From da162da0416abb367ea8a415eb90d072a01fa020 Mon Sep 17 00:00:00 2001 From: Colin Watson Date: Mon, 2 Jun 2008 13:04:55 +0000 Subject: Check compromised key blacklist in ssh or ssh-add, as well as in the server (LP: #232391). To override the blacklist check in ssh temporarily, use 'ssh -o UseBlacklistedKeys=yes'; there is no override for the blacklist check in ssh-add. --- readconf.c | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'readconf.c') diff --git a/readconf.c b/readconf.c index 0999f28e3..07f5775d5 100644 --- a/readconf.c +++ b/readconf.c @@ -125,6 +125,7 @@ typedef enum { oGlobalKnownHostsFile2, oUserKnownHostsFile2, oPubkeyAuthentication, oKbdInteractiveAuthentication, oKbdInteractiveDevices, oHostKeyAlias, oDynamicForward, oPreferredAuthentications, oHostbasedAuthentication, + oUseBlacklistedKeys, oHostKeyAlgorithms, oBindAddress, oSmartcardDevice, oClearAllForwardings, oNoHostAuthenticationForLocalhost, oEnableSSHKeysign, oRekeyLimit, oVerifyHostKeyDNS, oConnectTimeout, @@ -155,6 +156,7 @@ static struct { { "passwordauthentication", oPasswordAuthentication }, { "kbdinteractiveauthentication", oKbdInteractiveAuthentication }, { "kbdinteractivedevices", oKbdInteractiveDevices }, + { "useblacklistedkeys", oUseBlacklistedKeys }, { "rsaauthentication", oRSAAuthentication }, { "pubkeyauthentication", oPubkeyAuthentication }, { "dsaauthentication", oPubkeyAuthentication }, /* alias */ @@ -448,6 +450,10 @@ parse_flag: intptr = &options->challenge_response_authentication; goto parse_flag; + case oUseBlacklistedKeys: + intptr = &options->use_blacklisted_keys; + goto parse_flag; + case oGssAuthentication: intptr = &options->gss_authentication; goto parse_flag; @@ -1061,6 +1067,7 @@ initialize_options(Options * options) options->kbd_interactive_devices = NULL; options->rhosts_rsa_authentication = -1; options->hostbased_authentication = -1; + options->use_blacklisted_keys = -1; options->batch_mode = -1; options->check_host_ip = -1; options->strict_host_key_checking = -1; @@ -1159,6 +1166,8 @@ fill_default_options(Options * options) options->rhosts_rsa_authentication = 0; if (options->hostbased_authentication == -1) options->hostbased_authentication = 0; + if (options->use_blacklisted_keys == -1) + options->use_blacklisted_keys = 0; if (options->batch_mode == -1) options->batch_mode = 0; if (options->check_host_ip == -1) -- cgit v1.2.3