{"id":106630,"date":"2023-02-03T12:48:25","date_gmt":"2023-02-03T10:48:25","guid":{"rendered":"https:\/\/prohoster.info\/?p=106630"},"modified":"2023-02-03T21:50:37","modified_gmt":"2023-02-03T19:50:37","slug":"vypusk-openssh-9-2-s-ustraneniem-uyazvimosti-proyavlyayushhejsya-na-etape-do-autentifikaczii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/vypusk-openssh-9-2-s-ustraneniem-uyazvimosti-proyavlyayushhejsya-na-etape-do-autentifikaczii","title":{"rendered":"L\u00ebshimi i OpenSSH 9.2 me rregullimin e nj\u00eb dob\u00ebsie q\u00eb shfaqet para autentifikimit","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
\u00cbsht\u00eb publikuar l\u00ebshimi OpenSSH 9.2, implementimi i hapur i klientit dhe serverit p\u00ebr funksionimin mbi protokollet SSH 2.0 dhe SFTP. N\u00eb k\u00ebt\u00eb version \u00ebsht\u00eb rregulluar nj\u00eb dob\u00ebsi q\u00eb shkakton \u00e7lirimin e dyfisht\u00eb t\u00eb hap\u00ebsir\u00ebs n\u00eb faz\u00ebn para autentifikimit. Vet\u00ebm l\u00ebshimi OpenSSH 9.1 \u00ebsht\u00eb i ndjesh\u00ebm ndaj k\u00ebsaj dob\u00ebsie, nd\u00ebrsa versionet e m\u00ebparshme nuk kan\u00eb k\u00ebt\u00eb problem. <\/p>\n
P\u00ebr t\u00eb krijuar kushte p\u00ebr shfaqjen e nj\u00eb dob\u00ebsie, \u00ebsht\u00eb e mjaftueshme t\u00eb ndryshoni bannerin e klientit SSH n\u00eb 'SSH-2.0-FuTTYSH_9.1p1' p\u00ebr t\u00eb b\u00ebr\u00eb q\u00eb t\u00eb vendosen flamujt 'SSH_BUG_CURVE25519PAD' dhe 'SSH_OLD_DHGEX', t\u00eb cil\u00ebt varen nga versioni i klientit SSH. Pasi t\u00eb vendosen k\u00ebta flamuj, memoria p\u00ebr tamponin 'options.kex_algorithms' lirohet dy her\u00eb \u2014 gjat\u00eb ekzekutimit t\u00eb funksionit do_ssh2_kex(), i cili th\u00ebrret compat_kex_proposal(), dhe gjat\u00eb ekzekutimit t\u00eb funksionit do_authentication2(), i cili th\u00ebrret n\u00eb zinxhir input_userauth_request(), mm_getpwnamallow(), copy_set_server_options(), assemble_algorithms() dhe kex_assemble_names(). <\/p>\n
Krijimi i nj\u00eb eksploituesi funksional p\u00ebr dob\u00ebsin\u00eb konsiderohet i pak\u00ebndsh\u00ebm, pasi procesi i shfryt\u00ebzimit \u00ebsht\u00eb shum\u00eb i komplikuar \u2014 bibliotekat moderne t\u00eb menaxhimit t\u00eb memories ofrojn\u00eb mbrojtje kund\u00ebr lirojeve t\u00eb dyfishta t\u00eb memories, dhe procesi pre-auth, n\u00eb t\u00eb cilin ndodhet gabimi, ekzekutohet me privilegje t\u00eb ulta n\u00eb nj\u00eb mjedis t\u00eb izoluar sandboks. <\/p>\n
P\u00ebrve\u00e7 dob\u00ebsis\u00eb s\u00eb p\u00ebrmendur, n\u00eb l\u00ebshimin e ri jan\u00eb rregulluar edhe dy probleme t\u00eb tjera t\u00eb siguris\u00eb: <\/p>\n
\n
Gabim n\u00eb p\u00ebrpunimin e cil\u00ebsimit «PermitRemoteOpen», q\u00eb \u00e7on n\u00eb injorimin e argumentit t\u00eb par\u00eb n\u00ebse ai ndryshon nga vlerat «any» dhe «none». Problemi shfaqet n\u00eb versionet m\u00eb t\u00eb reja t\u00eb OpenSSH 8.7 dhe \u00e7on n\u00eb kalimin e verifikimeve kur specifikohet vet\u00ebm nj\u00eb autorizim.\n
Nj\u00eb sulmues q\u00eb kontrollon serverin DNS t\u00eb p\u00ebrdorur p\u00ebr t\u00eb p\u00ebrcaktuar emra mund t\u00eb arrij\u00eb t\u00eb inkasoj\u00eb karaktere speciale (p.sh. «*») n\u00eb skedar\u00ebt known_hosts, n\u00ebse konfigurimi aktivizon opsionet CanonicalizeHostname dhe CanonicalizePermittedCNAMEs, dhe rezolva i sistemit nuk verifikon sakt\u00ebsin\u00eb e p\u00ebrgjigjeve nga serveri DNS. Kryerja e nj\u00eb sulmi konsiderohet si e pak\u00ebt, pasi emrat e kthyer duhet t\u00eb p\u00ebrputhen me kushtet e p\u00ebrcaktuara p\u00ebrmes CanonicalizePermittedCNAMEs. <\/ul>\n
Ndryshime t\u00eb tjera: <\/p>\n
\n
N\u00eb ssh_config p\u00ebr ssh \u00ebsht\u00eb shtuar cil\u00ebsimi EnableEscapeCommandline, q\u00eb kontrollon p\u00ebrfshirjen e p\u00ebrpunimit t\u00eb sekuencave t\u00eb shp\u00ebtimit «~C» nga ana e klientit, q\u00eb ofron nj\u00eb komand\u00eb. Sipas parazgjedhjes, p\u00ebrpunimi i «~C» tani \u00ebsht\u00eb \u00e7aktivizuar p\u00ebr t\u00eb p\u00ebrdorur nj\u00eb izolim m\u00eb t\u00eb fort\u00eb sandbox, q\u00eb potencialisht mund t\u00eb \u00e7oj\u00eb n\u00eb probleme n\u00eb sisteme ku «~C» p\u00ebrdoret p\u00ebr t\u00eb drejtuar porta gjat\u00eb funksionimit.\n
N\u00eb sshd_config p\u00ebr sshd \u00ebsht\u00eb shtuar direktiva ChannelTimeout p\u00ebr t\u00eb caktuar nj\u00eb koh\u00eb t\u00eb pritjes s\u00eb pasivitetit t\u00eb kanalit (kanalet, n\u00eb t\u00eb cilat p\u00ebr nj\u00eb koh\u00eb t\u00eb caktuar t\u00eb p\u00ebrcaktuar n\u00eb direktiv\u00eb nuk ka trafik t\u00eb regjistruar, do t\u00eb mbyllen automatikisht). P\u00ebr seanc\u00ebn, X11, agjent\u00ebt dhe ridrejtimi i trafikut mund t\u00eb caktohen koh\u00eb t\u00eb ndryshme pritjeje.\n
N\u00eb sshd_config p\u00ebr sshd \u00ebsht\u00eb shtuar drejtorin\u00eb UnusedConnectionTimeout, e cila lejon t\u00eb caktohet nj\u00eb koh\u00ebzgjatje p\u00ebr p\u00ebrfundimin e lidhjeve t\u00eb klientit q\u00eb jan\u00eb pa kanale aktive p\u00ebr nj\u00eb periudh\u00eb t\u00eb caktuar kohe.\n
N\u00eb daljen «ssh -G» \u00ebsht\u00eb shtuar rreshti «Host», i cili pasqyron vler\u00ebn e argumentit me emrin e hostit.\n
N\u00eb scp dhe sftp \u00ebsht\u00eb shtuar opsioni «-X» p\u00ebr t\u00eb menaxhuar parametrat e protokollit SFTP, t\u00eb tilla si madh\u00ebsia e tamponit t\u00eb kopjimit dhe numri i k\u00ebrkesave n\u00eb pritje p\u00ebr t'u p\u00ebrfunduar.\n