Cookies op Tweakers

Tweakers maakt gebruik van cookies, onder andere om de website te analyseren, het gebruiksgemak te vergroten en advertenties te tonen. Door gebruik te maken van deze website, of door op 'Ga verder' te klikken, geef je toestemming voor het gebruik van cookies. Wil je meer informatie over cookies en hoe ze worden gebruikt, bekijk dan ons cookiebeleid.

Meer informatie

Door , , 1 reactie
Bron: The OpenBSD Project, submitter: Rafe

OpenSSH logo (75 pix) Maandag is versie 6.8 van OpenSSH uitgekomen. OpenSSH versleutelt het netwerkverkeer om afluisteren, het overnemen van de verbinding en andere netwerkaanvallen tegen te gaan. Daarnaast bevat het de mogelijkheid om zogenaamde veilige tunnels op te zetten en ondersteunt het verschillende authenticatiemethodes. OpenSSH is primair ontwikkeld voor OpenBSD, gebruikers van andere besturingssystemen kunnen hier terecht. De changelog van deze release ziet er als volgt uit:

Potentially-incompatible changes
  • sshd(8): UseDNS now defaults to 'no'. Configurations that match against the client host name (via sshd_config or authorized_keys) may need to re-enable it or convert to matching against addresses.
New Features
  • Much of OpenSSH's internal code has been re-factored to be more library-like. These changes are mostly not user-visible, but have greatly improved OpenSSH's testability and internal layout.
  • Add FingerprintHash option to ssh(1) and sshd(8), and equivalent command-line flags to the other tools to control algorithm used for key fingerprints. The default changes from MD5 to SHA256 and format from hex to base64.
    Fingerprints now have the hash algorithm prepended. An example of the new format: SHA256:mVPwvezndPv/ARoIadVY98vAC0g+P/5633yTC4d/wXE Please note that visual host keys will also be different.
  • ssh(1), sshd(8): Experimental host key rotation support. Add a protocol extension for a server to inform a client of all its available host keys after authentication has completed. The client may record the keys in known_hosts, allowing it to upgrade to better host key algorithms and a server to gracefully rotate its keys.
    The client side of this is controlled by a UpdateHostkeys config option (default off).
  • ssh(1): Add a ssh_config HostbasedKeyType option to control which host public key types are tried during host-based authentication.
  • ssh(1), sshd(8): fix connection-killing host key mismatch errors when sshd offers multiple ECDSA keys of different lengths.
  • ssh(1): when host name canonicalisation is enabled, try to parse host names as addresses before looking them up for canonicalisation. fixes bz#2074 and avoiding needless DNS lookups in some cases.
  • ssh-keygen(1), sshd(8): Key Revocation Lists (KRLs) no longer require OpenSSH to be compiled with OpenSSL support.
  • ssh(1), ssh-keysign(8): Make ed25519 keys work for host based authentication.
  • sshd(8): SSH protocol v.1 workaround for the Meyer, et al, Bleichenbacher Side Channel Attack. Fake up a bignum key before RSA decryption.
  • sshd(8): Remember which public keys have been used for authentication and refuse to accept previously-used keys. This allows AuthenticationMethods=publickey,publickey to require that users authenticate using two _different_ public keys.
  • sshd(8): add sshd_config HostbasedAcceptedKeyTypes and PubkeyAcceptedKeyTypes options to allow sshd to control what public key types will be accepted. Currently defaults to all.
  • sshd(8): Don't count partial authentication success as a failure against MaxAuthTries.
  • ssh(1): Add RevokedHostKeys option for the client to allow text-file or KRL-based revocation of host keys.
  • ssh-keygen(1), sshd(8): Permit KRLs that revoke certificates by serial number or key ID without scoping to a particular CA.
  • ssh(1): Add a "Match canonical" criteria that allows ssh_config Match blocks to trigger only in the second config pass.
  • ssh(1): Add a -G option to ssh that causes it to parse its configuration and dump the result to stdout, similar to "sshd -T".
  • ssh(1): Allow Match criteria to be negated. E.g. "Match !host".
  • The regression test suite has been extended to cover more OpenSSH features. The unit tests have been expanded and now cover key exchange.
Bugfixes
  • ssh-keyscan(1): ssh-keyscan has been made much more robust again servers that hang or violate the SSH protocol.
  • ssh(1), ssh-keygen(1): Fix regression bz#2306: Key path names were being lost as comment fields.
  • ssh(1): Allow ssh_config Port options set in the second config parse phase to be applied (they were being ignored). bz#2286
  • ssh(1): Tweak config re-parsing with host canonicalisation - make the second pass through the config files always run when host name canonicalisation is enabled (and not whenever the host name changes) bz#2267
  • ssh(1): Fix passing of wildcard forward bind addresses when connection multiplexing is in use; bz#2324;
  • ssh-keygen(1): Fix broken private key conversion from non-OpenSSH formats; bz#2345.
  • ssh-keygen(1): Fix KRL generation bug when multiple CAs are in use.
  • Various fixes to manual pages: bz#2288, bz#2316, bz#2273
Portable OpenSSH
  • Support --without-openssl at configure time
    Disables and removes dependency on OpenSSL. Many features, including SSH protocol 1 are not supported and the set of crypto options is greatly restricted. This will only work on systems with native arc4random or /dev/urandom.
    Considered highly experimental for now.
  • Support --without-ssh1 option at configure time
    Allows disabling support for SSH protocol 1.
  • sshd(8): Fix compilation on systems with IPv6 support in utmpx; bz#2296
  • Allow custom service name for sshd on Cygwin. Permits the use of multiple sshd running with different service names.

OpenSSH dinges (481 pix)

Versienummer:6.8
Releasestatus:Final
Besturingssystemen:Linux, BSD, macOS, Solaris, UNIX
Website:The OpenBSD Project
Download:http://www.openssh.com
Licentietype:Voorwaarden (GNU/BSD/etc.)
Moderatie-faq Wijzig weergave

Reacties (1)

Verstandig dat ze UseDNS uit zetten al zal dat bij een hoop mensen wel even pijn gaan doen. Eens kijken of de distributies hier in mee gaan of dat die het toch weer aan zetten om van het geklaag af te zijn.

Mooi dat host key rotation er nu in zit. Als je security echt heel serieus neemt was dat toch een beetje een zwak punt. Regelmatig nieuwe wachtwoorden nemen en SSL-certificaten na een paar jaar vervangen is inmiddels redelijk ingeburgerd maar ik ken werkelijk niemand die ooit z'n SSH-host-keys vervangt. DANE is ook een oplossing maar dan moet je wel toegang hebben tot DNS met DNSSEC en dat is lang niet altijd mogelijk.

Op dit item kan niet meer gereageerd worden.



Apple iOS 10 Google Pixel Apple iPhone 7 Sony PlayStation VR AMD Radeon RX 480 4GB Battlefield 1 Google Android Nougat Watch Dogs 2

© 1998 - 2016 de Persgroep Online Services B.V. Tweakers vormt samen met o.a. Autotrack en Carsom.nl de Persgroep Online Services B.V. Hosting door True