Интерактивная система просмотра системных руководств (man-ов)
ssh-vulnkey (1)
>> ssh-vulnkey (1) ( Linux man: Команды и прикладные программы пользовательского уровня )
BSD mandoc
NAME
ssh-vulnkey
- check blacklist of compromised keys
SYNOPSIS
[-q
]
file ...
-a
DESCRIPTION
checks a key against a blacklist of compromised keys.
A substantial number of keys are known to have been generated using a broken
version of OpenSSL distributed by Debian which failed to seed its random
number generator correctly.
Keys generated using these OpenSSL versions should be assumed to be
compromised.
This tool may be useful in checking for such keys.
Keys that are compromised cannot be repaired; replacements must be generated
using
ssh-keygen1.
Make sure to update
authorized_keys
files on all systems where compromised keys were permitted to authenticate.
The argument list will be interpreted as a list of paths to public key files
or
authorized_keys
files.
If no suitable file is found at a given path,
will append
.pub
and retry, in case it was given a private key file.
If no files are given as arguments,
will check
~/.ssh/id_rsa
~/.ssh/id_dsa
~/.ssh/identity
~/.ssh/authorized_keys
and
~/.ssh/authorized_keys2
as well as the system's host keys if readable.
If
``-''
is given as an argument,
will read from standard input.
This can be used to process output from
ssh-keyscan1,
for example:
will exit zero if any of the given keys were in the compromised list,
otherwise non-zero.
Unless the
PermitBlacklistedKeys
option is used,
sshd(8)
will reject attempts to authenticate with keys in the compromised list.
The options are as follows:
-a
Check keys of all users on the system.
You will typically need to run
as root to use this option.
For each user,
will check
~/.ssh/id_rsa
~/.ssh/id_dsa
~/.ssh/identity
~/.ssh/authorized_keys
and
~/.ssh/authorized_keys2
It will also check the system's host keys.
-q
Quiet mode.
Normally,
outputs the fingerprint of each key scanned, with a description of its
status.
This option suppresses that output.
BLACKLIST FILE FORMAT
The blacklist file may start with comments, on lines starting with
``#''
After these initial comments, it must follow a strict format:
All the lines must be exactly the same length (20 characters followed by a
newline) and must be in sorted order.
Each line must consist of the lower-case hexadecimal MD5 key fingerprint,
without colons, and with the first 12 characters removed (that is, the least
significant 80 bits of the fingerprint).
The key fingerprint may be generated using
ssh-keygen1:
$ ssh-keygen -l -f /path/to/key
This strict format is necessary to allow the blacklist file to be checked
quickly, using a binary-search algorithm.
FILES
~/.ssh/id_rsa
If present, contains the protocol version 2 RSA authentication identity of
the user.
~/.ssh/id_dsa
If present, contains the protocol version 2 DSA authentication identity of
the user.
~/.ssh/identity
If present, contains the protocol version 1 RSA authentication identity of
the user.
~/.ssh/authorized_keys
If present, lists the public keys (RSA/DSA) that can be used for logging in
as this user.
~/.ssh/authorized_keys2
Obsolete name for
~/.ssh/authorized_keys
This file may still be present on some old systems, but should not be
created if it is missing.
/etc/ssh/ssh_host_rsa_key
If present, contains the protocol version 2 RSA identity of the system.
/etc/ssh/ssh_host_dsa_key
If present, contains the protocol version 2 DSA identity of the system.
/etc/ssh/ssh_host_key
If present, contains the protocol version 1 RSA identity of the system.
/etc/ssh/blacklist. TYPE - LENGTH
If present, lists the blacklisted keys of type
TYPE
( ``RSA1''
``RSA''
or
``DSA''
and bit length
LENGTH
The format of this file is described above.
