{"id":110627,"date":"2023-10-05T15:10:24","date_gmt":"2023-10-05T13:10:24","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/reliz-openssh-9-5"},"modified":"2023-10-05T15:10:24","modified_gmt":"2023-10-05T13:10:24","slug":"reliz-openssh-9-5","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/reliz-openssh-9-5","title":{"rendered":"L\u00ebshimi i OpenSSH 9.5","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
\u00cbsht\u00eb publikuar l\u00ebshimi i OpenSSH 9.5, implementimi t\u00eb hapur t\u00eb klientit dhe serverit p\u00ebr operimin sipas protokolleve SSH 2.0 dhe SFTP. <\/p>\n
Ndryshimet kryesore: <\/p>\n
\n
N\u00eb ssh-keygen, gjenerimi i \u00e7el\u00eb save t\u00eb bazuar n\u00eb n\u00ebnshkrimin e digjitalit Ed25519 \u00ebsht\u00eb aktivizuar si parazgjedhje, i zhvilluar nga Daniel Bernstein dhe standardizuar n\u00eb RFC 8709. Vlen t\u00eb p\u00ebrmendet se \u00e7el\u00ebsat Ed25519 mb\u00ebshteten nga versioni i l\u00ebshuar OpenSSH 6.5 (2014) dhe jan\u00eb m\u00eb t\u00eb p\u00ebrshtatsh\u00ebm p\u00ebr shkak t\u00eb madh\u00ebsis\u00eb s\u00eb tyre t\u00eb vog\u00ebl. N\u00ebnshkrimet digjitale Ed25519 ofrojn\u00eb nj\u00eb nivel m\u00eb t\u00eb lart\u00eb sigurie se ECDSA dhe DSA dhe demonstrojn\u00eb nj\u00eb shpejt\u00ebsi shum\u00eb t\u00eb lart\u00eb t\u00eb verifikimit dhe krijimit t\u00eb n\u00ebnshkrimeve. Q\u00ebndrueshm\u00ebria ndaj thyerjes p\u00ebr Ed25519 \u00ebsht\u00eb rreth 2^128 (n\u00eb mesatar, p\u00ebr t\u00eb sulmuar Ed25519 k\u00ebrkohen 2^140 operacione bit\u00ebsh), e cila \u00ebsht\u00eb ekuivalente me q\u00ebndrueshm\u00ebrin\u00eb e algoritmeve si NIST P-256 dhe RSA me nj\u00eb \u00e7el\u00ebs t\u00eb madh\u00ebsis\u00eb 375 byte ose 128-bit\u00ebshif\u00ebr blok. Ed25519 gjithashtu nuk \u00ebsht\u00eb i ndjesh\u00ebm ndaj problemeve me p\u00ebrplasje n\u00eb hash, nuk ndjell sulme p\u00ebrmes p\u00ebrcaktimit t\u00eb shpejt\u00ebsis\u00eb s\u00eb pun\u00ebs s\u00eb cache-it (sulmeve t\u00eb keq-p\u00ebrdorimit t\u00eb koh\u00ebs s\u00eb cache-it) dhe sulmeve nga kanale t\u00eb jashtme.\n
N\u00eb utilitarin ssh \u00ebsht\u00eb shtuar mbrojtja nga sulmet p\u00ebrmes kanaleve an\u00ebsore, t\u00eb cilat analizojn\u00eb vonesat midis shtypjeve t\u00eb \u00e7el\u00ebsave n\u00eb tastier\u00eb p\u00ebr t\u00eb rikrijuar inputin. Sulmet e tilla bazohen n\u00eb faktin se vonesat midis shtypjeve gjat\u00eb shkruarjes varen nga pozita e \u00e7el\u00ebsave n\u00eb tastier\u00eb (p\u00ebr shembull, reagimi gjat\u00eb futjes s\u00eb shkronj\u00ebs \"F\" \u00ebsht\u00eb m\u00eb i shpejt\u00eb se kur futet \"Q\" ose \"X\", pasi shtypja k\u00ebrkon m\u00eb pak l\u00ebvizje gishti). SSH ka qen\u00eb i ekspozuar ndaj k\u00ebtyre sulmeve pasi d\u00ebrgonte informacionin mbi simbolin e futur n\u00eb nj\u00eb paket\u00eb t\u00eb ve\u00e7ant\u00eb menj\u00ebher\u00eb pas shtypjes s\u00eb \u00e7do \u00e7el\u00ebsi, p\u00ebrkat\u00ebsisht, vonesat midis d\u00ebrgimit t\u00eb pakove korrelacionoheshin me vonesat midis shtypjeve t\u00eb \u00e7el\u00ebsave.\n
P\u00ebr t\u00eb fshehur ve\u00e7orit\u00eb e inputit interaktiv n\u00eb trafikun n\u00eb ssh, \u00ebsht\u00eb implementuar d\u00ebrgimi i t\u00eb dh\u00ebnave jo me kalimin e shkrimeve, por vet\u00ebm pas intervaleve t\u00eb fikstuara t\u00eb koh\u00ebs (n\u00eb m\u00ebnyr\u00eb t\u00eb parazgjedhur 20 ms). Gjithashtu, p\u00ebr t\u00eb konfuzuar sulmuesit, n\u00eb momente t\u00eb rast\u00ebsishme, pas d\u00ebrgimit t\u00eb t\u00eb dh\u00ebnave t\u00eb v\u00ebrteta, d\u00ebrgohen shtypje t\u00eb rreme. P\u00ebr t\u00eb konfiguruar mbrojtjen, n\u00eb ssh_config \u00ebsht\u00eb shtuar parametri \"ObscureKeystrokeTiming\". <\/p>\n
N\u00eb ssh dhe sshd \u00ebsht\u00eb implementuar mb\u00ebshtetje p\u00ebr zgjerimin e protokollit SSH \"ping@openssh.com\", duke shtuar nj\u00eb lloj t\u00eb ri mesazhesh SSH2_MSG_PING dhe SSH2_MSG_PONG p\u00ebr d\u00ebrgimin periodik t\u00eb pakove n\u00eb intervale t\u00eb barabarta t\u00eb koh\u00ebs. Zgjerimi \u00ebsht\u00eb i nevojsh\u00ebm p\u00ebr mbrojtjen e p\u00ebrmendur m\u00eb sip\u00ebr ndaj sulmeve p\u00ebrmes kanaleve an\u00ebsore.\n
N\u00eb sshd, p\u00ebr direktiv\u00ebn Subsystem \u00ebsht\u00eb ndryshuar p\u00ebrpunimi i citateve, t\u00eb cilat tani ruhen p\u00ebr komandat dhe argumentet, gj\u00eb q\u00eb mund t\u00eb \u00e7oj\u00eb n\u00eb probleme t\u00eb pajtueshm\u00ebris\u00eb me konfigurime shum\u00eb t\u00eb rralla. <\/ul>\n