18 files changed, 756 insertions, 9 deletions

diff --git a/Makefile.in b/Makefile.in
index 3ac9aaf45..0c6f7e550 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -60,7 +60,7 @@ EXEEXT=@EXEEXT@
 INSTALL_SSH_PRNG_CMDS=@INSTALL_SSH_PRNG_CMDS@
 INSTALL_SSH_RAND_HELPER=@INSTALL_SSH_RAND_HELPER@
 
-TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-agent$(EXEEXT) scp$(EXEEXT) ssh-rand-helper${EXEEXT} sftp-server$(EXEEXT) sftp$(EXEEXT)
+TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-agent$(EXEEXT) scp$(EXEEXT) ssh-rand-helper${EXEEXT} sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-vulnkey$(EXEEXT)
 
 LIBSSH_OBJS=acss.o authfd.o authfile.o bufaux.o bufbn.o buffer.o \
         canohost.o channels.o cipher.o cipher-acss.o cipher-aes.o \
@@ -88,8 +88,8 @@ SSHDOBJS=sshd.o auth-rhosts.o auth-passwd.o auth-rsa.o auth-rh-rsa.o \
         loginrec.o auth-pam.o auth-shadow.o auth-sia.o md5crypt.o \
         audit.o audit-bsm.o platform.o
 
-MANPAGES        = scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-rand-helper.8.out ssh-keysign.8.out sshd_config.5.out ssh_config.5.out
-MANPAGES_IN     = scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-rand-helper.8 ssh-keysign.8 sshd_config.5 ssh_config.5
+MANPAGES        = scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-rand-helper.8.out ssh-keysign.8.out ssh-vulnkey.1.out sshd_config.5.out ssh_config.5.out
+MANPAGES_IN     = scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-rand-helper.8 ssh-keysign.8 ssh-vulnkey.1 sshd_config.5 ssh_config.5
 MANTYPE         = @MANTYPE@
 
 CONFIGFILES=sshd_config.out ssh_config.out moduli.out
@@ -165,6 +165,9 @@ sftp$(EXEEXT): $(LIBCOMPAT) libssh.a sftp.o sftp-client.o sftp-common.o sftp-glo
 ssh-rand-helper${EXEEXT}: $(LIBCOMPAT) libssh.a ssh-rand-helper.o
         $(LD) -o $@ ssh-rand-helper.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
 
+ssh-vulnkey$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-vulnkey.o
+        $(LD) -o $@ ssh-vulnkey.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
+
 # test driver for the loginrec code - not built by default
 logintest: logintest.o $(LIBCOMPAT) libssh.a loginrec.o
         $(LD) -o $@ logintest.o $(LDFLAGS) loginrec.o -lopenbsd-compat -lssh $(LIBS)
@@ -264,6 +267,7 @@ install-files: scard-install
         $(INSTALL) -m 4711 $(STRIP_OPT) ssh-keysign $(DESTDIR)$(SSH_KEYSIGN)
         $(INSTALL) -m 0755 $(STRIP_OPT) sftp $(DESTDIR)$(bindir)/sftp
         $(INSTALL) -m 0755 $(STRIP_OPT) sftp-server $(DESTDIR)$(SFTP_SERVER)
+        $(INSTALL) -m 0755 $(STRIP_OPT) ssh-vulnkey $(DESTDIR)$(bindir)/ssh-vulnkey
         $(INSTALL) -m 644 ssh.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
         $(INSTALL) -m 644 scp.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/scp.1
         $(INSTALL) -m 644 ssh-add.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-add.1
@@ -280,6 +284,7 @@ install-files: scard-install
         $(INSTALL) -m 644 sftp.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/sftp.1
         $(INSTALL) -m 644 sftp-server.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/sftp-server.8
         $(INSTALL) -m 644 ssh-keysign.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8
+        $(INSTALL) -m 644 ssh-vulnkey.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-vulnkey.1
         -rm -f $(DESTDIR)$(bindir)/slogin
         ln -s ssh$(EXEEXT) $(DESTDIR)$(bindir)/slogin
         -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/slogin.1
@@ -361,6 +366,7 @@ uninstall:
         -rm -f $(DESTDIR)$(bindir)/ssh-agent$(EXEEXT)
         -rm -f $(DESTDIR)$(bindir)/ssh-keygen$(EXEEXT)
         -rm -f $(DESTDIR)$(bindir)/ssh-keyscan$(EXEEXT)
+        -rm -f $(DESTDIR)$(bindir)/ssh-vulnkey$(EXEEXT)
         -rm -f $(DESTDIR)$(bindir)/sftp$(EXEEXT)
         -rm -f $(DESTDIR)$(sbindir)/sshd$(EXEEXT)
         -rm -r $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
@@ -373,6 +379,7 @@ uninstall:
         -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-keygen.1
         -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/sftp.1
         -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-keyscan.1
+        -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-vulnkey.1
         -rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/sshd.8
         -rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-rand-helper.8
         -rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/sftp-server.8
diff --git a/auth-rh-rsa.c b/auth-rh-rsa.c
index eca750275..093461e83 100644
--- a/auth-rh-rsa.c
+++ b/auth-rh-rsa.c
@@ -20,6 +20,7 @@
 #include <pwd.h>
 #include <stdarg.h>
 
+#include "xmalloc.h"
 #include "packet.h"
 #include "uidswap.h"
 #include "log.h"
@@ -27,6 +28,7 @@
 #include "servconf.h"
 #include "key.h"
 #include "hostfile.h"
+#include "authfile.h"
 #include "pathnames.h"
 #include "auth.h"
 #include "canohost.h"
@@ -42,8 +44,22 @@ int
 auth_rhosts_rsa_key_allowed(struct passwd *pw, char *cuser, char *chost,
     Key *client_host_key)
 {
+        char *fp;
         HostStatus host_status;
 
+        if (blacklisted_key(client_host_key)) {
+                fp = key_fingerprint(client_host_key, SSH_FP_MD5, SSH_FP_HEX);
+                if (options.permit_blacklisted_keys)
+                        logit("Public key %s blacklisted (see "
+                            "ssh-vulnkey(1)); continuing anyway", fp);
+                else
+                        logit("Public key %s blacklisted (see "
+                            "ssh-vulnkey(1))", fp);
+                xfree(fp);
+                if (!options.permit_blacklisted_keys)
+                        return 0;
+        }
+
         /* Check if we would accept it using rhosts authentication. */
         if (!auth_rhosts(pw, cuser))
                 return 0;
diff --git a/auth-rsa.c b/auth-rsa.c
index 69f9a5896..1d277f92a 100644
--- a/auth-rsa.c
+++ b/auth-rsa.c
@@ -40,6 +40,7 @@
 #include "servconf.h"
 #include "key.h"
 #include "hostfile.h"
+#include "authfile.h"
 #include "auth.h"
 #ifdef GSSAPI
 #include "ssh-gss.h"
@@ -221,6 +222,7 @@ auth_rsa_key_allowed(struct passwd *pw, BIGNUM *client_n, Key **rkey)
                 char *cp;
                 char *key_options;
                 int keybits;
+                char *fp;
 
                 /* Skip leading whitespace, empty and comment lines. */
                 for (cp = line; *cp == ' ' || *cp == '\t'; cp++)
@@ -265,6 +267,19 @@ auth_rsa_key_allowed(struct passwd *pw, BIGNUM *client_n, Key **rkey)
                             "actual %d vs. announced %d.",
                             file, linenum, BN_num_bits(key->rsa->n), bits);
 
+                if (blacklisted_key(key)) {
+                        fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
+                        if (options.permit_blacklisted_keys)
+                                logit("Public key %s blacklisted (see "
+                                    "ssh-vulnkey(1)); continuing anyway", fp);
+                        else
+                                logit("Public key %s blacklisted (see "
+                                    "ssh-vulnkey(1))", fp);
+                        xfree(fp);
+                        if (!options.permit_blacklisted_keys)
+                                continue;
+                }
+
                 /* We have found the desired key. */
                 /*
                  * If our options do not allow this key to be used,
diff --git a/auth2-hostbased.c b/auth2-hostbased.c
index 663dec5d9..a0ee3060a 100644
--- a/auth2-hostbased.c
+++ b/auth2-hostbased.c
@@ -40,6 +40,7 @@
 #include "compat.h"
 #include "key.h"
 #include "hostfile.h"
+#include "authfile.h"
 #include "auth.h"
 #include "canohost.h"
 #ifdef GSSAPI
@@ -141,10 +142,24 @@ int
 hostbased_key_allowed(struct passwd *pw, const char *cuser, char *chost,
     Key *key)
 {
+        char *fp;
         const char *resolvedname, *ipaddr, *lookup;
         HostStatus host_status;
         int len;
 
+        if (blacklisted_key(key)) {
+                fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
+                if (options.permit_blacklisted_keys)
+                        logit("Public key %s blacklisted (see "
+                            "ssh-vulnkey(1)); continuing anyway", fp);
+                else
+                        logit("Public key %s blacklisted (see "
+                            "ssh-vulnkey(1))", fp);
+                xfree(fp);
+                if (!options.permit_blacklisted_keys)
+                        return 0;
+        }
+
         resolvedname = get_canonical_hostname(options.use_dns);
         ipaddr = get_remote_ipaddr();
 
diff --git a/auth2-pubkey.c b/auth2-pubkey.c
index 9863cd9e6..cf911968a 100644
--- a/auth2-pubkey.c
+++ b/auth2-pubkey.c
@@ -42,6 +42,7 @@
 #include "compat.h"
 #include "key.h"
 #include "hostfile.h"
+#include "authfile.h"
 #include "auth.h"
 #include "pathnames.h"
 #include "uidswap.h"
@@ -269,9 +270,23 @@ user_key_allowed2(struct passwd *pw, Key *key, char *file)
 int
 user_key_allowed(struct passwd *pw, Key *key)
 {
+        char *fp;
         int success;
         char *file;
 
+        if (blacklisted_key(key)) {
+                fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
+                if (options.permit_blacklisted_keys)
+                        logit("Public key %s blacklisted (see "
+                            "ssh-vulnkey(1)); continuing anyway", fp);
+                else
+                        logit("Public key %s blacklisted (see "
+                            "ssh-vulnkey(1))", fp);
+                xfree(fp);
+                if (!options.permit_blacklisted_keys)
+                        return 0;
+        }
+
         file = authorized_keys_file(pw);
         success = user_key_allowed2(pw, key, file);
         xfree(file);
diff --git a/authfile.c b/authfile.c
index 735c64780..5348a014d 100644
--- a/authfile.c
+++ b/authfile.c
@@ -65,6 +65,7 @@
 #include "rsa.h"
 #include "misc.h"
 #include "atomicio.h"
+#include "pathnames.h"
 
 /* Version identification string for SSH v1 identity files. */
 static const char authfile_id_string[] =
@@ -677,3 +678,113 @@ key_load_public(const char *filename, char **commentp)
         key_free(pub);
         return NULL;
 }
+
+char *
+blacklist_filename(const Key *key)
+{
+        char *name;
+
+        xasprintf(&name, "%s.%s-%u",
+            _PATH_BLACKLIST, key_type(key), key_size(key));
+        return name;
+}
+
+/* Scan a blacklist of known-vulnerable keys. */
+int
+blacklisted_key(const Key *key)
+{
+        char *blacklist_file;
+        int fd = -1;
+        char *dgst_hex = NULL;
+        char *dgst_packed = NULL, *p;
+        int i;
+        size_t line_len;
+        struct stat st;
+        char buf[256];
+        off_t start, lower, upper;
+        int ret = 0;
+
+        blacklist_file = blacklist_filename(key);
+        debug("Checking blacklist file %s", blacklist_file);
+        fd = open(blacklist_file, O_RDONLY);
+        if (fd < 0)
+                goto out;
+
+        dgst_hex = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
+        /* Remove all colons */
+        dgst_packed = xcalloc(1, strlen(dgst_hex) + 1);
+        for (i = 0, p = dgst_packed; dgst_hex[i]; i++)
+                if (dgst_hex[i] != ':')
+                        *p++ = dgst_hex[i];
+        /* Only compare least-significant 80 bits (to keep the blacklist
+         * size down)
+         */
+        line_len = strlen(dgst_packed + 12);
+        if (line_len > 32)
+                goto out;
+
+        /* Skip leading comments */
+        start = 0;
+        for (;;) {
+                ssize_t r;
+                char *newline;
+
+                r = atomicio(read, fd, buf, 256);
+                if (r <= 0)
+                        goto out;
+                if (buf[0] != '#')
+                        break;
+
+                newline = memchr(buf, '\n', 256);
+                if (!newline)
+                        goto out;
+                start += newline + 1 - buf;
+                if (lseek(fd, start, SEEK_SET) < 0)
+                        goto out;
+        }
+
+        /* Initialise binary search record numbers */
+        if (fstat(fd, &st) < 0)
+                goto out;
+        lower = 0;
+        upper = (st.st_size - start) / (line_len + 1);
+
+        while (lower != upper) {
+                off_t cur;
+                char buf[32];
+                int cmp;
+
+                cur = lower + (upper - lower) / 2;
+
+                /* Read this line and compare to digest; this is
+                 * overflow-safe since cur < max(off_t) / (line_len + 1) */
+                if (lseek(fd, start + cur * (line_len + 1), SEEK_SET) < 0)
+                        break;
+                if (atomicio(read, fd, buf, line_len) != line_len)
+                        break;
+                cmp = memcmp(buf, dgst_packed + 12, line_len);
+                if (cmp < 0) {
+                        if (cur == lower)
+                                break;
+                        lower = cur;
+                } else if (cmp > 0) {
+                        if (cur == upper)
+                                break;
+                        upper = cur;
+                } else {
+                        debug("Found %s in blacklist", dgst_hex);
+                        ret = 1;
+                        break;
+                }
+        }
+
+out:
+        if (dgst_packed)
+                xfree(dgst_packed);
+        if (dgst_hex)
+                xfree(dgst_hex);
+        if (fd >= 0)
+                close(fd);
+        xfree(blacklist_file);
+        return ret;
+}
diff --git a/authfile.h b/authfile.h
index a6c74934d..e47710495 100644
--- a/authfile.h
+++ b/authfile.h
@@ -23,4 +23,7 @@ Key	*key_load_private_type(int, const char *, const char *, char **, int *);
 Key     *key_load_private_pem(int, int, const char *, char **);
 int      key_perm_ok(int, const char *);
 
+char    *blacklist_filename(const Key *key);
+int      blacklisted_key(const Key *key);
+
 #endif
diff --git a/debian/changelog b/debian/changelog
index 9a9095189..95ab72caf 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,6 +1,19 @@
-openssh (1:4.7p1-9) UNRELEASED; urgency=low
+openssh (1:4.7p1-9) UNRELEASED; urgency=critical
 
   * Fill in CVE identifier for security vulnerability fixed in 1:4.7p1-8.
+  * Mitigate OpenSSL security vulnerability:
+    - Add key blacklisting support. Keys listed in
+      /etc/ssh/blacklist.TYPE-LENGTH will be rejected for authentication by
+      sshd, unless "PermitBlacklistedKeys yes" is set in
+      /etc/ssh/sshd_config.
+    - Add a new program, ssh-vulnkey, which can be used to check keys
+      against these blacklists.
+    - Depend on openssh-blacklist.
+    - Force dependencies on libssl0.9.8 / libcrypto0.9.8-udeb to at least
+      0.9.8g-9.
+    - Automatically regenerate known-compromised host keys, with a
+      critical-priority debconf note. (I regret that there was no time to
+      gather translations.)
 
  -- Colin Watson <cjwatson@debian.org>  Wed, 09 Apr 2008 14:57:43 +0100
 
diff --git a/debian/control b/debian/control
index 290799998..c2bf961eb 100644
--- a/debian/control
+++ b/debian/control
@@ -8,7 +8,7 @@ Uploaders: Colin Watson <cjwatson@debian.org>, Matthew Vernon <matthew@debian.or
 
 Package: openssh-client
 Architecture: any
-Depends: ${shlibs:Depends}, debconf (>= 1.2.0) | debconf-2.0, adduser (>= 3.10), dpkg (>= 1.7.0), passwd
+Depends: ${shlibs:Depends}, debconf (>= 1.2.0) | debconf-2.0, adduser (>= 3.10), dpkg (>= 1.7.0), passwd, libssl0.9.8 (>= 0.9.8g-9)
 Recommends: xauth
 Conflicts: ssh (<< 1:3.8.1p1-9), sftp, rsh-client (<<0.16.1-1), ssh-krb5 (<< 1:4.3p2-7)
 Replaces: ssh, ssh-krb5
@@ -37,7 +37,7 @@ Description: secure shell client, an rlogin/rsh/rcp replacement
 Package: openssh-server
 Priority: optional
 Architecture: any
-Depends: ${shlibs:Depends}, debconf (>= 1.2.0) | debconf-2.0, libpam-runtime (>= 0.76-14), libpam-modules (>= 0.72-9), adduser (>= 3.9), dpkg (>= 1.9.0), openssh-client (= ${binary:Version}), lsb-base (>= 3.0-6)
+Depends: ${shlibs:Depends}, debconf (>= 1.2.0) | debconf-2.0, libpam-runtime (>= 0.76-14), libpam-modules (>= 0.72-9), adduser (>= 3.9), dpkg (>= 1.9.0), openssh-client (= ${binary:Version}), lsb-base (>= 3.0-6), libssl0.9.8 (>= 0.9.8g-9), openssh-blacklist
 Recommends: xauth
 Conflicts: ssh (<< 1:3.8.1p1-9), ssh-nonfree (<<2), ssh-socks, ssh2, sftp, rsh-client (<<0.16.1-1), ssh-krb5 (<< 1:4.3p2-7)
 Replaces: ssh, openssh-client (<< 1:3.8.1p1-11), ssh-krb5
@@ -99,7 +99,7 @@ XC-Package-Type: udeb
 Section: debian-installer
 Priority: optional
 Architecture: any
-Depends: ${shlibs:Depends}, libnss-files-udeb
+Depends: ${shlibs:Depends}, libnss-files-udeb, libcrypto0.9.8-udeb (>= 0.9.8g-9)
 XB-Installer-Menu-Item: 99900
 Description: secure shell client for the Debian installer
  This is the portable version of OpenSSH, a free implementation of
@@ -113,7 +113,7 @@ XC-Package-Type: udeb
 Section: debian-installer
 Priority: optional
 Architecture: any
-Depends: ${shlibs:Depends}, libnss-files-udeb
+Depends: ${shlibs:Depends}, libnss-files-udeb, libcrypto0.9.8-udeb (>= 0.9.8g-9)
 Description: secure shell server for the Debian installer
  This is the portable version of OpenSSH, a free implementation of
  the Secure Shell protocol as specified by the IETF secsh working
diff --git a/debian/openssh-server.postinst b/debian/openssh-server.postinst
index 1d26a7b55..b7ea210c4 100644
--- a/debian/openssh-server.postinst
+++ b/debian/openssh-server.postinst
@@ -183,6 +183,35 @@ create_keys() {
 }
 
 
+vulnerable_host_keys() {
+        # If the admin has explicitly put the vulnerable keys back, we
+        # assume they can look after themselves.
+        db_fget ssh/vulnerable_host_keys seen
+        if [ "$RET" = true ]; then
+                return 0
+        fi
+
+        hostkeys="$(host_keys_required)"
+        vulnerable=
+        for hostkey in $hostkeys; do
+                [ -f "$hostkey" ] || continue
+                if ssh-vulnkey -q "$hostkey"; then
+                        vulnerable="${vulnerable:+$vulnerable }$hostkey"
+                fi
+        done
+        if [ "$vulnerable" ]; then
+                db_subst ssh/vulnerable_host_keys HOST_KEYS "$vulnerable"
+                db_input critical ssh/vulnerable_host_keys || true
+                db_go
+                for hostkey in $vulnerable; do
+                        mv "$hostkey" "$hostkey.broken" || true
+                        mv "$hostkey.pub" "$hostkey.pub.broken" || true
+                done
+                create_keys
+        fi
+}
+
+
 check_password_auth() {
         passwordauth="$(get_config_option PasswordAuthentication)"
         crauth="$(get_config_option ChallengeResponseAuthentication)"
@@ -422,6 +451,7 @@ fix_doc_symlink
 create_sshdconfig
 check_idea_key
 create_keys
+vulnerable_host_keys
 fix_statoverride
 if dpkg --compare-versions "$2" lt 1:4.3p2-3; then
     fix_sshd_shell
diff --git a/debian/openssh-server.templates b/debian/openssh-server.templates
index 2cc62f8f1..6c1187e7f 100644
--- a/debian/openssh-server.templates
+++ b/debian/openssh-server.templates
@@ -62,3 +62,23 @@ _Description: Disable challenge-response authentication?
  able to log in using passwords. If you leave it enabled (the default
  answer), then the 'PasswordAuthentication no' option will have no useful
  effect unless you also adjust your PAM configuration in /etc/pam.d/ssh.
+
+Template: ssh/vulnerable_host_keys
+Type: note
+_Description: Vulnerable host keys will be regenerated
+ Some of the OpenSSH server host keys on this system were generated with a
+ version of OpenSSL that had a broken random number generator. As a result,
+ these host keys are from a well-known set, are subject to brute-force
+ attacks, and must be regenerated.
+ .
+ Users of this system should be informed of this change, as they will be
+ prompted about the host key change the next time they log in. Use
+ 'ssh-keygen -l -f HOST_KEY_FILE' after the upgrade has changed to print the
+ fingerprints of the new host keys.
+ .
+ The affected host keys are:
+ .
+ ${HOST_KEYS}
+ .
+ User keys may also be affected by this problem. The 'ssh-vulnkey' command
+ may be used as a partial test for this.
diff --git a/pathnames.h b/pathnames.h
index f2571e274..8886e8edd 100644
--- a/pathnames.h
+++ b/pathnames.h
@@ -43,6 +43,8 @@
 /* Backwards compatibility */
 #define _PATH_DH_PRIMES                 SSHDIR "/primes"
 
+#define _PATH_BLACKLIST                 SSHDIR "/blacklist"
+
 #ifndef _PATH_SSH_PROGRAM
 #define _PATH_SSH_PROGRAM               "/usr/bin/ssh"
 #endif
diff --git a/servconf.c b/servconf.c
index 14a9dde3d..c5688912d 100644
--- a/servconf.c
+++ b/servconf.c
@@ -96,6 +96,7 @@ initialize_server_options(ServerOptions *options)
         options->password_authentication = -1;
         options->kbd_interactive_authentication = -1;
         options->challenge_response_authentication = -1;
+        options->permit_blacklisted_keys = -1;
         options->permit_empty_passwd = -1;
         options->permit_user_env = -1;
         options->use_login = -1;
@@ -218,6 +219,8 @@ fill_default_server_options(ServerOptions *options)
                 options->kbd_interactive_authentication = 0;
         if (options->challenge_response_authentication == -1)
                 options->challenge_response_authentication = 1;
+        if (options->permit_blacklisted_keys == -1)
+                options->permit_blacklisted_keys = 0;
         if (options->permit_empty_passwd == -1)
                 options->permit_empty_passwd = 0;
         if (options->permit_user_env == -1)
@@ -287,7 +290,7 @@ typedef enum {
         sListenAddress, sAddressFamily,
         sPrintMotd, sPrintLastLog, sIgnoreRhosts,
         sX11Forwarding, sX11DisplayOffset, sX11UseLocalhost,
-        sStrictModes, sEmptyPasswd, sTCPKeepAlive,
+        sStrictModes, sPermitBlacklistedKeys, sEmptyPasswd, sTCPKeepAlive,
         sPermitUserEnvironment, sUseLogin, sAllowTcpForwarding, sCompression,
         sAllowUsers, sDenyUsers, sAllowGroups, sDenyGroups,
         sIgnoreUserKnownHosts, sCiphers, sMacs, sProtocol, sPidFile,
@@ -387,6 +390,7 @@ static struct {
         { "x11uselocalhost", sX11UseLocalhost, SSHCFG_ALL },
         { "xauthlocation", sXAuthLocation, SSHCFG_GLOBAL },
         { "strictmodes", sStrictModes, SSHCFG_GLOBAL },
+        { "permitblacklistedkeys", sPermitBlacklistedKeys, SSHCFG_GLOBAL },
         { "permitemptypasswords", sEmptyPasswd, SSHCFG_GLOBAL },
         { "permituserenvironment", sPermitUserEnvironment, SSHCFG_GLOBAL },
         { "uselogin", sUseLogin, SSHCFG_GLOBAL },
@@ -943,6 +947,10 @@ parse_flag:
                 intptr = &options->tcp_keep_alive;
                 goto parse_flag;
 
+        case sPermitBlacklistedKeys:
+                intptr = &options->permit_blacklisted_keys;
+                goto parse_flag;
+
         case sEmptyPasswd:
                 intptr = &options->permit_empty_passwd;
                 goto parse_flag;
diff --git a/servconf.h b/servconf.h
index 257de1c8b..be42e9f60 100644
--- a/servconf.h
+++ b/servconf.h
@@ -94,6 +94,7 @@ typedef struct {
                                                  * authentication. */
         int     kbd_interactive_authentication; /* If true, permit */
         int     challenge_response_authentication;
+        int     permit_blacklisted_keys;        /* If true, permit */
         int     permit_empty_passwd;    /* If false, do not permit empty
                                          * passwords. */
         int     permit_user_env;        /* If true, read ~/.ssh/environment */
diff --git a/ssh-vulnkey.1 b/ssh-vulnkey.1
new file mode 100644
index 000000000..9286e73c0
--- /dev/null
+++ b/ssh-vulnkey.1
@@ -0,0 +1,151 @@
+.\" Copyright (c) 2008 Canonical Ltd.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\" 1. Redistributions of source code must retain the above copyright
+.\"    notice, this list of conditions and the following disclaimer.
+.\" 2. Redistributions in binary form must reproduce the above copyright
+.\"    notice, this list of conditions and the following disclaimer in the
+.\"    documentation and/or other materials provided with the distribution.
+.\"
+.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+.\"
+.Dd $Mdocdate: May 12 2008 $
+.Dt SSH-VULNKEY 1
+.Os
+.Sh NAME
+.Nm ssh-vulnkey
+.Nd check blacklist of compromised keys
+.Sh SYNOPSIS
+.Nm
+.Op Fl q
+.Ar file ...
+.Nm
+.Fl a
+.Sh DESCRIPTION
+.Nm
+checks a key against a blacklist of compromised keys.
+.Pp
+A substantial number of keys are known to have been generated using a broken
+version of OpenSSL distributed by Debian which failed to seed its random
+number generator correctly.
+Keys generated using these OpenSSL versions should be assumed to be
+compromised.
+This tool may be useful in checking for such keys.
+.Pp
+Keys that are compromised cannot be repaired; replacements must be generated
+using
+.Xr ssh-keygen 1 .
+Make sure to update
+.Pa authorized_keys
+files on all systems where compromised keys were permitted to authenticate.
+.Pp
+The argument list will be interpreted as a list of paths to public key files
+or
+.Pa authorized_keys
+files.
+If no suitable file is found at a given path,
+.Nm
+will append
+.Pa .pub
+and retry, in case it was given a private key file.
+If no files are given as arguments,
+.Nm
+will check
+.Pa ~/.ssh/id_rsa ,
+.Pa ~/.ssh/id_dsa ,
+.Pa ~/.ssh/identity ,
+.Pa ~/.ssh/authorized_keys
+and
+.Pa ~/.ssh/authorized_keys2 ,
+as well as the system's host keys if readable.
+.Pp
+If
+.Dq -
+is given as an argument,
+.Nm
+will read from standard input.
+This can be used to process output from
+.Xr ssh-keyscan 1 ,
+for example:
+.Pp
+.Dl $ ssh-keyscan -t rsa remote.example.org | ssh-vulnkey -
+.Pp
+.Nm
+will exit zero if any of the given keys were in the compromised list,
+otherwise non-zero.
+.Pp
+Unless the
+.Cm PermitBlacklistedKeys
+option is used,
+.Xr sshd 8
+will reject attempts to authenticate with keys in the compromised list.
+.Pp
+The options are as follows:
+.Bl -tag -width Ds
+.It Fl a
+Check keys of all users on the system.
+You will typically need to run
+.Nm
+as root to use this option.
+For each user,
+.Nm
+will check
+.Pa ~/.ssh/id_rsa ,
+.Pa ~/.ssh/id_dsa ,
+.Pa ~/.ssh/identity ,
+.Pa ~/.ssh/authorized_keys
+and
+.Pa ~/.ssh/authorized_keys2 .
+It will also check the system's host keys.
+.It Fl q
+Quiet mode.
+Normally,
+.Nm
+outputs the fingerprint of each key scanned, with a description of its
+status.
+This option suppresses that output.
+.El
+.Sh BLACKLIST FILE FORMAT
+The blacklist file may start with comments, on lines starting with
+.Dq # .
+After these initial comments, it must follow a strict format:
+.Pp
+.Bl -bullet -offset indent -compact
+.It
+All the lines must be exactly the same length (20 characters followed by a
+newline) and must be in sorted order.
+.It
+Each line must consist of the lower-case hexadecimal MD5 key fingerprint,
+without colons, and with the first 12 characters removed (that is, the least
+significant 80 bits of the fingerprint).
+.El
+.Pp
+The key fingerprint may be generated using
+.Xr ssh-keygen 1 :
+.Pp
+.Dl $ ssh-keygen -l -f /path/to/key
+.Pp
+This strict format is necessary to allow the blacklist file to be checked
+quickly, using a binary-search algorithm.
+.Sh SEE ALSO
+.Xr ssh-keygen 1 ,
+.Xr sshd 8
+.Sh AUTHORS
+.An -nosplit
+.An Colin Watson Aq cjwatson@ubuntu.com
+.Pp
+Florian Weimer suggested the option to check keys of all users, and the idea
+of processing
+.Xr ssh-keyscan 1
+output.
diff --git a/ssh-vulnkey.c b/ssh-vulnkey.c
new file mode 100644
index 000000000..ba87cbd28
--- /dev/null
+++ b/ssh-vulnkey.c
@@ -0,0 +1,311 @@
+/*
+ * Copyright (c) 2008 Canonical Ltd.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "includes.h"
+
+#include <sys/types.h>
+#include <sys/stat.h>
+
+#include <string.h>
+#include <stdio.h>
+#include <fcntl.h>
+#include <unistd.h>
+
+#include <openssl/evp.h>
+
+#include "xmalloc.h"
+#include "ssh.h"
+#include "log.h"
+#include "key.h"
+#include "authfile.h"
+#include "pathnames.h"
+#include "misc.h"
+
+extern char *__progname;
+
+/* Default files to check */
+static char *default_host_files[] = {
+        _PATH_HOST_RSA_KEY_FILE,
+        _PATH_HOST_DSA_KEY_FILE,
+        _PATH_HOST_KEY_FILE,
+        NULL
+};
+static char *default_files[] = {
+        _PATH_SSH_CLIENT_ID_RSA,
+        _PATH_SSH_CLIENT_ID_DSA,
+        _PATH_SSH_CLIENT_IDENTITY,
+        _PATH_SSH_USER_PERMITTED_KEYS,
+        _PATH_SSH_USER_PERMITTED_KEYS2,
+        NULL
+};
+
+static int quiet = 0;
+
+static void
+usage(void)
+{
+        fprintf(stderr, "usage: %s [-aq] [file ...]\n", __progname);
+        fprintf(stderr, "Options:\n");
+        fprintf(stderr, "  -a          Check keys of all users.\n");
+        fprintf(stderr, "  -q          Quiet mode.\n");
+        exit(1);
+}
+
+void
+describe_key(const char *msg, const Key *key, const char *comment)
+{
+        char *fp;
+
+        fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
+        if (!quiet)
+                printf("%s: %u %s %s\n", msg, key_size(key), fp, comment);
+        xfree(fp);
+}
+
+int
+do_key(const Key *key, const char *comment)
+{
+        char *blacklist_file;
+        struct stat st;
+        int ret = 1;
+
+        blacklist_file = blacklist_filename(key);
+        if (stat(blacklist_file, &st) < 0)
+                describe_key("Unknown (no blacklist information)",
+                    key, comment);
+        else if (blacklisted_key(key)) {
+                describe_key("COMPROMISED", key, comment);
+                ret = 0;
+        } else
+                describe_key("Not blacklisted", key, comment);
+        xfree(blacklist_file);
+
+        return ret;
+}
+
+int
+do_filename(const char *filename, int quiet_open)
+{
+        FILE *f;
+        char line[SSH_MAX_PUBKEY_BYTES];
+        char *cp;
+        u_long linenum = 0;
+        Key *key;
+        char *comment = NULL;
+        int found = 0, ret = 1;
+
+        /* Copy much of key_load_public's logic here so that we can read
+         * several keys from a single file (e.g. authorized_keys).
+         */
+
+        if (strcmp(filename, "-") != 0) {
+                f = fopen(filename, "r");
+                if (!f) {
+                        char pubfile[MAXPATHLEN];
+                        if (strlcpy(pubfile, filename, sizeof pubfile) <
+                            sizeof(pubfile) &&
+                            strlcat(pubfile, ".pub", sizeof pubfile) <
+                            sizeof(pubfile))
+                                f = fopen(pubfile, "r");
+                }
+                if (!f) {
+                        if (!quiet_open)
+                                perror(filename);
+                        return -1;
+                }
+        } else
+                f = stdin;
+        while (read_keyfile_line(f, filename, line, sizeof(line),
+                    &linenum) != -1) {
+                cp = line;
+                switch (*cp) {
+                case '#':
+                case '\n':
+                case '\0':
+                        continue;
+                }
+                /* Skip leading whitespace. */
+                for (; *cp && (*cp == ' ' || *cp == '\t'); cp++)
+                        ;
+                /* Cope with ssh-keyscan output. */
+                comment = NULL;
+                if (*cp) {
+                        char *space;
+                        int type;
+
+                        space = strchr(cp, ' ');
+                        if (!space)
+                                continue;
+                        *space = '\0';
+                        type = key_type_from_name(cp);
+                        if (type == KEY_UNSPEC) {
+                                comment = xstrdup(cp);
+                                cp = space + 1;
+                        }
+                        *space = ' ';
+                }
+                if (!comment)
+                        comment = xstrdup(filename);
+                if (*cp) {
+                        key = key_new(KEY_RSA1);
+                        if (key_read(key, &cp) == 1) {
+                                if (!do_key(key, comment))
+                                        ret = 0;
+                                key_free(key);
+                                found = 1;
+                        } else {
+                                key_free(key);
+                                key = key_new(KEY_UNSPEC);
+                                if (key_read(key, &cp) == 1) {
+                                        if (!do_key(key, comment))
+                                                ret = 0;
+                                        key_free(key);
+                                        found = 1;
+                                }
+                        }
+                }
+                xfree(comment);
+                comment = NULL;
+        }
+        if (f != stdin)
+                fclose(f);
+
+        if (!found && filename) {
+                key = key_load_public(filename, &comment);
+                if (key) {
+                        if (!do_key(key, comment))
+                                ret = 0;
+                        found = 1;
+                }
+                if (comment)
+                        xfree(comment);
+        }
+
+        return ret;
+}
+
+int
+do_host(void)
+{
+        int i;
+        struct stat st;
+        int ret = 1;
+
+        for (i = 0; default_host_files[i]; i++) {
+                if (stat(default_host_files[i], &st) < 0)
+                        continue;
+                if (!do_filename(default_host_files[i], 1))
+                        ret = 0;
+        }
+
+        return ret;
+}
+
+int
+do_user(const char *dir)
+{
+        int i;
+        char buf[MAXPATHLEN];
+        struct stat st;
+        int ret = 1;
+
+        for (i = 0; default_files[i]; i++) {
+                snprintf(buf, sizeof(buf), "%s/%s", dir, default_files[i]);
+                if (stat(buf, &st) < 0)
+                        continue;
+                if (!do_filename(buf, 0))
+                        ret = 0;
+        }
+
+        return ret;
+}
+
+int
+main(int argc, char **argv)
+{
+        int opt, all_users = 0;
+        int ret = 1;
+        extern int optind;
+
+        /* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */
+        sanitise_stdfd();
+
+        __progname = ssh_get_progname(argv[0]);
+
+        SSLeay_add_all_algorithms();
+        log_init(argv[0], SYSLOG_LEVEL_INFO, SYSLOG_FACILITY_USER, 1);
+
+        /* We don't need the RNG ourselves, but symbol references here allow
+         * ld to link us properly.
+         */
+        init_rng();
+        seed_rng();
+
+        while ((opt = getopt(argc, argv, "ahq")) != -1) {
+                switch (opt) {
+                case 'a':
+                        all_users = 1;
+                        break;
+                case 'q':
+                        quiet = 1;
+                        break;
+                case 'h':
+                default:
+                        usage();
+                }
+        }
+
+        if (all_users) {
+                struct passwd *pw;
+
+                if (!do_host())
+                        ret = 0;
+
+                while ((pw = getpwent()) != NULL) {
+                        if (pw->pw_dir) {
+                                if (!do_user(pw->pw_dir))
+                                        ret = 0;
+                        }
+                }
+        } else if (optind == argc) {
+                struct passwd *pw;
+
+                if (!do_host())
+                        ret = 0;
+
+                if ((pw = getpwuid(getuid())) == NULL)
+                        fprintf(stderr, "No user found with uid %u\n",
+                            (u_int)getuid());
+                else {
+                        if (!do_user(pw->pw_dir))
+                                ret = 0;
+                }
+        } else {
+                while (optind < argc)
+                        if (!do_filename(argv[optind++], 0))
+                                ret = 0;
+        }
+
+        return ret;
+}
diff --git a/sshd.c b/sshd.c
index add61cc5f..2d428967c 100644
--- a/sshd.c
+++ b/sshd.c
@@ -1466,6 +1466,21 @@ main(int ac, char **av)
 
         for (i = 0; i < options.num_host_key_files; i++) {
                 key = key_load_private(options.host_key_files[i], "", NULL);
+                if (key && blacklisted_key(key)) {
+                        char *fp;
+                        fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
+                        if (options.permit_blacklisted_keys)
+                                error("Host key %s blacklisted (see "
+                                    "ssh-vulnkey(1)); continuing anyway", fp);
+                        else
+                                error("Host key %s blacklisted (see "
+                                    "ssh-vulnkey(1))", fp);
+                        xfree(fp);
+                        if (!options.permit_blacklisted_keys) {
+                                sensitive_data.host_keys[i] = NULL;
+                                continue;
+                        }
+                }
                 sensitive_data.host_keys[i] = key;
                 if (key == NULL) {
                         error("Could not load host key: %s",
diff --git a/sshd_config.5 b/sshd_config.5
index a7a7227b2..dab26e079 100644
--- a/sshd_config.5
+++ b/sshd_config.5
@@ -615,6 +615,20 @@ are refused if the number of unauthenticated connections reaches
 Specifies whether password authentication is allowed.
 The default is
 .Dq yes .
+.It Cm PermitBlacklistedKeys
+Specifies whether
+.Xr sshd 8
+should allow keys recorded in its blacklist of known-compromised keys (see
+.Xr ssh-vulnkey 1 ) .
+If
+.Dq yes ,
+then attempts to authenticate with compromised keys will be logged but
+accepted.
+If
+.Dq no ,
+then attempts to authenticate with compromised keys will be rejected.
+The default is
+.Dq no .
 .It Cm PermitEmptyPasswords
 When password authentication is allowed, it specifies whether the
 server allows login to accounts with empty password strings.