{"id":101069,"date":"2021-08-20T22:22:44","date_gmt":"2021-08-20T20:22:44","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/reliz-openssh-8-7"},"modified":"2021-08-20T22:22:44","modified_gmt":"2021-08-20T20:22:44","slug":"reliz-openssh-8-7","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/reliz-openssh-8-7","title":{"rendered":"L\u00ebshimi i OpenSSH 8.7","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Pas nj\u00eb periudh\u00eb kat\u00ebrmujore zhvillimi, \u00ebsht\u00eb publikuar versi i OpenSSH 8.7, implementimi i hapur i klientit dhe serverit p\u00ebr pun\u00eb me protokollet SSH 2.0 dhe SFTP. <\/p>\n
Ndryshimet kryesore: <\/p>\n
\n
N\u00eb scp \u00ebsht\u00eb shtuar nj\u00eb m\u00ebnyr\u00eb eksperimentale transferimi t\u00eb t\u00eb dh\u00ebnave duke p\u00ebrdorur protokollin SFTP n\u00eb vend t\u00eb protokollit tradicional SCP\/RCP. N\u00eb SFTP p\u00ebrdoren metoda m\u00eb t\u00eb parashikueshme p\u00ebr p\u00ebrpunimin e emrave dhe nuk p\u00ebrdoret p\u00ebrpunimi i modeleve glob nga shell-i n\u00eb an\u00ebn e hostit tjet\u00ebr, i cili krijon probleme me sigurin\u00eb. P\u00ebr t\u00eb aktivizuar SFTP n\u00eb scp \u00ebsht\u00eb propozuar flag-u \u00ab-s\u00bb, por n\u00eb t\u00eb ardhmen planifikohet kalimi n\u00eb k\u00ebt\u00eb protokoll si parazgjedhje.\n
N\u00eb sftp-server jan\u00eb realizuar zgjerimet e protokollit SFTP p\u00ebr zbuluar rrug\u00ebt ~\/ dhe ~user\/, t\u00eb cilat jan\u00eb t\u00eb nevojshme p\u00ebr scp.\n
N\u00eb utilitarin scp \u00ebsht\u00eb ndryshuar sjellja gjat\u00eb kopjimit t\u00eb skedareve mes dy hosteve t\u00eb larg\u00ebt (p.sh., \u00abscp host-a:\/path host-b:\u00bb), e cila tani kryhet si parazgjedhje p\u00ebrmes nj\u00eb hosti lokal nd\u00ebrmjet\u00ebs, ashtu si\u00e7 \u00ebsht\u00eb specifikuar me flag-un \u00ab-3\u00bb. Ky qasje lejon shmangien e transmetimit t\u00eb t\u00eb dh\u00ebnave t\u00eb panevojshme n\u00eb hostin e par\u00eb dhe interpretimin e trefisht\u00eb t\u00eb emrave t\u00eb skedareve n\u00eb shell (n\u00eb an\u00ebn e burimit, pranuesit dhe sistemit lokal), si dhe duke p\u00ebrdorur SFTP mund t\u00eb p\u00ebrdoren t\u00eb gjitha metodat e autentikimit kur lidhen me hoste t\u00eb larg\u00ebt, dhe jo vet\u00ebm metodat jo-interaktive. P\u00ebr rikthimin e sjelljes s\u00eb m\u00ebparshme \u00ebsht\u00eb shtuar opsioni \u00ab-R\u00bb.\n
N\u00eb ssh \u00ebsht\u00eb shtuar parametrimi ForkAfterAuthentication, i cili i p\u00ebrgjigjet flag-ut \u00ab-f\u00bb.\n
N\u00eb ssh \u00ebsht\u00eb shtuar parametrimi StdinNull, i cili i p\u00ebrgjigjet flag-ut \u00ab-n\u00bb.\n
N\u00eb ssh \u00ebsht\u00eb shtuar parametrimi SessionType, p\u00ebrmes t\u00eb cilit mund t\u00eb vendosen modus q\u00eb i p\u00ebrgjigjen flag-\u00ebve \u00ab-N\u00bb (pa sesion) dhe \u00ab-s\u00bb (subsystem).\n
N\u00eb ssh-keygen n\u00eb skedar\u00ebt e \u00e7el\u00ebsave \u00ebsht\u00eb lejuar tregimi i intervalit t\u00eb vlefshm\u00ebris\u00eb s\u00eb \u00e7el\u00ebsit.\n
N\u00eb ssh-keygen \u00ebsht\u00eb shtuar flag-u \u00ab-Oprint-pubkey\u00bb p\u00ebr t\u00eb nxjerr\u00eb \u00e7el\u00ebsin e plot\u00eb publik si pjes\u00eb e n\u00ebnshkrimit sshsig.\n
N\u00eb ssh dhe sshd, si klienti ashtu edhe serveri, jan\u00eb kaluar n\u00eb p\u00ebrdorimin e nj\u00eb parser-i m\u00eb t\u00eb rrept\u00eb t\u00eb skedarit t\u00eb konfigurimit, n\u00eb t\u00eb cilin p\u00ebrdoren rregulla t\u00eb ngjashme me ato t\u00eb shell-it p\u00ebr p\u00ebrpunimin e thonj\u00ebzave, hap\u00ebsirave dhe simboleve t\u00eb sh\u00ebnjestrimit. Parser-i i ri gjithashtu nuk do t\u00eb pranoj\u00eb supozime t\u00eb m\u00ebparshme, si\u00e7 \u00ebsht\u00eb l\u00ebnia e argumenteve bosh n\u00eb opsione (p.sh., tani s\u2019lejohet t\u00eb lini direktiv\u00ebn e zbrazur DenyUsers), thonj\u00ebza t\u00eb pambyllura dhe specifikimin e disa simboleve \u00ab=\u00bb.\n
Kur p\u00ebrdoren rekordet DNS SSHFP p\u00ebr verifikimin e \u00e7el\u00ebsave, ssh tani kontrollon t\u00eb gjitha rekordet e ndeshura, jo vet\u00ebm ato q\u00eb kan\u00eb nj\u00eb lloj t\u00eb caktuar digjital t\u00eb n\u00ebnshkrimit.\n
N\u00eb ssh-keygen, kur gjenerohet \u00e7el\u00ebsi FIDO me opsionin -Ochallenge p\u00ebr hashimin, tani p\u00ebrdoret nj\u00eb nd\u00ebrfaqe e nd\u00ebrthurur, jo mjetet libfido2, duke lejuar p\u00ebrdorimin e sekuencave challenge m\u00eb t\u00eb m\u00ebdha ose m\u00eb t\u00eb vogla se 32 byte.\n
N\u00eb sshd, gjat\u00eb p\u00ebrpunimit t\u00eb direktiv\u00ebs environment=\u00ab\u2026\u00bb n\u00eb skedar\u00ebt authorized_keys tani pranohet p\u00ebrshtatja e par\u00eb dhe ka nj\u00eb kufizim prej 1024 emrave t\u00eb variablave t\u00eb ambientit. <\/ul>\n
Zhvilluesit e OpenSSH gjithashtu paralajm\u00ebruan se algoritmet q\u00eb p\u00ebrdorin hash SHA-1 po kalojn\u00eb n\u00eb kategorin\u00eb e algoritmeve t\u00eb vjetruara, p\u00ebr shkak t\u00eb rritjes s\u00eb efektivitetit t\u00eb sulmeve me kolizione me nj\u00eb prefiks t\u00eb caktuar (kostoja p\u00ebr t\u00eb arritur nj\u00eb kolizion vler\u00ebsohet n\u00eb rreth 50 mij\u00eb dollar\u00eb). N\u00eb numrin e ardhsh\u00ebm, pritet q\u00eb mund\u00ebsia p\u00ebr t\u00eb p\u00ebrdorur algoritmin e n\u00ebnshkrimit digjital me \u00e7el\u00ebs publik \"ssh-rsa\" t\u00eb jet\u00eb e aktivizuar si e parazgjedhur, e cila p\u00ebrmendet n\u00eb RFC origjinale p\u00ebr protokollin SSH dhe mbetet e p\u00ebrhapur gjer\u00ebsisht n\u00eb praktik\u00eb. <\/p>\n
P\u00ebr t\u00eb kontrolluar p\u00ebrdorimin e ssh-rsa n\u00eb sistemet tuaja, mund t\u00eb provoni t\u00eb lidheni p\u00ebrmes ssh me opsionin \"-oHostKeyAlgorithms=-ssh-rsa\". Megjithat\u00eb, \u00e7aktivizimi i n\u00ebnshkrimeve digjitale \"ssh-rsa\" si parazgjedhje nuk do t\u00eb thot\u00eb se do t\u00eb ndalohet plot\u00ebsisht p\u00ebrdorimi i \u00e7el\u00ebsave RSA, pasi p\u00ebrve\u00e7 SHA-1, protokolli SSH lejon p\u00ebrdorimin e algoritmeve t\u00eb tjer\u00eb t\u00eb llogaritjes s\u00eb hash-\u00ebve. N\u00eb ve\u00e7anti, p\u00ebrve\u00e7 \"ssh-rsa\", do t\u00eb mbetet mund\u00ebsia e p\u00ebrdorimit t\u00eb lidhjeve \"rsa-sha2-256\" (RSA\/SHA256) dhe \"rsa-sha2-512\" (RSA\/SHA512). <\/p>\n