{"id":83061,"date":"2020-05-28T01:42:22","date_gmt":"2020-05-27T23:42:22","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/reliz-openssh-8-3-s-ustraneniem-uyazvimosti-v-scp"},"modified":"2020-05-28T01:42:22","modified_gmt":"2020-05-27T23:42:22","slug":"reliz-openssh-8-3-s-ustraneniem-uyazvimosti-v-scp","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/reliz-openssh-8-3-s-ustraneniem-uyazvimosti-v-scp","title":{"rendered":"L\u00ebshimi i OpenSSH 8.3 me rregullimin e dob\u00ebsis\u00eb n\u00eb scp","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Pas tre muajsh zhvillimi <noindex><a rel=\"nofollow\" href=\"https:\/\/lists.mindrot.org\/pipermail\/openssh-unix-dev\/2020-May\/038528.html\">u paraqit<\/a><\/noindex> l\u00ebshimi <noindex><a rel=\"nofollow\" href=\"https:\/\/www.openssh.com\/\">OpenSSH 8.3<\/a><\/noindex>, implementimi t\u00eb hapur t\u00eb klientit dhe serverit p\u00ebr pun\u00eb sipas protokolleve SSH 2.0 dhe SFTP. <\/p>\n<p>N\u00eb k\u00ebt\u00eb version t\u00eb ri \u00ebsht\u00eb shtuar mbrojtja nga sulmi n\u00eb scp, e cila lejon serverin t\u00eb transferoj\u00eb emra t\u00eb tjer\u00eb skedash q\u00eb dallojn\u00eb nga ato t\u00eb k\u00ebrkuara (ndryshe nga <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=49953\">vulnerabiliteti i m\u00ebparsh\u00ebm<\/a><\/noindex>, sulmi nuk lejon t\u00eb ndryshohet katalogu i zgjedhur nga p\u00ebrdoruesi ose maska glob). Kujtojm\u00eb se n\u00eb SCP serveri merr vendimin se cilat skedar\u00eb dhe katalog\u00eb t\u00eb d\u00ebrgohen te klienti, nd\u00ebrsa klienti thjesht kontrollon sakt\u00ebsin\u00eb e emrave t\u00eb objektit t\u00eb kthyer. Thelbi i problemit t\u00eb identifikuar \u00ebsht\u00eb se n\u00ebse thirrja sistemike utimes p\u00ebrfundon me gabim, p\u00ebrmbajtja e skedarit interpretohet si meta t\u00eb skedarit. <\/p>\n<p>Kjo ve\u00e7ori kur lidhemi me nj\u00eb server n\u00ebn kontrollin e sulmuesit mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb ruajtur n\u00eb sistemin e skedar\u00ebve t\u00eb p\u00ebrdoruesit emra tjet\u00ebr skedar\u00ebsh dhe p\u00ebrmbajtje tjet\u00ebr kur kopjohet p\u00ebrmes scp n\u00eb konfiguracione q\u00eb \u00e7ojn\u00eb n\u00eb d\u00ebshtim gjat\u00eb thirrjes s\u00eb utimes (p.sh., kur utimes ndalohet nga politika SELinux ose nga filtri i thirrjeve sistemore). Mund\u00ebsia e realizimit t\u00eb sulmeve reale vler\u00ebsohet si minimale, sepse n\u00eb konfigurimet tipike thirrja e utimes nuk gjendet me d\u00ebshtim. P\u00ebr m\u00eb tep\u00ebr, sulmi nuk kalon pa u v\u00ebn\u00eb re \u2014 gjat\u00eb thirrjes s\u00eb scp shfaqet nj\u00eb gabim n\u00eb transfert\u00eb.<\/p>\n<p>Ndryshime t\u00eb p\u00ebrgjithshme:<\/p>\n<ul>\n<li class=\"l\"> N\u00eb sftp \u00ebsht\u00eb ndaluar p\u00ebrpunimi i argumentit \u00ab-1\u00bb n\u00eb p\u00ebrputhje me ssh dhe scp, i cili m\u00eb par\u00eb pranoheshin, por injoroheshin;\n<li class=\"l\"> N\u00eb sshd, kur p\u00ebrdoret IgnoreRhosts tani ofrohen tre opsione: \u00abyes\u00bb \u2014 injoro rhosts\/shosts, \u00abno\u00bb \u2014 merr parasysh rhosts\/shosts dhe \u00abshosts-only\u00bb \u2014 lejo \u00ab.shosts\u00bb, por ndalo \u00ab.rhosts\u00bb;\n<li class=\"l\"> N\u00eb ssh sigurohet trajtimi i z\u00ebvend\u00ebsimit %TOKEN n\u00eb cil\u00ebsimet LocalFoward dhe RemoteForward, t\u00eb cilat p\u00ebrdoren p\u00ebr t\u00eb ri-direktuar soket e Unix-it;\n<li class=\"l\"> Lejohet ngarkimi i \u00e7el\u00ebsave publik\u00eb nga nj\u00eb skedar i dezifruar me \u00e7el\u00ebs privat, n\u00ebse nuk ka ndonj\u00eb skedar t\u00eb ve\u00e7ant\u00eb me \u00e7el\u00ebs publik;\n<li class=\"l\"> N\u00ebse ka n\u00eb sistem libcrypto, ssh dhe sshd tani p\u00ebrdorin implementimin e algoritmit chacha20 nga kjo bibliotek\u00eb, n\u00eb vend t\u00eb implementimit t\u00eb ngjash\u00ebm q\u00eb ishte m\u00eb i ngadalsh\u00ebm;\n<li class=\"l\"> \u00cbsht\u00eb realizuar mund\u00ebsia e dump-it t\u00eb p\u00ebrmbajtjes s\u00eb list\u00ebs binar t\u00eb \u00e7ertifikatave t\u00eb t\u00ebrhequra gjat\u00eb ekzekutimit t\u00eb komand\u00ebs \u00abssh-keygen -lQf \/path\u00bb;\n<li class=\"l\"> N\u00eb versionin portativ \u00ebsht\u00eb realizuar p\u00ebrcaktimi i sistemeve ku sinjalet me opsionin SA_RESTART nd\u00ebrpresin pun\u00ebn e select;\n<li class=\"l\"> Jan\u00eb zgjidhur problemet me nd\u00ebrtimin n\u00eb sistemet HP\/UX dhe AIX;\n<li class=\"l\"> Jan\u00eb eliminuar problemet me nd\u00ebrtimin e seccomp sandbox n\u00eb disa konfiguracione Linux;\n<li class=\"l\"> P\u00ebrmir\u00ebsuar identifikimi i bibliotek\u00ebs libfido2 dhe zgjidhur problemet e nd\u00ebrtimit me opsionin \u00ab--with-security-key-builtin\u00bb.\n<\/ul>\n<p>Zhvilluesit e OpenSSH gjithashtu e njoftuan s\u00ebrish p\u00ebr kalimin e ardhsh\u00ebm n\u00eb statusin e deprecated p\u00ebr algoritmet q\u00eb p\u00ebrdorin hashes SHA-1, lidhur me <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=52149\">p\u00ebrmir\u00ebsimin<\/a><\/noindex> efikasiteti i sulmeve t\u00eb kolizionit me nj\u00eb prefiks t\u00eb caktuar (kostoja e gjetjes s\u00eb kolizionit vler\u00ebsohet t\u00eb jet\u00eb rreth 45 mij\u00eb dollar\u00eb). Nj\u00eb nga numrat e ardhsh\u00ebm planifikon t\u00eb \u00e7aktivizoj\u00eb si parazgjedhje mund\u00ebsin\u00eb e p\u00ebrdorimit t\u00eb algoritmit t\u00eb n\u00ebnshkrimit digjital me \u00e7el\u00ebsa publik\u00eb \u00abssh-rsa\u00bb, i cili p\u00ebrmendet n\u00eb RFC origjinal p\u00ebr protokollin SSH dhe mbetet i p\u00ebrhapur gjer\u00ebsisht n\u00eb praktik\u00eb (p\u00ebr t\u00eb kontrolluar p\u00ebrdorimin e ssh-rsa n\u00eb sistemet tuaja, mund t\u00eb provoni t\u00eb lidheni p\u00ebrmes ssh me opsionin \u00ab-oHostKeyAlgorithms=-ssh-rsa\u00bb).<\/p>\n<p>P\u00ebr t\u00eb leht\u00ebsuar kalimin n\u00eb algoritmet e reja n\u00eb OpenSSH, n\u00eb nj\u00eb nga versionet e ardhshme, do t\u00eb jet\u00eb e mundur t\u00eb aktivizohet parazgjedhur konfigurimi UpdateHostKeys, i cili do t\u00eb lejoj\u00eb automatikisht nd\u00ebrrimin e klient\u00ebve n\u00eb algoritme m\u00eb t\u00eb sigurta. Mes algoritmeve t\u00eb rekomanduara p\u00ebr migrim, p\u00ebrmenden rsa-sha2-256\/512 bazuar n\u00eb RFC8332 RSA SHA-2 (e mb\u00ebshtetur nga OpenSSH 7.2 dhe p\u00ebrdoret parazgjedhur), ssh-ed25519 (e mb\u00ebshtetur nga OpenSSH 6.5) dhe ecdsa-sha2-nistp256\/384\/521 bazuar n\u00eb RFC5656 ECDSA (e mb\u00ebshtetur nga OpenSSH 5.7). <\/p>\n<p>Duke filluar nga versioni i kaluar, \u00abssh-rsa\u00bb dhe \u00abdiffie-hellman-group14-sha1\u00bb jan\u00eb fshir\u00eb nga lista CASignatureAlgorithms, e cila p\u00ebrcakton algoritmet e pranuesh\u00ebm p\u00ebr n\u00ebnshkrimin digjital t\u00eb \u00e7ertifikatave t\u00eb reja, sepse p\u00ebrdorimi i SHA-1 n\u00eb \u00e7ertifikata \u00ebsht\u00eb e lidhur me nj\u00eb rrezik shtes\u00eb p\u00ebr shkak se sulmuesi ka nj\u00eb koh\u00eb t\u00eb pakufizuar p\u00ebr t\u00eb gjetur kolizione p\u00ebr nj\u00eb \u00e7ertifikat\u00eb ekzistuese, nd\u00ebrsa koha e sulmit ndaj \u00e7el\u00ebsave t\u00eb hostit \u00ebsht\u00eb e kufizuar nga skadimi i lidhjes (LoginGraceTime). <\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Burimi: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=53039\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u043e\u0441\u043b\u0435 \u0442\u0440\u0451\u0445 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 OpenSSH 8.3, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430\u043c SSH 2.0 \u0438 SFTP. \u0412 \u043d\u043e\u0432\u043e\u043c \u0432\u044b\u043f\u0443\u0441\u043a\u0435 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0430 \u0437\u0430\u0449\u0438\u0442\u0430 \u043e\u0442 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 scp, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0441\u0435\u0440\u0432\u0435\u0440\u0443 \u043f\u0435\u0440\u0435\u0434\u0430\u0442\u044c \u0434\u0440\u0443\u0433\u0438\u0435 \u0438\u043c\u0435\u043d\u0430 \u0444\u0430\u0439\u043b\u043e\u0432, \u043e\u0442\u043b\u0438\u0447\u0430\u044e\u0449\u0438\u0435\u0441\u044f \u043e\u0442 \u0437\u0430\u043f\u0440\u043e\u0448\u0435\u043d\u043d\u044b\u0445 (\u0432 \u043e\u0442\u043b\u0438\u0447\u0438\u0435 \u043e\u0442 \u043f\u0440\u043e\u0448\u043b\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0430\u0442\u0430\u043a\u0430 \u043d\u0435 \u0434\u0430\u0451\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0441\u043c\u0435\u043d\u0438\u0442\u044c \u0432\u044b\u0431\u0440\u0430\u043d\u043d\u044b\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u043a\u0430\u0442\u0430\u043b\u043e\u0433 \u0438\u043b\u0438 glob-\u043c\u0430\u0441\u043a\u0443). \u041d\u0430\u043f\u043e\u043c\u043d\u0438\u043c, [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-83061","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u043e\u0441\u043b\u0435 \u0442\u0440\u0451\u0445 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sq\/blog\/news\/reliz-openssh-8-3-s-ustraneniem-uyazvimosti-v-scp\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"sq_AL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 OpenSSH 8.3 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 scp | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u043e\u0441\u043b\u0435 \u0442\u0440\u0451\u0445 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sq\/blog\/news\/reliz-openssh-8-3-s-ustraneniem-uyazvimosti-v-scp\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-05-27T23:42:22+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-05-27T23:42:22+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47L\u00ebshimi i OpenSSH 8.3 me eliminimin e dob\u00ebsis\u00eb n\u00eb scp | ProHoster","description":"Pas tre muajsh zhvillimi, u prezantua publiku","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/reliz-openssh-8-3-s-ustraneniem-uyazvimosti-v-scp","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 OpenSSH 8.3 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 scp | ProHoster","og:description":"\u041f\u043e\u0441\u043b\u0435 \u0442\u0440\u0451\u0445 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/reliz-openssh-8-3-s-ustraneniem-uyazvimosti-v-scp","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-27T23:42:22+00:00","article:modified_time":"2020-05-27T23:42:22+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"83061","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 15:25:24","updated":"2022-10-02 17:17:29","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/83061","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=83061"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/83061\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=83061"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=83061"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=83061"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}