diff options
author | Colin Watson <cjwatson@ubuntu.com> | 2014-02-09 16:09:50 +0000 |
---|---|---|
committer | Colin Watson <cjwatson@debian.org> | 2014-02-09 16:17:31 +0000 |
commit | 8909ff0e3cd07d1b042d1be1c8b8828dbf6c9a83 (patch) | |
tree | ebee4092f1411059e34da6f66b4ebd64f4411020 /ssh-add.1 | |
parent | 07f2a771c490bd68cd5c5ea9c535705e93bd94f3 (diff) |
Reject vulnerable keys to mitigate Debian OpenSSL flaw
In 2008, Debian (and derived distributions such as Ubuntu) shipped an
OpenSSL package with a flawed random number generator, causing OpenSSH to
generate only a very limited set of keys which were subject to private half
precomputation. To mitigate this, this patch checks key authentications
against a blacklist of known-vulnerable keys, and adds a new ssh-vulnkey
program which can be used to explicitly check keys against that blacklist.
See CVE-2008-0166.
Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1469
Last-Update: 2013-09-14
Patch-Name: ssh-vulnkey.patch
Diffstat (limited to 'ssh-add.1')
-rw-r--r-- | ssh-add.1 | 5 |
1 files changed, 5 insertions, 0 deletions
@@ -81,6 +81,10 @@ environment variable must contain the name of its socket for | |||
81 | .Nm | 81 | .Nm |
82 | to work. | 82 | to work. |
83 | .Pp | 83 | .Pp |
84 | Any keys recorded in the blacklist of known-compromised keys (see | ||
85 | .Xr ssh-vulnkey 1 ) | ||
86 | will be refused. | ||
87 | .Pp | ||
84 | The options are as follows: | 88 | The options are as follows: |
85 | .Bl -tag -width Ds | 89 | .Bl -tag -width Ds |
86 | .It Fl c | 90 | .It Fl c |
@@ -186,6 +190,7 @@ is unable to contact the authentication agent. | |||
186 | .Xr ssh 1 , | 190 | .Xr ssh 1 , |
187 | .Xr ssh-agent 1 , | 191 | .Xr ssh-agent 1 , |
188 | .Xr ssh-keygen 1 , | 192 | .Xr ssh-keygen 1 , |
193 | .Xr ssh-vulnkey 1 , | ||
189 | .Xr sshd 8 | 194 | .Xr sshd 8 |
190 | .Sh AUTHORS | 195 | .Sh AUTHORS |
191 | OpenSSH is a derivative of the original and free | 196 | OpenSSH is a derivative of the original and free |