From 324541e5264e1489ca0babfaf2b39612eb80dfb3 Mon Sep 17 00:00:00 2001 From: Damien Miller Date: Tue, 31 Dec 2013 12:25:40 +1100 Subject: - djm@cvs.openbsd.org 2013/12/30 23:52:28 [auth2-hostbased.c auth2-pubkey.c compat.c compat.h ssh-rsa.c] [sshconnect.c sshconnect2.c sshd.c] refuse RSA keys from old proprietary clients/servers that use the obsolete RSA+MD5 signature scheme. it will still be possible to connect with these clients/servers but only DSA keys will be accepted, and we'll deprecate them entirely in a future release. ok markus@ --- auth2-hostbased.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) (limited to 'auth2-hostbased.c') diff --git a/auth2-hostbased.c b/auth2-hostbased.c index a344dcc1f..488008f62 100644 --- a/auth2-hostbased.c +++ b/auth2-hostbased.c @@ -1,4 +1,4 @@ -/* $OpenBSD: auth2-hostbased.c,v 1.16 2013/06/21 00:34:49 djm Exp $ */ +/* $OpenBSD: auth2-hostbased.c,v 1.17 2013/12/30 23:52:27 djm Exp $ */ /* * Copyright (c) 2000 Markus Friedl. All rights reserved. * @@ -100,6 +100,12 @@ userauth_hostbased(Authctxt *authctxt) "(received %d, expected %d)", key->type, pktype); goto done; } + if (key_type_plain(key->type) == KEY_RSA && + (datafellows & SSH_BUG_RSASIGMD5) != 0) { + error("Refusing RSA key because peer uses unsafe " + "signature format"); + goto done; + } service = datafellows & SSH_BUG_HBSERVICE ? "ssh-userauth" : authctxt->service; buffer_init(&b); -- cgit v1.2.3