GuestOnCampus und Shell/Fingerprints: Unterschied zwischen den Seiten
(Unterschied zwischen Seiten)
Zur Navigation springen
Zur Suche springen
imported>Burghardt |
imported>Matthias.neumann (Änderung 971 von Matthias.neumann (Diskussion) rückgängig gemacht.) |
||
| Zeile 1: | Zeile 1: | ||
| + | __NOTOC__ |
||
| − | Seit Anfang 2017 existiert das WLAN "<tt>GuestOnCampus</tt>". |
||
| + | * Back to [[Shell]] |
||
| − | == Nutzung per WLAN == |
||
| − | Zur Authentifizierung genügt |
||
| − | * ein "echter" Gwdg-Account |
||
| − | * ein Studierenden-Account |
||
| − | * ein Gäste-Account |
||
| − | ** zentral ausgestellt von einem Administrator |
||
| − | ** dezentral ausgestellt von ''irgendjemandem'' - Stichwort: "WLAN-Bürgschaft". Diese Person übernimmt dann auch die Verantwortung! |
||
| + | While older ssh-versions relied on [[MD5]] (Message Digest number five) for generating a fingerprint this is considered "unsafe" for some time now. The current implementation uses [[SHA256]] by default. |
||
| − | ;Achtung:das Netz ist '''nicht verschlüsselt''' - mit allen problematischen Konsequenzen. Verwenden Sie daher möglichst ein VPN. |
||
| + | == Current fingerprints as of April 2017 == |
||
| − | == |
+ | === Older Servers === |
| + | Included in [[debian]] [[Jessie]], [[Ubuntu]] [[Trusty]] and others. Used ''prior April 10th'' in <tt>login</tt>, <tt>shell</tt> and all pool workstations: |
||
| − | * manchmal scheint nach der Authentifizierung ein Browser-Restart notwendig zu sein. (Cacheprobleme?) |
||
| + | <pre> |
||
| − | * beim Sponsoring ''kann'' eine der lokalen Uni-Adressen <tt>user@gwdg.de</tt>, <tt>user@xyz.uni-goettingen.de</tt> (für den Gast) ''nicht'' funktionieren. Die Anmeldung mit dem Gäste-Code schlägt immer fehl. Offenbar wird erst das ''echte'' Konto gefunden und das echte Passwort abgefragt. Der Gäste-Code kommt also gar nicht zum Einsatz. Wozu sollte das auch gut sein? Dieser Nutzer soll <tt>Eduroam</tt> verwenden! |
||
| + | ~$ lsb_release -d; for F in /etc/ssh/*.pub ; do echo -e "\n$F:"; ssh-keygen -l -f $F; done |
||
| − | * Bürge darf jeder Nutzer sein, der selbst das WLAN verwenden darf - also jeder Mitarbeiter und alle Studierenden. Ein Gastaccount gilt für '''bis zu drei Endgeräte'''. Ein Nutzer darf '''bis zu fünf Gäste gleichzeitig''' haben. |
||
| + | Description: Ubuntu 14.04.5 LTS |
||
| + | /etc/ssh/ssh_host_ecdsa.pub: |
||
| + | 256 07:84:c9:e1:59:4f:03:75:69:b1:e4:d0:b4:1f:9a:cd root@nfsadm (ECDSA) |
||
| + | /etc/ssh/ssh_host_ed25519_key.pub: |
||
| − | == Nutzung per Kupfer == |
||
| + | 256 93:11:29:c4:a2:03:e1:2d:b1:82:05:74:dd:a5:3b:9a root@nfsadm (ED25519) |
||
| − | * ''Betatest'' - eventuell ändert sich hier noch etwas. |
||
| − | * exakt genau dieses Netz wird auch per Kupfer zugänglich gemacht. Dass der Name dann eigentlich unpassend ist, ist nur ein Schönheitsfehler! |
||
| + | /etc/ssh/ssh_host_rsa_key.pub: |
||
| + | 2048 de:db:6e:72:52:de:30:73:db:bb:6e:79:df:f9:2c:0d root@nfsadm (RSA) |
||
| + | </pre> |
||
| − | == |
+ | === Newer Servers === |
| + | Included in debian [[Stretch]], Ubuntu [[Xenial]] and others. ''Currently used'' in <tt>login</tt>, <tt>shell</tt> and all pool workstations: |
||
| − | Gwdg: |
||
| + | <pre> |
||
| − | * https://www.gwdg.de/documents/20182/27257/GN_3-2017_www.pdf -- Das neue Gästenetz – Überblick + WLAN-Bürgschaften |
||
| + | ~$ lsb_release -d; for F in /etc/ssh/*.pub ; do echo -e "\n$F:"; ssh-keygen -l -f $F; done |
||
| − | * <b>https://guestnet.gwdg.de/</b> -- hier können von Gästen Accounts beantragt werden - erreichbar ''nur'' aus dem Gästenetz heraus |
||
| + | Description: Ubuntu 16.04.2 LTS |
||
| − | * <b>https://voucher.gwdg.de/</b> -- freigeben von "gesponsorten" Zugängen |
||
| − | * https://wlan.gwdg.de -- leitet weiter an das captive-portal |
||
| − | * https://captive-portal.gwdg.de:8003/index.php?zone=wlan_gast -- ohne Parameter klappt das nicht! Nur erreichbar solange man ''nicht'' authentifiziert ist |
||
| + | /etc/ssh/ssh_host_dsa_key.pub: |
||
| − | Andere: |
||
| + | 1024 SHA256:OpBcTf2pc3p3oUXKZvJ2773TULj6lskxYI/INZvLes8 root@c043 (DSA) |
||
| − | * https://www.sub.uni-goettingen.de/neu-hier/internetzugang/ -- allgemeine Informationen |
||
| − | * https://wiki.student.uni-goettingen.de/support/wlan/sub_gaeste -- zielt zwar auf die SUB, passt aber dennoch |
||
| + | /etc/ssh/ssh_host_ecdsa_key.pub: |
||
| + | 256 SHA256:IN1YJYjBWzm1irujENh5KVB6RxqXBGbvIT6WrGv++fw root@nfs (ECDSA) |
||
| + | /etc/ssh/ssh_host_ed25519_key.pub: |
||
| − | [[Kategorie:Netzwerk]] |
||
| + | 256 SHA256:P/gxfKUFA/5Gf9v5GOGQhcV3TgNzt9wS+moCKFjlUpo root@c009 (ED25519) |
||
| + | |||
| + | /etc/ssh/ssh_host_rsa_key.pub: |
||
| + | 1024 SHA256:f7orU3tn+mVuMlv/CjnfJOF8dr4/VhPhZMtSirMIndQ root@c043 (RSA) |
||
| + | </pre> |
||
| + | |||
| + | If you are using an old client you need to check the deprecated MD5 checksum: |
||
| + | <pre> |
||
| + | ~$ lsb_release -d; for F in /etc/ssh/*.pub ; do echo -e "\n$F:"; ssh-keygen -l -E MD5 -f $F; done |
||
| + | Description: Ubuntu 16.04.2 LTS |
||
| + | |||
| + | /etc/ssh/ssh_host_dsa_key.pub: |
||
| + | 1024 MD5:c0:e6:ac:3f:62:4c:4e:dc:cc:68:66:45:83:f2:23:9a root@c043 (DSA) |
||
| + | |||
| + | /etc/ssh/ssh_host_ecdsa_key.pub: |
||
| + | 256 MD5:1a:04:8e:f5:7e:e6:44:6a:a8:1f:b7:f0:8c:40:f8:ff root@nfs (ECDSA) |
||
| + | |||
| + | /etc/ssh/ssh_host_ed25519_key.pub: |
||
| + | 256 MD5:c5:fb:87:6c:78:29:32:90:ea:3d:3c:0d:9b:2c:83:bd root@c009 (ED25519) |
||
| + | |||
| + | /etc/ssh/ssh_host_rsa_key.pub: |
||
| + | 1024 MD5:c6:82:13:00:60:c5:70:a7:60:6b:09:8d:c7:0b:b3:06 root@c043 (RSA) |
||
| + | </pre> |
||
| + | |||
| + | == Actually compare a fingerprint when establishing a session == |
||
| + | As a client you need to verify the actually used key/fingerprint to those documented above. Depending on old/new implementations the exact behavior and output might be different: |
||
| + | |||
| + | === Using an '''older''' client === |
||
| + | * connecting to an '''old''' server |
||
| + | ~$ ssh -o VisualHostKey=yes shell.informatik.uni-goettingen.de |
||
| + | Host key fingerprint is 07:84:c9:e1:59:4f:03:75:69:b1:e4:d0:b4:1f:9a:cd |
||
| + | |||
| + | * connecting to a '''newer''' server |
||
| + | ~$ ssh -o VisualHostKey=yes newerserverinstance.informatik.uni-goettingen |
||
| + | Host key fingerprint is 1a:04:8e:f5:7e:e6:44:6a:a8:1f:b7:f0:8c:40:f8:ff |
||
| + | |||
| + | |||
| + | === Using a '''newer''' client === |
||
| + | * connecting to an '''old''' server |
||
| + | ~$ ssh -o VisualHostKey=yes shell.informatik.uni-goettingen.de |
||
| + | Host key fingerprint is SHA256:L+FCMj2bm8x/BfR8AdaaLnqTmFD35D0EYNlFG7a2dt8 |
||
| + | |||
| + | * connecting to an '''old''' server |
||
| + | ~$ ssh -o VisualHostKey=yes -o fingerprinthash=md5 shell.informatik.uni-goettingen.de |
||
| + | Host key fingerprint is MD5:07:84:c9:e1:59:4f:03:75:69:b1:e4:d0:b4:1f:9a:cd |
||
| + | |||
| + | * connecting to a '''newer''' server |
||
| + | ~$ ssh -o VisualHostKey=yes localhost |
||
| + | Host key fingerprint is SHA256:IN1YJYjBWzm1irujENh5KVB6RxqXBGbvIT6WrGv++fw |
||
| + | |||
| + | |||
| + | == See also == |
||
| + | * [[Shell]] |
||
Version vom 27. September 2017, 19:42 Uhr
- Back to Shell
While older ssh-versions relied on MD5 (Message Digest number five) for generating a fingerprint this is considered "unsafe" for some time now. The current implementation uses SHA256 by default.
Current fingerprints as of April 2017
Older Servers
Included in debian Jessie, Ubuntu Trusty and others. Used prior April 10th in login, shell and all pool workstations:
~$ lsb_release -d; for F in /etc/ssh/*.pub ; do echo -e "\n$F:"; ssh-keygen -l -f $F; done Description: Ubuntu 14.04.5 LTS /etc/ssh/ssh_host_ecdsa.pub: 256 07:84:c9:e1:59:4f:03:75:69:b1:e4:d0:b4:1f:9a:cd root@nfsadm (ECDSA) /etc/ssh/ssh_host_ed25519_key.pub: 256 93:11:29:c4:a2:03:e1:2d:b1:82:05:74:dd:a5:3b:9a root@nfsadm (ED25519) /etc/ssh/ssh_host_rsa_key.pub: 2048 de:db:6e:72:52:de:30:73:db:bb:6e:79:df:f9:2c:0d root@nfsadm (RSA)
Newer Servers
Included in debian Stretch, Ubuntu Xenial and others. Currently used in login, shell and all pool workstations:
~$ lsb_release -d; for F in /etc/ssh/*.pub ; do echo -e "\n$F:"; ssh-keygen -l -f $F; done Description: Ubuntu 16.04.2 LTS /etc/ssh/ssh_host_dsa_key.pub: 1024 SHA256:OpBcTf2pc3p3oUXKZvJ2773TULj6lskxYI/INZvLes8 root@c043 (DSA) /etc/ssh/ssh_host_ecdsa_key.pub: 256 SHA256:IN1YJYjBWzm1irujENh5KVB6RxqXBGbvIT6WrGv++fw root@nfs (ECDSA) /etc/ssh/ssh_host_ed25519_key.pub: 256 SHA256:P/gxfKUFA/5Gf9v5GOGQhcV3TgNzt9wS+moCKFjlUpo root@c009 (ED25519) /etc/ssh/ssh_host_rsa_key.pub: 1024 SHA256:f7orU3tn+mVuMlv/CjnfJOF8dr4/VhPhZMtSirMIndQ root@c043 (RSA)
If you are using an old client you need to check the deprecated MD5 checksum:
~$ lsb_release -d; for F in /etc/ssh/*.pub ; do echo -e "\n$F:"; ssh-keygen -l -E MD5 -f $F; done Description: Ubuntu 16.04.2 LTS /etc/ssh/ssh_host_dsa_key.pub: 1024 MD5:c0:e6:ac:3f:62:4c:4e:dc:cc:68:66:45:83:f2:23:9a root@c043 (DSA) /etc/ssh/ssh_host_ecdsa_key.pub: 256 MD5:1a:04:8e:f5:7e:e6:44:6a:a8:1f:b7:f0:8c:40:f8:ff root@nfs (ECDSA) /etc/ssh/ssh_host_ed25519_key.pub: 256 MD5:c5:fb:87:6c:78:29:32:90:ea:3d:3c:0d:9b:2c:83:bd root@c009 (ED25519) /etc/ssh/ssh_host_rsa_key.pub: 1024 MD5:c6:82:13:00:60:c5:70:a7:60:6b:09:8d:c7:0b:b3:06 root@c043 (RSA)
Actually compare a fingerprint when establishing a session
As a client you need to verify the actually used key/fingerprint to those documented above. Depending on old/new implementations the exact behavior and output might be different:
Using an older client
- connecting to an old server
~$ ssh -o VisualHostKey=yes shell.informatik.uni-goettingen.de Host key fingerprint is 07:84:c9:e1:59:4f:03:75:69:b1:e4:d0:b4:1f:9a:cd
- connecting to a newer server
~$ ssh -o VisualHostKey=yes newerserverinstance.informatik.uni-goettingen Host key fingerprint is 1a:04:8e:f5:7e:e6:44:6a:a8:1f:b7:f0:8c:40:f8:ff
Using a newer client
- connecting to an old server
~$ ssh -o VisualHostKey=yes shell.informatik.uni-goettingen.de Host key fingerprint is SHA256:L+FCMj2bm8x/BfR8AdaaLnqTmFD35D0EYNlFG7a2dt8
- connecting to an old server
~$ ssh -o VisualHostKey=yes -o fingerprinthash=md5 shell.informatik.uni-goettingen.de Host key fingerprint is MD5:07:84:c9:e1:59:4f:03:75:69:b1:e4:d0:b4:1f:9a:cd
- connecting to a newer server
~$ ssh -o VisualHostKey=yes localhost Host key fingerprint is SHA256:IN1YJYjBWzm1irujENh5KVB6RxqXBGbvIT6WrGv++fw