Log IP addresses of hosts attempting to use blacklisted keys (closes:

#481721).

5 files changed, 27 insertions, 16 deletions

diff --git a/auth-rh-rsa.c b/auth-rh-rsa.c
index 77a043998..cd272e4ca 100644
--- a/auth-rh-rsa.c
+++ b/auth-rh-rsa.c
@@ -50,11 +50,13 @@ auth_rhosts_rsa_key_allowed(struct passwd *pw, char *cuser, char *chost,
         if (blacklisted_key(client_host_key) == 1) {
                 fp = key_fingerprint(client_host_key, SSH_FP_MD5, SSH_FP_HEX);
                 if (options.permit_blacklisted_keys)
-                        logit("Public key %s blacklisted (see "
-                            "ssh-vulnkey(1)); continuing anyway", fp);
+                        logit("Public key %s from %s blacklisted (see "
+                            "ssh-vulnkey(1)); continuing anyway",
+                            fp, get_remote_ipaddr());
                 else
-                        logit("Public key %s blacklisted (see "
-                            "ssh-vulnkey(1))", fp);
+                        logit("Public key %s from %s blacklisted (see "
+                            "ssh-vulnkey(1))",
+                            fp, get_remote_ipaddr());
                 xfree(fp);
                 if (!options.permit_blacklisted_keys)
                         return 0;
diff --git a/auth-rsa.c b/auth-rsa.c
index 87e1fbf59..898e9eb50 100644
--- a/auth-rsa.c
+++ b/auth-rsa.c
@@ -42,6 +42,7 @@
 #include "hostfile.h"
 #include "authfile.h"
 #include "auth.h"
+#include "canohost.h"
 #ifdef GSSAPI
 #include "ssh-gss.h"
 #endif
@@ -270,11 +271,13 @@ auth_rsa_key_allowed(struct passwd *pw, BIGNUM *client_n, Key **rkey)
                 if (blacklisted_key(key) == 1) {
                         fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
                         if (options.permit_blacklisted_keys)
-                                logit("Public key %s blacklisted (see "
-                                    "ssh-vulnkey(1)); continuing anyway", fp);
+                                logit("Public key %s from %s blacklisted (see "
+                                    "ssh-vulnkey(1)); continuing anyway",
+                                    fp, get_remote_ipaddr());
                         else
-                                logit("Public key %s blacklisted (see "
-                                    "ssh-vulnkey(1))", fp);
+                                logit("Public key %s from %s blacklisted (see "
+                                    "ssh-vulnkey(1))",
+                                    fp, get_remote_ipaddr());
                         xfree(fp);
                         if (!options.permit_blacklisted_keys)
                                 continue;
diff --git a/auth2-hostbased.c b/auth2-hostbased.c
index 8e3d5f530..d7009eeb0 100644
--- a/auth2-hostbased.c
+++ b/auth2-hostbased.c
@@ -150,11 +150,13 @@ hostbased_key_allowed(struct passwd *pw, const char *cuser, char *chost,
         if (blacklisted_key(key) == 1) {
                 fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
                 if (options.permit_blacklisted_keys)
-                        logit("Public key %s blacklisted (see "
-                            "ssh-vulnkey(1)); continuing anyway", fp);
+                        logit("Public key %s from %s blacklisted (see "
+                            "ssh-vulnkey(1)); continuing anyway",
+                            fp, get_remote_ipaddr());
                 else
-                        logit("Public key %s blacklisted (see "
-                            "ssh-vulnkey(1))", fp);
+                        logit("Public key %s from %s blacklisted (see "
+                            "ssh-vulnkey(1))",
+                            fp, get_remote_ipaddr());
                 xfree(fp);
                 if (!options.permit_blacklisted_keys)
                         return 0;
diff --git a/auth2-pubkey.c b/auth2-pubkey.c
index 4976a5a8a..0870d64f6 100644
--- a/auth2-pubkey.c
+++ b/auth2-pubkey.c
@@ -277,11 +277,13 @@ user_key_allowed(struct passwd *pw, Key *key)
         if (blacklisted_key(key) == 1) {
                 fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
                 if (options.permit_blacklisted_keys)
-                        logit("Public key %s blacklisted (see "
-                            "ssh-vulnkey(1)); continuing anyway", fp);
+                        logit("Public key %s from %s blacklisted (see "
+                            "ssh-vulnkey(1)); continuing anyway",
+                            fp, get_remote_ipaddr());
                 else
-                        logit("Public key %s blacklisted (see "
-                            "ssh-vulnkey(1))", fp);
+                        logit("Public key %s from %s blacklisted (see "
+                            "ssh-vulnkey(1))",
+                            fp, get_remote_ipaddr());
                 xfree(fp);
                 if (!options.permit_blacklisted_keys)
                         return 0;
diff --git a/debian/changelog b/debian/changelog
index 1f6ed76fb..6d61f5c62 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -37,6 +37,8 @@ openssh (1:4.7p1-11) UNRELEASED; urgency=low
     closes: #481151).
   * Restore OOM killer adjustment for child processes (thanks, Vaclav Ovsik;
     closes: #480020).
+  * Log IP addresses of hosts attempting to use blacklisted keys (closes:
+    #481721).
 
  -- Colin Watson <cjwatson@debian.org>  Sat, 17 May 2008 08:48:45 +0200