{"id":95368,"date":"2020-09-28T13:42:14","date_gmt":"2020-09-28T11:42:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/reliz-openssh-8-4"},"modified":"2020-09-28T13:42:14","modified_gmt":"2020-09-28T11:42:14","slug":"reliz-openssh-8-4","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sl\/blog\/news\/reliz-openssh-8-4","title":{"rendered":"Izdaja OpenSSH 8.4","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Po \u0161tirih mesecih razvoja <noindex><a rel=\"nofollow\" href=\"https:\/\/lists.mindrot.org\/pipermail\/openssh-unix-dev\/2020-September\/038826.html\">predstavljen<\/a><\/noindex> izdaja OpenSSH 8.4, odprte razli\u010dice odjemalca in stre\u017enika za delovanje po protokolih SSH 2.0 in SFTP.<\/p>\n<p>Glavne spremembe:<\/p>\n<ul>\n<li class=\"l\"> Spremembe, povezane z varnostjo:\n<ul>\n<li class=\"l\"> V ssh-agent je pri pou\u017eit\u00ed FIDO k\u013e\u00fa\u010dov, ktor\u00e9 neboli vytvoren\u00e9 pre autentifik\u00e1ciu cez SSH (identifik\u00e1tor k\u013e\u00fa\u010da neza\u010d\u00edna re\u0165azcom 'ssh:'), teraz vykon\u00e1van\u00e1 kontrola, \u017ee spr\u00e1va bude podpisovan\u00e1 pomocou met\u00f3d, ktor\u00e9 s\u00fa uplat\u0148ovan\u00e9 v protokole SSH. Zmena neumo\u017en\u00ed presmerovanie ssh-agent na vzdialen\u00e9 hosty, ktor\u00e9 maj\u00fa FIDO k\u013e\u00fa\u010de, aby sa zabr\u00e1nilo mo\u017enosti pou\u017e\u00edvania t\u00fdchto k\u013e\u00fa\u010dov na vytvorenie podpisov po\u017eiadaviek na webov\u00fa autentifik\u00e1ciu (opakovan\u00fd pr\u00edpad, ke\u010f m\u00f4\u017ee prehliada\u010d podp\u00edsa\u0165 po\u017eiadavku SSH, bol p\u00f4vodne vyl\u00fa\u010den\u00fd v\u010faka pou\u017e\u00edvaniu prefixu 'ssh:' v identifik\u00e1tore k\u013e\u00fa\u010da).\n<li class=\"l\"> V ssh-keygenu je ob generiranju rezidentnega klju\u010da vklju\u010dena podpora za dodatek credProtect, opisan v specifikaciji FIDO 2.1, ki zagotavlja dodatno za\u0161\u010dito za klju\u010de z obveznim zahtevkom za vnos PIN kode pred izvajanjem katere koli operacije, ki bi lahko privedla do pridobitve rezidentnega klju\u010da iz toka.\n<\/ul>\n<li class=\"l\"> Spremembe, ki lahko potencialno kr\u0161ijo zdru\u017eljivost:\n<ul>\n<li class=\"l\"> Za podporo FIDO\/U2F je priporo\u010dljivo uporabiti knji\u017enico libfido2 razli\u010dice vsaj 1.5.0. Delno je bila omogo\u010dena uporaba tudi starej\u0161ih razli\u010dic, vendar bodo v tem primeru nedostopne funkcije, kot so rezidentni klju\u010di, zahteva za PIN in povezovanje ve\u010d tokenov.\n<li class=\"l\"> V ssh-keygenu so v format potrditvenih informacij, ki se opcijsko shranjujejo ob generiranju FIDO klju\u010da, dodani podatki za avtentikator, potrebni za preverjanje potrditvenih digitalnih podpisov.\n<li class=\"l\"> API, uporabljen pri interakciji OpenSSH s plastjo za dostop do FIDO tokenov, je bil spremenjen.\n<li class=\"l\"> Pri gradnji prenosne razli\u010dice OpenSSH je zdaj potreben automake za oblikovanje konfiguracijskega skripta in spremljajo\u010dih gradbenih datotek (\u010de se gradnja izvaja iz objavljenega tar datoteke s kodo, preusmeritev konfiguracije ni potrebna).\n<\/ul>\n<li class=\"l\"> Do ssh a ssh-keygen bola pridan\u00e1 podpora FIDO k\u013e\u00fa\u010dov, ktor\u00e9 vy\u017eaduj\u00fa potvrdenie pomocou PIN k\u00f3du. Pre generovanie k\u013e\u00fa\u010dov s PIN v ssh-keygen bola pridan\u00e1 mo\u017enos\u0165 'verify-required'. V pr\u00edpade pou\u017eit\u00ed tak\u00fdchto k\u013e\u00fa\u010dov, pred vykonan\u00edm oper\u00e1cie vytv\u00e1rania podpisu sa pou\u017e\u00edvate\u013eovi zobraz\u00ed v\u00fdzva, vy\u017eaduj\u00faca potvrdenie jeho akci\u00ed zadan\u00edm PIN k\u00f3du.\n<li class=\"l\"> V sshd v nastaven\u00ed authorized_keys bola implementovan\u00e1 mo\u017enos\u0165 'verify-required', ktor\u00e1 vy\u017eaduje pou\u017eitie funkci\u00ed overovania pr\u00edtomnosti pou\u017e\u00edvate\u013ea po\u010das oper\u00e1ci\u00ed s tokenom. \u0160tandard FIDO predpoklad\u00e1 nieko\u013eko variantov tak\u00e9hoto overovania, ale v s\u00fa\u010dasnosti v OpenSSH je podporovan\u00e1 iba kontrola zalo\u017een\u00e1 na PIN k\u00f3de.\n<li class=\"l\"> V sshd in ssh-keygen je dodana podpora za preverjanje digitalnih podpisov, ki ustrezajo standardu FIDO Webauthn, kar omogo\u010da uporabo FIDO klju\u010dev v spletnih brskalnikih.\n<li class=\"l\"> V ssh v nastavitvah CertificateFile,<br \/>\n   ControlPath, IdentityAgent, IdentityFile, LocalForward in<br \/>\n   RemoteForward umo\u017e\u0148uje substit\u00faciu hodn\u00f4t z environment\u00e1lnych premenn\u00fdch, uveden\u00fdch vo form\u00e1te '${ENV}'. <\/p>\n<li class=\"l\"> V ssh in ssh-agentu je dodana podpora za okolijsko spremenljivko $SSH_ASKPASS_REQUIRE, ki jo lahko uporabite za vklju\u010ditev ali izklju\u010ditev klica ssh-askpass.\n<li class=\"l\"> V ssh v ssh_config je v direktivi AddKeysToAgent dodana mo\u017enost omejitve \u010dasa veljavnosti klju\u010da. Po preteku dolo\u010denega limita se klju\u010di samodejno izbri\u0161ejo iz ssh-agenta.\n<li class=\"l\"> V scp a sftp je teraz pomocou prep\u00edna\u010da '-A' mo\u017en\u00e9 explicitne povoli\u0165 presmerovanie v scp a sftp s pou\u017eit\u00edm ssh-agent (predvolene je presmerovanie zak\u00e1zan\u00e9).\n<li class=\"l\"> V nastaveniach ssh bola pridan\u00e1 podpora substit\u00facie '%k', ktor\u00e1 ur\u010duje n\u00e1zov k\u013e\u00fa\u010da hostite\u013ea. T\u00fato mo\u017enos\u0165 je mo\u017en\u00e9 vyu\u017ei\u0165 na rozdelenie k\u013e\u00fa\u010dov do samostatn\u00fdch s\u00faborov (napr\u00edklad 'UserKnownHostsFile ~\/.ssh\/known_hosts.d\/%k').\n<li class=\"l\"> Povolen\u00e9 je pou\u017e\u00edvanie oper\u00e1cie 'ssh-add -d -' na \u010d\u00edtanie z stdin k\u013e\u00fa\u010dov, ktor\u00e9 maj\u00fa by\u0165 odstr\u00e1nen\u00e9.\n<li class=\"l\"> V sshd je zagotavljena bele\u017eenje v dnevniku za\u010detka in konca postopka omejevanja povezav, ki ga upravlja parameter MaxStartups.\n<\/ul>\n<p>Razvijalci OpenSSH so tudi opozorili na prihajajo\u010do uvrstitev v razred zastare algoritmov, ki uporabljajo hash SHA-1, v povezavi z <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=52149\">pove\u010danjem<\/a><\/noindex> u\u010dinkovitosti kolizijskih napadov z dolo\u010denim prefixom (stro\u0161ek iskanja kolizije se ocenjuje na pribli\u017eno 45 tiso\u010d dolarjev). V eni od bli\u017enjih izdaje na\u010drtujejo, da bodo privzeto onemogo\u010dili mo\u017enost uporabe algoritma digitalnih podpisov s javnim klju\u010dem &#171;ssh-rsa&#187;, ki je omenjen v izvirnem RFC za protokol SSH in ostaja \u0161iroko raz\u0161irjen v praksi (za preverjanje uporabe ssh-rsa v svojih sistemih lahko poskusite vzpostaviti povezavo preko ssh z mo\u017enostjo &#171;-oHostKeyAlgorithms=-ssh-rsa&#187;).<\/p>\n<p>Za la\u017eje prehod na nove algoritme v OpenSSH bo v naslednji izdaji privzeto vklju\u010dena nastavitev UpdateHostKeys, ki bo omogo\u010dila samodejno preusmeritev strank na bolj zanesljive algoritme. Med priporo\u010danimi algoritmi za migracijo so omenjeni rsa-sha2-256\/512 na osnovi RFC8332 RSA SHA-2 (podprt od OpenSSH 7.2 in uporabljen privzeto), ssh-ed25519 (podprt od OpenSSH 6.5) ter ecdsa-sha2-nistp256\/384\/521 na osnovi RFC5656 ECDSA (podprt od OpenSSH 5.7). <\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Izvor: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=53793\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u043e\u0441\u043b\u0435 \u0447\u0435\u0442\u044b\u0440\u0451\u0445 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 OpenSSH 8.4, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430\u043c SSH 2.0 \u0438 SFTP. \u041e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f: \u0418\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e: \u0412 ssh-agent \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u043a\u043b\u044e\u0447\u0435\u0439 FIDO, \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u044b\u0445 \u043d\u0435 \u0434\u043b\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 SSH (\u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 \u043a\u043b\u044e\u0447\u0430 \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442\u0441\u044f \u043d\u0435 \u0441\u043e \u0441\u0442\u0440\u043e\u043a\u0438 &#171;ssh:&#187;), \u0442\u0435\u043f\u0435\u0440\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430, \u0447\u0442\u043e \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0435 \u0431\u0443\u0434\u0435\u0442 \u043f\u043e\u0434\u043f\u0438\u0441\u0430\u043d\u043e \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-95368","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u043e\u0441\u043b\u0435 \u0447\u0435\u0442\u044b\u0440\u0451\u0445 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 OpenSSH 8.4, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sl\/blog\/news\/reliz-openssh-8-4\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sl_SI\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 OpenSSH 8.4 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u043e\u0441\u043b\u0435 \u0447\u0435\u0442\u044b\u0440\u0451\u0445 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 OpenSSH 8.4, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sl\/blog\/news\/reliz-openssh-8-4\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-09-28T11:42:14+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-09-28T11:42:14+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Izdaja OpenSSH 8.4 | ProHoster","description":"Po \u0161tirih mesecih razvoja je iz\u0161la izdaja OpenSSH 8.4, odprte izvedbe.","canonical_url":"https:\/\/prohoster.info\/sl\/blog\/news\/reliz-openssh-8-4","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sl_SI","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 OpenSSH 8.4 | ProHoster","og:description":"\u041f\u043e\u0441\u043b\u0435 \u0447\u0435\u0442\u044b\u0440\u0451\u0445 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 OpenSSH 8.4, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438.","og:url":"https:\/\/prohoster.info\/sl\/blog\/news\/reliz-openssh-8-4","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-09-28T11:42:14+00:00","article:modified_time":"2020-09-28T11:42:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"95368","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 11:07:31","updated":"2022-10-03 18:22:53","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/95368","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/comments?post=95368"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/95368\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media?parent=95368"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/categories?post=95368"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/tags?post=95368"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}