The OpenNET Project / Index page

[ новости /+++ | форум | теги | ]

Интерактивная система просмотра системных руководств (man-ов)

 ТемаНаборКатегория 
 
 [Cписок руководств | Печать]

ssh-vulnkey (1)
  • >> ssh-vulnkey (1) ( Linux man: Команды и прикладные программы пользовательского уровня )

  • BSD mandoc
     

    NAME

    
    
    ssh-vulnkey
    
     - check blacklist of compromised keys
    
     
    

    SYNOPSIS

    [-q ] file ...
    -a  

    DESCRIPTION

    checks a key against a blacklist of compromised keys.

    A substantial number of keys are known to have been generated using a broken version of OpenSSL distributed by Debian which failed to seed its random number generator correctly. Keys generated using these OpenSSL versions should be assumed to be compromised. This tool may be useful in checking for such keys.

    Keys that are compromised cannot be repaired; replacements must be generated using ssh-keygen1. Make sure to update authorized_keys files on all systems where compromised keys were permitted to authenticate.

    The argument list will be interpreted as a list of paths to public key files or authorized_keys files. If no suitable file is found at a given path, will append .pub and retry, in case it was given a private key file. If no files are given as arguments, will check ~/.ssh/id_rsa ~/.ssh/id_dsa ~/.ssh/identity ~/.ssh/authorized_keys and ~/.ssh/authorized_keys2 as well as the system's host keys if readable.

    If ``-'' is given as an argument, will read from standard input. This can be used to process output from ssh-keyscan1, for example:

    $ ssh-keyscan -t rsa remote.example.org | ssh-vulnkey

    will exit zero if any of the given keys were in the compromised list, otherwise non-zero.

    Unless the PermitBlacklistedKeys option is used, sshd(8) will reject attempts to authenticate with keys in the compromised list.

    The options are as follows:

    -a
    Check keys of all users on the system. You will typically need to run as root to use this option. For each user, will check ~/.ssh/id_rsa ~/.ssh/id_dsa ~/.ssh/identity ~/.ssh/authorized_keys and ~/.ssh/authorized_keys2 It will also check the system's host keys.
    -q
    Quiet mode. Normally, outputs the fingerprint of each key scanned, with a description of its status. This option suppresses that output.

     

    BLACKLIST FILE FORMAT

    The blacklist file may start with comments, on lines starting with ``#'' After these initial comments, it must follow a strict format:

    The key fingerprint may be generated using ssh-keygen1:

    $ ssh-keygen -l -f /path/to/key

    This strict format is necessary to allow the blacklist file to be checked quickly, using a binary-search algorithm.  

    FILES

    ~/.ssh/id_rsa
    If present, contains the protocol version 2 RSA authentication identity of the user.
    ~/.ssh/id_dsa
    If present, contains the protocol version 2 DSA authentication identity of the user.
    ~/.ssh/identity
    If present, contains the protocol version 1 RSA authentication identity of the user.
    ~/.ssh/authorized_keys
    If present, lists the public keys (RSA/DSA) that can be used for logging in as this user.
    ~/.ssh/authorized_keys2
    Obsolete name for ~/.ssh/authorized_keys This file may still be present on some old systems, but should not be created if it is missing.
    /etc/ssh/ssh_host_rsa_key
    If present, contains the protocol version 2 RSA identity of the system.
    /etc/ssh/ssh_host_dsa_key
    If present, contains the protocol version 2 DSA identity of the system.
    /etc/ssh/ssh_host_key
    If present, contains the protocol version 1 RSA identity of the system.
    /etc/ssh/blacklist. TYPE - LENGTH
    If present, lists the blacklisted keys of type TYPE ( ``RSA1'' ``RSA'' or ``DSA'' and bit length LENGTH The format of this file is described above.

     

    SEE ALSO

    ssh-keygen1, sshd(8)  

    AUTHORS

    An -nosplit An Colin Watson Aq [email protected]

    Florian Weimer suggested the option to check keys of all users, and the idea of processing ssh-keyscan1 output.


     

    Index

    NAME
    SYNOPSIS
    DESCRIPTION
    BLACKLIST FILE FORMAT
    FILES
    SEE ALSO
    AUTHORS


    Поиск по тексту MAN-ов: 




    Партнёры:
    PostgresPro
    Inferno Solutions
    Hosting by Hoster.ru
    Хостинг:

    Закладки на сайте
    Проследить за страницей
    Created 1996-2024 by Maxim Chirkov
    Добавить, Поддержать, Вебмастеру