From 47608c17e64138f8d16aa2bdc49a0eb00e1c3549 Mon Sep 17 00:00:00 2001 From: Colin Watson Date: Mon, 12 May 2008 23:33:01 +0000 Subject: * Mitigate OpenSSL security vulnerability: - Add key blacklisting support. Keys listed in /etc/ssh/blacklist.TYPE-LENGTH will be rejected for authentication by sshd, unless "PermitBlacklistedKeys yes" is set in /etc/ssh/sshd_config. - Add a new program, ssh-vulnkey, which can be used to check keys against these blacklists. - Depend on openssh-blacklist. - Force dependencies on libssl0.9.8 / libcrypto0.9.8-udeb to at least 0.9.8g-9. - Automatically regenerate known-compromised host keys, with a critical-priority debconf note. (I regret that there was no time to gather translations.) --- auth-rsa.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) (limited to 'auth-rsa.c') diff --git a/auth-rsa.c b/auth-rsa.c index 69f9a5896..1d277f92a 100644 --- a/auth-rsa.c +++ b/auth-rsa.c @@ -40,6 +40,7 @@ #include "servconf.h" #include "key.h" #include "hostfile.h" +#include "authfile.h" #include "auth.h" #ifdef GSSAPI #include "ssh-gss.h" @@ -221,6 +222,7 @@ auth_rsa_key_allowed(struct passwd *pw, BIGNUM *client_n, Key **rkey) char *cp; char *key_options; int keybits; + char *fp; /* Skip leading whitespace, empty and comment lines. */ for (cp = line; *cp == ' ' || *cp == '\t'; cp++) @@ -265,6 +267,19 @@ auth_rsa_key_allowed(struct passwd *pw, BIGNUM *client_n, Key **rkey) "actual %d vs. announced %d.", file, linenum, BN_num_bits(key->rsa->n), bits); + if (blacklisted_key(key)) { + fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX); + if (options.permit_blacklisted_keys) + logit("Public key %s blacklisted (see " + "ssh-vulnkey(1)); continuing anyway", fp); + else + logit("Public key %s blacklisted (see " + "ssh-vulnkey(1))", fp); + xfree(fp); + if (!options.permit_blacklisted_keys) + continue; + } + /* We have found the desired key. */ /* * If our options do not allow this key to be used, -- cgit v1.2.3