summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--debian/changelog3
-rw-r--r--ssh-vulnkey.112
-rw-r--r--ssh-vulnkey.c19
3 files changed, 25 insertions, 9 deletions
diff --git a/debian/changelog b/debian/changelog
index 6d61f5c62..15abbe97a 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -39,6 +39,9 @@ openssh (1:4.7p1-11) UNRELEASED; urgency=low
39 closes: #480020). 39 closes: #480020).
40 * Log IP addresses of hosts attempting to use blacklisted keys (closes: 40 * Log IP addresses of hosts attempting to use blacklisted keys (closes:
41 #481721). 41 #481721).
42 * Add -v (verbose) option to ssh-vulnkey, and don't print output for keys
43 that have a blacklist file but that are not listed unless in verbose
44 mode (thanks, Hugh Daniel).
42 45
43 -- Colin Watson <cjwatson@debian.org> Sat, 17 May 2008 08:48:45 +0200 46 -- Colin Watson <cjwatson@debian.org> Sat, 17 May 2008 08:48:45 +0200
44 47
diff --git a/ssh-vulnkey.1 b/ssh-vulnkey.1
index c0a7592f8..8e681115a 100644
--- a/ssh-vulnkey.1
+++ b/ssh-vulnkey.1
@@ -28,7 +28,7 @@
28.Nd check blacklist of compromised keys 28.Nd check blacklist of compromised keys
29.Sh SYNOPSIS 29.Sh SYNOPSIS
30.Nm 30.Nm
31.Op Fl q 31.Op Fl q | Fl v
32.Ar file ... 32.Ar file ...
33.Nm 33.Nm
34.Fl a 34.Fl a
@@ -115,6 +115,16 @@ Normally,
115outputs the fingerprint of each key scanned, with a description of its 115outputs the fingerprint of each key scanned, with a description of its
116status. 116status.
117This option suppresses that output. 117This option suppresses that output.
118.It Fl v
119Verbose mode.
120Normally,
121.Nm
122does not output anything for keys that are not listed in their corresponding
123blacklist file (although it still produces output for keys for which there
124is no blacklist file, since their status is unknown).
125This option causes
126.Nm
127to produce output for all keys.
118.El 128.El
119.Sh BLACKLIST FILE FORMAT 129.Sh BLACKLIST FILE FORMAT
120The blacklist file may start with comments, on lines starting with 130The blacklist file may start with comments, on lines starting with
diff --git a/ssh-vulnkey.c b/ssh-vulnkey.c
index f78615478..39c984db2 100644
--- a/ssh-vulnkey.c
+++ b/ssh-vulnkey.c
@@ -60,7 +60,7 @@ static char *default_files[] = {
60 NULL 60 NULL
61}; 61};
62 62
63static int quiet = 0; 63static int verbosity = 0;
64 64
65static void 65static void
66usage(void) 66usage(void)
@@ -74,12 +74,12 @@ usage(void)
74 74
75void 75void
76describe_key(const char *filename, u_long linenum, const char *msg, 76describe_key(const char *filename, u_long linenum, const char *msg,
77 const Key *key, const char *comment) 77 const Key *key, const char *comment, int min_verbosity)
78{ 78{
79 char *fp; 79 char *fp;
80 80
81 fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX); 81 fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
82 if (!quiet) 82 if (verbosity >= min_verbosity)
83 printf("%s:%lu: %s: %u %s %s\n", filename, linenum, msg, 83 printf("%s:%lu: %s: %u %s %s\n", filename, linenum, msg,
84 key_size(key), fp, comment); 84 key_size(key), fp, comment);
85 xfree(fp); 85 xfree(fp);
@@ -101,14 +101,14 @@ do_key(const char *filename, u_long linenum,
101 blacklist_status = blacklisted_key(public); 101 blacklist_status = blacklisted_key(public);
102 if (blacklist_status == -1) 102 if (blacklist_status == -1)
103 describe_key(filename, linenum, 103 describe_key(filename, linenum,
104 "Unknown (no blacklist information)", key, comment); 104 "Unknown (no blacklist information)", key, comment, 0);
105 else if (blacklist_status == 1) { 105 else if (blacklist_status == 1) {
106 describe_key(filename, linenum, 106 describe_key(filename, linenum,
107 "COMPROMISED", key, comment); 107 "COMPROMISED", key, comment, 0);
108 ret = 0; 108 ret = 0;
109 } else 109 } else
110 describe_key(filename, linenum, 110 describe_key(filename, linenum,
111 "Not blacklisted", key, comment); 111 "Not blacklisted", key, comment, 1);
112 112
113 key_free(public); 113 key_free(public);
114 114
@@ -289,13 +289,16 @@ main(int argc, char **argv)
289 init_rng(); 289 init_rng();
290 seed_rng(); 290 seed_rng();
291 291
292 while ((opt = getopt(argc, argv, "ahq")) != -1) { 292 while ((opt = getopt(argc, argv, "ahqv")) != -1) {
293 switch (opt) { 293 switch (opt) {
294 case 'a': 294 case 'a':
295 all_users = 1; 295 all_users = 1;
296 break; 296 break;
297 case 'q': 297 case 'q':
298 quiet = 1; 298 verbosity--;
299 break;
300 case 'v':
301 verbosity++;
299 break; 302 break;
300 case 'h': 303 case 'h':
301 default: 304 default: