355"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=101355"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}