{"id":123013,"date":"2025-03-26T16:22:56","date_gmt":"2025-03-26T14:22:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/kompaniya-cloudflare-opublikovala-opkssh-dlya-autentifikaczii-v-ssh-cherez-openid-connect"},"modified":"2025-03-26T16:22:56","modified_gmt":"2025-03-26T14:22:58","slug":"kompaniya-cloudflare-opublikovala-opkssh-dlya-autentifikaczii-v-ssh-cherez-openid-connect","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/kompaniya-cloudflare-opublikovala-opkssh-dlya-autentifikaczii-v-ssh-cherez-openid-connect","title":{"rendered":"Spolo\u010dnos\u0165 Cloudflare vydala opkssh na autentifik\u00e1ciu do SSH cez OpenID Connect.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Spolo\u010dnos\u0165 Cloudflare predstavila n\u00e1stroj opkssh (OpenPubkey SSH), ktor\u00fd umo\u017e\u0148uje integrova\u0165 do OpenSSH prostriedky centralizovanej autentifik\u00e1cie s mo\u017enos\u0165ou prihl\u00e1senia prostredn\u00edctvom poskytovate\u013eov OpenID Connect. Pomocou opkssh sa m\u00f4\u017eete zbavi\u0165 manu\u00e1lnej pr\u00e1ce pri spr\u00e1ve a nastaven\u00ed SSH k\u013e\u00fa\u010dov a zabezpe\u010di\u0165 pripojenie k serveru z ak\u00fdchko\u013evek hostite\u013eov, bez potreby vytv\u00e1ra\u0165 s\u00fakromn\u00e9 k\u013e\u00fa\u010de na ka\u017edom klientskom po\u010d\u00edta\u010di a bez manu\u00e1lneho kop\u00edrovania verejn\u00fdch k\u013e\u00fa\u010dov na server. Pre pripojenie sta\u010d\u00ed vykona\u0165 na serveri prepojenie na \u00fa\u010det u poskytovate\u013ea OpenID. K\u00f3d n\u00e1stroja je nap\u00edsan\u00fd v jazyku Go a je \u0161\u00edren\u00fd pod licenciou Apache 2.0. <\/p>\n

Opkssh je kompatibiln\u00fd s OpenID poskytovate\u013emi Google, Microsoft\/Azure a Gitlab, \u010do umo\u017e\u0148uje nastavi\u0165 prihl\u00e1senie prostredn\u00edctvom existuj\u00facich \u00fa\u010dtov v slu\u017eb\u00e1ch gmail.com, microsoft.com a gitlab.com. Pri pou\u017eit\u00ed opkssh namiesto neobmedzen\u00fdch \u010dasov\u00fdch SSH k\u013e\u00fa\u010dov sa generuj\u00fa do\u010dasn\u00e9 k\u013e\u00fa\u010de, ktor\u00e9 s\u00fa platn\u00e9 nieko\u013eko hod\u00edn a s\u00fa vytv\u00e1ran\u00e9 na z\u00e1klade potvrdenia od poskytovate\u013ea OpenID. \u00danik tak\u00fdchto k\u013e\u00fa\u010dov po uplynut\u00ed ich platnosti nezaprisahuje bezpe\u010dnostn\u00e9 riziko. Predvolene je \u010das platnosti k\u013e\u00fa\u010da 24 hod\u00edn, po ktor\u00fdch je potrebn\u00e9 sa znovu identifikova\u0165 cez OpenID. <\/p>\n

Integr\u00e1cia s OpenSSH je zalo\u017een\u00e1 na mo\u017enosti vytv\u00e1ra\u0165 roz\u0161\u00edrenia protokolu SSH, ktor\u00e9 umo\u017e\u0148uj\u00fa pripoji\u0165 \u013eubovo\u013en\u00e9 \u00fadaje k SSH certifik\u00e1tom. Po vykonan\u00ed autentifik\u00e1cie cez OpenID klient vytvor\u00ed verejn\u00fd k\u013e\u00fa\u010d, ktor\u00fd obsahuje PK-token potvrdzuj\u00faci priradenie k\u013e\u00fa\u010da vyhl\u00e1sen\u00e9mu pou\u017e\u00edvate\u013eovi. Token je integrovan\u00fd do protokolu SSH prostredn\u00edctvom po\u013ea s dodato\u010dn\u00fdmi \u00fadajmi SSH certifik\u00e1tu. Vytv\u00e1ranie PK-tokenov a ich overovanie na strane servera sa vykon\u00e1va s pou\u017eit\u00edm kryptografick\u00e9ho protokolu OpenPubKey. <\/p>\n

OpenPubKey umo\u017e\u0148uje generova\u0165 verejn\u00fd k\u013e\u00fa\u010d a priradi\u0165 ho k tokenu vydan\u00e9mu poskytovate\u013eom OpenID. Pomocou digit\u00e1lneho podpisu poskytovate\u013e potvrdzuje, \u017ee tento k\u013e\u00fa\u010d bol vytvoren\u00fd ozn\u00e1men\u00fdm autentifikovan\u00fdm pou\u017e\u00edvate\u013eom. Napr\u00edklad, poskytovate\u013e OpenID Google m\u00f4\u017ee potvrdi\u0165, \u017ee pou\u017e\u00edvate\u013e je autentifikovan\u00fd ako test@gmail.com. Na strane servera sa kontroluje, \u010di je prilo\u017een\u00fd token podp\u00edsan\u00fd poskytovate\u013eom OpenID a \u010di digit\u00e1lny podpis zodpoved\u00e1 ozn\u00e1men\u00e9mu verejn\u00e9mu k\u013e\u00fa\u010du, t. j. server sa m\u00f4\u017ee uisti\u0165, \u017ee verejn\u00fd k\u013e\u00fa\u010d vytvoril pr\u00e1ve pou\u017e\u00edvate\u013e test@gmail.com pre pripojen\u00e9ho SSH klienta.

\"Spolo\u010dnos\u0165<\/center> <\/p>\n

Integr\u00e1cia s OpenSSH je organizovan\u00e1 prostredn\u00edctvom zadania programu opkssh v konfigura\u010dnom s\u00fabore \u201esshd_config\u201c pomocou direkt\u00edvy \u201eAuthorizedKeysCommand\u201c (napr\u00edklad: \u201eAuthorizedKeysCommand \/usr\/local\/bin\/opkssh verify %u %k %t\u201c). Nastavenie prepojenia \u00fa\u010dtov s OpenID sa vykon\u00e1va na strane SSH servera. Na strane SSH klienta nie s\u00fa potrebn\u00e9 \u017eiadne zmeny nastavenia, ale pred prihl\u00e1sen\u00edm je potrebn\u00e9 spusti\u0165 pr\u00edkaz \u201eopkssh login\u201c a v objavenom okne prehliada\u010da vybra\u0165 poskytovate\u013ea OpenID a vykona\u0165 autentifik\u00e1ciu cez neho. <\/p>\n

N\u00e1stroj opkssh vygeneruje SSH k\u013e\u00fa\u010de a z\u00edska PK-token, ktor\u00fd potvrdzuje, \u017ee pou\u017e\u00edvate\u013e pre\u0161iel autentifik\u00e1ciou a umo\u017e\u0148uje overi\u0165, \u017ee vytvoren\u00e9 k\u013e\u00fa\u010de patria ozn\u00e1men\u00e9mu pou\u017e\u00edvate\u013eovi. Verejn\u00fd k\u013e\u00fa\u010d SSH, ku ktor\u00e9mu je cez pole s \u010fal\u0161\u00edmi \u00fadajmi pripojen\u00fd PK-token, bude zap\u00edsan\u00fd do s\u00faboru ~\/ .ssh\/id_ecdsas a za\u010dne sa pren\u00e1\u0161a\u0165 pri pripojen\u00ed k serveru<\/a> n\u00e1stroju ssh. <\/p>\n

Pripojenie na server sa vykon\u00e1va pomocou \u0161tandardn\u00e9ho pre SSH form\u00e1tu \u201essh login@server\u201c, pri\u010dom na serveri<\/a> login mus\u00ed by\u0165 predt\u00fdm overen\u00fd s \u00fa\u010dtom v OpenID, ktor\u00fd pou\u017e\u00edvate\u013e vyu\u017e\u00edva. T\u00fdmto sp\u00f4sobom fungovanie spo\u010d\u00edva v tom, \u017ee ssh klient posiela na ssh server verejn\u00fd k\u013e\u00fa\u010d a server sp\u00fa\u0161\u0165a pr\u00edkaz \u201eopkssh verify\u201c na overenie k\u013e\u00fa\u010da. <\/p>\n

Na prepojenie \u00fa\u010dtu s OpenID serverov\u00fd administr\u00e1tor vykon\u00e1va pr\u00edkaz \u201eopkssh add\u201c. Napr\u00edklad, aby sa umo\u017enil pr\u00edstup na server pod pou\u017e\u00edvate\u013eom \u201eroot\u201c s OpenID autentifik\u00e1ciou prostredn\u00edctvom \u00fa\u010dtu test@gmail.com v Gmaile, je potrebn\u00e9 vykona\u0165 \u201esudo opkssh add root test@gmail.com google\u201c, po \u010dom sa klient m\u00f4\u017ee pripoji\u0165 s parametrami tohto \u00fa\u010dtu pr\u00edkazom \u201essh root@host_servera\u201c. <\/p>\n

Prepojenie \u00fa\u010dtu je mo\u017en\u00e9 vykona\u0165 aj manu\u00e1lne cez konfigura\u010dn\u00fd s\u00fabor \/etc\/opk\/auth_id (alebo ~\/.opk\/auth_id), do ktor\u00e9ho pre vy\u0161\u0161ie uveden\u00fd pr\u00edklad bude zap\u00edsan\u00e1 l\u00ednia \u201eroot test@gmail.com https:\/\/accounts.google.com\u201c. Navy\u0161e cez s\u00fabor \/etc\/opk\/providers je mo\u017en\u00e9 definova\u0165 zoznam povolen\u00fdch poskytovate\u013eov OpenID, ich parametre a zoznam povolen\u00fdch identifik\u00e1torov klientov.

\"Spolo\u010dnos\u0165<\/center>
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cloudflare \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439 opkssh (OpenPubkey SSH), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0432 OpenSSH \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0446\u0435\u043d\u0442\u0440\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c\u044e \u0432\u0445\u043e\u0434\u0430 \u0447\u0435\u0440\u0435\u0437 \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u0432 OpenID Connect. \u041f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 opkssh \u043c\u043e\u0436\u043d\u043e \u0438\u0437\u0431\u0430\u0432\u0438\u0442\u044c\u0441\u044f \u043e\u0442 \u0440\u0443\u0447\u043d\u043e\u0439 \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044e \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 SSH-\u043a\u043b\u044e\u0447\u0435\u0439, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0443 \u0441 \u043b\u044e\u0431\u044b\u0445 \u0445\u043e\u0441\u0442\u043e\u0432, \u0431\u0435\u0437 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0437\u0430\u043a\u0440\u044b\u0442\u044b\u0445 \u043a\u043b\u044e\u0447\u0435\u0439 \u043d\u0430 \u043a\u0430\u0436\u0434\u043e\u043c \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u043e\u043c \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0435 \u0438 \u0431\u0435\u0437 \u0440\u0443\u0447\u043d\u043e\u0433\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":123014,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-123013","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Spolo\u010dnos\u0165 Cloudflare zverejnila opkssh na autentifik\u00e1ciu v SSH cez OpenID Connect | ProHoster","description":"Spolo\u010dnos\u0165 Cloudflare predstavila n\u00e1stroj opkssh (OpenPubkey SSH), ktor\u00fd umo\u017e\u0148uje integrova\u0165 do OpenSSH prostriedky centr\u00e1lnej autentifik\u00e1cie s mo\u017enos\u0165ou prihl\u00e1senia cez poskytovate\u013eov OpenID Connect.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/kompaniya-cloudflare-opublikovala-opkssh-dlya-autentifikaczii-v-ssh-cherez-openid-connect","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cloudflare \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 opkssh \u0434\u043b\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 SSH \u0447\u0435\u0440\u0435\u0437 OpenID Connect | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cloudflare \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439 opkssh (OpenPubkey SSH), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0432 OpenSSH \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0446\u0435\u043d\u0442\u0440\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c\u044e \u0432\u0445\u043e\u0434\u0430 \u0447\u0435\u0440\u0435\u0437 \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u0432 OpenID Connect.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/kompaniya-cloudflare-opublikovala-opkssh-dlya-autentifikaczii-v-ssh-cherez-openid-connect","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-03-26T14:22:58+00:00","article:modified_time":"2025-03-26T14:22:58+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"123013","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 22:07:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 11:38:16","updated":"2026-02-09 22:07:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/123013","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=123013"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/123013\/revisions"}],"predecessor-version":[{"id":160229,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/123013\/revisions\/160229"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/123014"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=123013"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=123013"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=123013"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}