Check compromised key blacklist in ssh or ssh-add, as well as in the

server (LP: #232391). To override the blacklist check in ssh
temporarily, use 'ssh -o UseBlacklistedKeys=yes'; there is no override
for the blacklist check in ssh-add.

1 files changed, 9 insertions, 1 deletions

diff --git a/ssh-add.c b/ssh-add.c
index 4dc46f6db..f3e30a24d 100644
--- a/ssh-add.c
+++ b/ssh-add.c
@@ -138,7 +138,7 @@ static int
 add_file(AuthenticationConnection *ac, const char *filename)
 {
         Key *private;
-        char *comment = NULL;
+        char *comment = NULL, *fp;
         char msg[1024];
         int fd, perms_ok, ret = -1;
 
@@ -183,6 +183,14 @@ add_file(AuthenticationConnection *ac, const char *filename)
                             "Bad passphrase, try again for %.200s: ", comment);
                 }
         }
+        if (blacklisted_key(private, &fp) == 1) {
+                fprintf(stderr, "Public key %s blacklisted (see "
+                    "ssh-vulnkey(1)); refusing to add it\n", fp);
+                xfree(fp);
+                key_free(private);
+                xfree(comment);
+                return -1;
+        }
 
         if (ssh_add_identity_constrained(ac, private, comment, lifetime,
             confirm)) {