{"id":52210,"date":"2019-11-03T00:00:00","date_gmt":"2019-11-02T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/v-openssh-dobavlena-podderzhka-universalnoj-dvuhfaktornoj-autentifikatsii"},"modified":"2020-02-18T13:59:53","modified_gmt":"2020-02-18T10:59:53","slug":"v-openssh-dobavlena-podderzhka-universalnoj-dvuhfaktornoj-autentifikatsii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/v-openssh-dobavlena-podderzhka-universalnoj-dvuhfaktornoj-autentifikatsii","title":{"rendered":"OpenSSH har lagt till st\u00f6d f\u00f6r universell tv\u00e5faktorsautentisering","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

I OpenSSH:s kodbas har lagts till<\/a><\/noindex> experimentellt st\u00f6d f\u00f6r tv\u00e5faktorsautentisering med enheter som st\u00f6der protokollet U2F<\/a><\/noindex>, som utvecklas av alliansen FIDO<\/a><\/noindex>. U2F m\u00f6jligg\u00f6r skapande av prisv\u00e4rda h\u00e5rdvarutokens f\u00f6r att bekr\u00e4fta anv\u00e4ndarens fysiska n\u00e4rvaro, d\u00e4r interaktion sker via USB, Bluetooth eller NFC. S\u00e5dana enheter marknadsf\u00f6rs som verktyg f\u00f6r tv\u00e5faktorsautentisering p\u00e5 webbplatser, st\u00f6ds av de flesta webbl\u00e4sare och tillverkas av olika producenter, inklusive Yubico, Feitian, Thetis och Kensington.<\/p>\n

F\u00f6r att interagera med enheter som bekr\u00e4ftar anv\u00e4ndarens n\u00e4rvaro har OpenSSH lagt till en ny typ av nycklar «sk-ecdsa-sha2-nistp256@openssh.com» («ecdsa-sk»), d\u00e4r algoritmen f\u00f6r digital signatur ECDSA (Elliptic Curve Digital Signature Algorithm) anv\u00e4nds med den elliptiska kurvan NIST P-256 och hashen SHA-256. Procedurerna f\u00f6r interaktion med token har flyttats till ett mellanbibliotek som laddas p\u00e5 samma s\u00e4tt som biblioteket f\u00f6r PKCS#11 och \u00e4r ett gr\u00e4nssnitt \u00f6ver biblioteket. libfido2<\/a><\/noindex>, som ger medel f\u00f6r kommunikation med tokens via USB (st\u00f6der protokollen FIDO U2F\/CTAP 1 och FIDO 2.0\/CTAP 2). Det mellanlager som utvecklarna av OpenSSH f\u00f6rberett, libsk-libfido2 \u00e4r inkluderad<\/a><\/noindex> , ing\u00e5r i huvudbiblioteket libfido2, precis som HID-drivrutinen<\/a><\/noindex> f\u00f6r OpenBSD.<\/p>\n

F\u00f6r att aktivera U2F kan ett f\u00e4rskt klipp av kodbasen anv\u00e4ndas fr\u00e5n arkivet<\/a><\/noindex> OpenSSH och HEAD-grenen av biblioteket libfido2<\/a><\/noindex>, som redan inneh\u00e5ller det som kr\u00e4vs f\u00f6r OpenSSH.
\nLibfido2 st\u00f6der drift i OpenBSD, Linux, macOS och Windows. <\/p>\n

F\u00f6r autentisering och nyckelgenerering m\u00e5ste milj\u00f6variabeln SSH_SK_PROVIDER st\u00e4llas in med s\u00f6kv\u00e4gen till libsk-libfido2.so (export SSH_SK_PROVIDER=\\\/path\\\/to\\\/libsk-libfido2.so), eller biblioteket kan definieras genom inst\u00e4llningen SecurityKeyProvider, varp\u00e5 du kan k\u00f6ra «ssh-keygen -t ecdsa-sk» eller, om nycklarna redan har skapats och konfigurerats, ansluta till servern med «ssh». Vid k\u00f6rning av ssh-keygen kommer det skapade nyckelparet att sparas i «~\\\/ .ssh\\\/id_ecdsa_sk» och kan anv\u00e4ndas p\u00e5 samma s\u00e4tt som andra nycklar. <\/p>\n

Den offentliga nyckeln (id_ecdsa_sk.pub) b\u00f6r kopieras till servern i filen authorized_keys. P\u00e5 serversidan kontrolleras endast den digitala signaturen, medan interaktionen med token sker p\u00e5 klientsidan (det kr\u00e4vs ingen installation av libsk-libfido2 p\u00e5 servern, men servern m\u00e5ste st\u00f6dja nyckeltyp «ecdsa-sk»). Den genererade privata nyckeln (id_ecdsa_sk) \u00e4r i praktiken en beskrivning av nyckeln och bildar den verkliga nyckeln endast i kombination med den hemliga sekvensen som lagras p\u00e5 U2F-token.<\/p>\n

Om nyckeln id_ecdsa_sk hamnar i h\u00e4nderna p\u00e5 en angripare, kr\u00e4vs det ocks\u00e5 att de f\u00e5r tillg\u00e5ng till den h\u00e5rdvarutoken f\u00f6r autentisering, utan vilken den privata nyckeln som sparats i filen id_ecdsa_sk \u00e4r v\u00e4rdel\u00f6s. Dessutom kr\u00e4vs lokala bekr\u00e4ftelser av anv\u00e4ndarens fysiska n\u00e4rvaro som standard vid utf\u00f6rande av operationer med nycklar (b\u00e5de vid generering och autentisering), till exempel att anv\u00e4ndaren uppmanas att r\u00f6ra vid sensorn p\u00e5 tokenen, vilket f\u00f6rsv\u00e5rar fj\u00e4rrattacker p\u00e5 system med ansluten token. Som ytterligare ett skydd kan ett l\u00f6senord f\u00f6r \u00e5tkomst till nyckelfilen anges vid starten av ssh-keygen. <\/p>\n

U2F-nyckeln kan l\u00e4ggas till i ssh-agenten via «ssh-add ~\\\/ .ssh\\\/id_ecdsa_sk», men ssh-agenten m\u00e5ste kompilera med st\u00f6d f\u00f6r nycklar av typen «ecdsa-sk», libsk-libfido2 m\u00e5ste finnas och agenten m\u00e5ste k\u00f6ras p\u00e5 systemet d\u00e4r tokenet ansluts.
\nDen nya nyckeltypen «ecdsa-sk» har lagts till eftersom formatet f\u00f6r ecdsa-nycklar i OpenSSH skiljer sig fr\u00e5n formatet f\u00f6r U2F f\u00f6r ECDSA-digitala signaturer genom att ha ytterligare f\u00e4lt.<\/p>\n

<\/a><\/noindex><\/p>\n

K\u00e4lla: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043a\u043e\u0434\u043e\u0432\u0443\u044e \u0431\u0430\u0437\u0443 OpenSSH \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0430 \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u0430\u044f \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430 \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432, \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u044e\u0449\u0438\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b U2F, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u044b\u0439 \u0430\u043b\u044c\u044f\u043d\u0441\u043e\u043c FIDO. U2F \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u0442\u044c \u043d\u0435\u0434\u043e\u0440\u043e\u0433\u0438\u0435 \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u044b\u0435 \u0442\u043e\u043a\u0435\u043d\u044b \u0434\u043b\u044f \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u044f \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435 \u0441 \u043a\u043e\u0442\u043e\u0440\u044b\u043c\u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 USB, Bluetooth \u0438\u043b\u0438 NFC. \u041f\u043e\u0434\u043e\u0431\u043d\u044b\u0435 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u043f\u0440\u043e\u0434\u0432\u0438\u0433\u0430\u044e\u0442\u0441\u044f \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0434\u043b\u044f \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043d\u0430 \u0441\u0430\u0439\u0442\u0430\u0445, \u0443\u0436\u0435 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u044e\u0442\u0441\u044f \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u043c\u0438 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430\u043c\u0438 \u0438 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u044e\u0442\u0441\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-52210","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47St\u00f6d f\u00f6r universell tv\u00e5faktorsautentisering har lagts till i OpenSSH | ProHoster","description":"Experimentellt st\u00f6d f\u00f6r tv\u00e5faktorsautentisering har lagts till i OpenSSH-kodbasen.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/v-openssh-dobavlena-podderzhka-universalnoj-dvuhfaktornoj-autentifikatsii","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 OpenSSH \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0430 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430 \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0430\u043b\u044c\u043d\u043e\u0439 \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 | ProHoster","og:description":"\u0412 \u043a\u043e\u0434\u043e\u0432\u0443\u044e \u0431\u0430\u0437\u0443 OpenSSH \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0430 \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u0430\u044f \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430 \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c.","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/v-openssh-dobavlena-podderzhka-universalnoj-dvuhfaktornoj-autentifikatsii","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-02T21:00:00+00:00","article:modified_time":"2020-02-18T10:59:53+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"52210","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 02:52:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:47:23","updated":"2026-01-24 02:52:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/52210","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=52210"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/52210\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=52210"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=52210"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=52210"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}