{"id":52210,"date":"2019-11-03T00:00:00","date_gmt":"2019-11-02T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/v-openssh-dobavlena-podderzhka-universalnoj-dvuhfaktornoj-autentifikatsii"},"modified":"2020-02-18T13:59:53","modified_gmt":"2020-02-18T10:59:53","slug":"v-openssh-dobavlena-podderzhka-universalnoj-dvuhfaktornoj-autentifikatsii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/v-openssh-dobavlena-podderzhka-universalnoj-dvuhfaktornoj-autentifikatsii","title":{"rendered":"N\u00eb OpenSSH \u00ebsht\u00eb shtuar mb\u00ebshtetje p\u00ebr autentifikimin dy-faktor\u00ebsh universal.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

N\u00eb baz\u00ebn e kodit OpenSSH \u00ebsht\u00eb shtuar<\/a><\/noindex> mb\u00ebshtetje eksperimentale p\u00ebr autentifikimin me dy faktor\u00eb duke p\u00ebrdorur pajisje q\u00eb mb\u00ebshtesin protokollin U2F<\/a><\/noindex>, e zhvilluar nga aleanca FIDO<\/a><\/noindex>. U2F lejon krijimin e token\u00ebve fizik\u00eb t\u00eb lir\u00eb p\u00ebr t\u00eb konfirmuar pranin\u00eb fizike t\u00eb p\u00ebrdoruesit, me t\u00eb cil\u00ebt nd\u00ebrveprohet p\u00ebrmes USB, Bluetooth ose NFC. K\u00ebto pajisje promovohen si nj\u00eb mjet p\u00ebr autentifikimin me dy faktor\u00eb n\u00eb faqe, mb\u00ebshteten tashm\u00eb nga shfletuesit kryesor\u00eb dhe prodhohen nga disa prodhues, p\u00ebrfshir\u00eb Yubico, Feitian, Thetis dhe Kensington.<\/p>\n

P\u00ebr nd\u00ebrveprimin me pajisjet q\u00eb konfirmojn\u00eb pranin\u00eb e p\u00ebrdoruesit, n\u00eb OpenSSH \u00ebsht\u00eb shtuar nj\u00eb lloj i ri \u00e7el\u00ebsi \u00absk-ecdsa-sha2-nistp256@openssh.com\u00bb (\u00abecdsa-sk\u00bb), n\u00eb t\u00eb cilin p\u00ebrdoret algoritmi i n\u00ebnshkrimit digjital ECDSA (Algoritmi i N\u00ebnshkrimit Digjital me Kurriz Eliptik) me kurb\u00ebn eliptike NIST P-256 dhe hash-in SHA-256. Procedurat p\u00ebr nd\u00ebrveprimin me token\u00ebt jan\u00eb transferuar n\u00eb nj\u00eb bibliotek\u00eb p\u00ebrmes nd\u00ebrmjet\u00ebs, e cila ngarkohet n\u00eb m\u00ebnyr\u00eb t\u00eb ngjashme me bibliotek\u00ebn p\u00ebr mb\u00ebshtetje PKCS#11 dhe \u00ebsht\u00eb nj\u00eb lidh\u00ebs mbi bibliotek\u00ebn. libfido2<\/a><\/noindex>, e cila ofron mjete p\u00ebr komunikim me token\u00ebt mbi USB (mb\u00ebshteten protokollet FIDO U2F\/CTAP 1 dhe FIDO 2.0\/CTAP 2). Biblioteka nd\u00ebrmjet\u00ebse libsk-libfido2 e p\u00ebrgatitur nga zhvilluesit e OpenSSH \u00ebsht\u00eb p\u00ebrfshir\u00eb<\/a><\/noindex> u p\u00ebrfshi n\u00eb p\u00ebrb\u00ebrjen kryesore t\u00eb libfido2, ashtu si drejtp\u00ebrdrejtori HID<\/a><\/noindex> p\u00ebr OpenBSD.<\/p>\n

P\u00ebr t\u00eb aktivizuar U2F mund t\u00eb p\u00ebrdorni nj\u00eb prerje t\u00eb re t\u00eb baz\u00ebs s\u00eb kodit nga repozitari<\/a><\/noindex> OpenSSH dhe dega HEAD e bibliotek\u00ebs libfido2<\/a><\/noindex>, e cila tashm\u00eb p\u00ebrmban shtres\u00ebn e nevojshme p\u00ebr OpenSSH.
\nLibfido2 mb\u00ebshtet funksionimin n\u00eb OpenBSD, Linux, macOS dhe Windows. <\/p>\n

P\u00ebr autentifikimin dhe gjenerimin e \u00e7el\u00ebsit \u00ebsht\u00eb e nevojshme t\u00eb vendosni variabl\u00ebn e mjedisit SSH_SK_PROVIDER, duke treguar atje rrug\u00ebn p\u00ebr libsk-libfido2.so (export SSH_SK_PROVIDER=\/path\/to\/libsk-libfido2.so), ose ta p\u00ebrcaktoni bibliotek\u00ebn p\u00ebrmes cil\u00ebsimit SecurityKeyProvider, pastaj t\u00eb ekzekutoni \u00abssh-keygen -t ecdsa-sk\u00bb ose, n\u00ebse \u00e7el\u00ebsat tashm\u00eb jan\u00eb krijuar dhe konfiguruar, t\u00eb lidhni me serverin duke p\u00ebrdorur \u00abssh\u00bb. Kur ekzekutoni ssh-keygen, \u00e7ifti i krijuar i \u00e7el\u00ebsave do t\u00eb ruhet n\u00eb \u00ab~\/.ssh\/id_ecdsa_sk\u00bb dhe mund t\u00eb p\u00ebrdoret nj\u00ebsoj si \u00e7el\u00ebsat e tjer\u00eb. <\/p>\n

\u00c7el\u00ebsi i hapur (id_ecdsa_sk.pub) duhet kopjuar n\u00eb server n\u00eb skedarin authorized_keys. Anash serveri vet\u00ebm kontrollon n\u00ebnshkrimin digjital, nd\u00ebrsa nd\u00ebrveprimi me token\u00ebt b\u00ebhet nga ana e klientit (n\u00eb server nuk \u00ebsht\u00eb e nevojshme t\u00eb instaloni libsk-libfido2, por serveri duhet t\u00eb mb\u00ebshtes\u00eb llojin e \u00e7el\u00ebsave \u00abecdsa-sk\u00bb). \u00c7el\u00ebsi i mbyllur i gjeneruar (id_ecdsa_sk) n\u00eb thelb \u00ebsht\u00eb nj\u00eb p\u00ebrshkrues i \u00e7el\u00ebsit, duke formuar \u00e7el\u00ebsin real vet\u00ebm n\u00eb kombinim me nj\u00eb sekuenc\u00eb sekrete, e ruajtur n\u00eb an\u00ebn e tokenit U2F.<\/p>\n

N\u00ebse \u00e7el\u00ebsi id_ecdsa_sk bie n\u00eb duar t\u00eb nj\u00eb sulmuesi, p\u00ebr t\u00eb kaluar autentikimin ai do t'i nevojitet gjithashtu akses n\u00eb tokenin harduerik, pa t\u00eb cilin \u00e7el\u00ebsi privat i ruajtur n\u00eb skedarin id_ecdsa_sk \u00ebsht\u00eb i pavler\u00eb. P\u00ebr m\u00eb tep\u00ebr, n\u00eb m\u00ebnyr\u00eb default, gjat\u00eb kryerjes s\u00eb \u00e7do operacioni me \u00e7el\u00ebsa (si gjat\u00eb gjenerimit ashtu edhe gjat\u00eb autentikimit) k\u00ebrkohet nj\u00eb konfirmim lokal i pranish\u00ebm fizikisht t\u00eb p\u00ebrdoruesit, p\u00ebr shembull, duke iu k\u00ebrkuar t\u00eb prekin sensorin n\u00eb token, gj\u00eb q\u00eb e v\u00ebshtir\u00ebson kryerjen e sulmeve t\u00eb larg\u00ebta ndaj sistemeve me token t\u00eb lidhur. Si nj\u00eb barier\u00eb tjet\u00ebr mbrojt\u00ebse, n\u00eb faz\u00ebn e nisjes ssh-keygen gjithashtu mund t\u00eb k\u00ebrkohet nj\u00eb fjal\u00ebkalim p\u00ebr qasje n\u00eb skedarin me \u00e7el\u00ebsin. <\/p>\n

\u00c7el\u00ebsi U2F mund t\u00eb shtohet n\u00eb ssh-agent p\u00ebrmes \u00abssh-add ~\/.ssh\/id_ecdsa_sk\u00bb, por ssh-agent duhet t\u00eb jet\u00eb nd\u00ebrtuar me mb\u00ebshtetje p\u00ebr \u00e7el\u00ebsat \u00abecdsa-sk\u00bb, duhet t\u00eb ket\u00eb nj\u00eb nd\u00ebrfaqe libsk-libfido2 dhe agenti duhet t\u00eb ekzekutohet n\u00eb sistemin, n\u00eb t\u00eb cilin lidhet tokeni.
\nNj\u00eb lloj i ri \u00e7el\u00ebsi \u00abecdsa-sk\u00bb \u00ebsht\u00eb shtuar sepse formati i \u00e7el\u00ebsave ecdsa n\u00eb OpenSSH i kund\u00ebrvihet formatit U2F p\u00ebr n\u00ebnshkrime digjital ECDSA duke pasur fusha shtes\u00eb.<\/p>\n

<\/a><\/noindex><\/p>\n

Burimi: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043a\u043e\u0434\u043e\u0432\u0443\u044e \u0431\u0430\u0437\u0443 OpenSSH \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0430 \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u0430\u044f \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430 \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432, \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u044e\u0449\u0438\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b U2F, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u044b\u0439 \u0430\u043b\u044c\u044f\u043d\u0441\u043e\u043c FIDO. U2F \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u0442\u044c \u043d\u0435\u0434\u043e\u0440\u043e\u0433\u0438\u0435 \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u044b\u0435 \u0442\u043e\u043a\u0435\u043d\u044b \u0434\u043b\u044f \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u044f \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435 \u0441 \u043a\u043e\u0442\u043e\u0440\u044b\u043c\u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 USB, Bluetooth \u0438\u043b\u0438 NFC. \u041f\u043e\u0434\u043e\u0431\u043d\u044b\u0435 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u043f\u0440\u043e\u0434\u0432\u0438\u0433\u0430\u044e\u0442\u0441\u044f \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0434\u043b\u044f \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043d\u0430 \u0441\u0430\u0439\u0442\u0430\u0445, \u0443\u0436\u0435 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u044e\u0442\u0441\u044f \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u043c\u0438 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430\u043c\u0438 \u0438 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u044e\u0442\u0441\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-52210","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47N\u00eb OpenSSH \u00ebsht\u00eb shtuar mb\u00ebshtetje p\u00ebr autentikimin universalisht t\u00eb dy faktor\u00ebve | ProHoster","description":"N\u00eb kodin e baz\u00ebs OpenSSH \u00ebsht\u00eb shtuar mb\u00ebshtetje eksperimentale p\u00ebr autentikimin me dy faktor\u00eb duke p\u00ebrdorur.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/v-openssh-dobavlena-podderzhka-universalnoj-dvuhfaktornoj-autentifikatsii","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 OpenSSH \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0430 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430 \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0430\u043b\u044c\u043d\u043e\u0439 \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 | ProHoster","og:description":"\u0412 \u043a\u043e\u0434\u043e\u0432\u0443\u044e \u0431\u0430\u0437\u0443 OpenSSH \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0430 \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u0430\u044f \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430 \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/v-openssh-dobavlena-podderzhka-universalnoj-dvuhfaktornoj-autentifikatsii","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-02T21:00:00+00:00","article:modified_time":"2020-02-18T10:59:53+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"52210","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 02:52:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:47:23","updated":"2026-01-24 02:52:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/52210","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=52210"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/52210\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=52210"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=52210"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=52210"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}