[Da-tools-commits] ./da-tools/userdir-ldap-common r395: Merge: ud-mailgate no longer accepts ssh dss keys, keys with a size smaller than 1024.
Peter Palfrader
peter at palfrader.org
Wed May 14 15:47:17 UTC 2008
------------------------------------------------------------
revno: 395
committer: Peter Palfrader <peter at palfrader.org>
branch nick: userdir-ldap
timestamp: Wed 2008-05-14 17:47:17 +0200
message:
Merge: ud-mailgate no longer accepts ssh dss keys, keys with a size smaller than 1024.
Additionally it checks new keys against a blacklist of ssh key fingerprints. [joerg]
added:
templates/admin-info
modified:
debian/changelog
ud-mailgate
userdir-ldap.conf
------------------------------------------------------------
revno: 349.2.36
committer: Joerg Jaspert <joerg at debian.org>
branch nick: userdir-ldap-common
timestamp: Tue 2008-05-13 00:12:56 +0200
message:
First version of a check for ssh keys
modified:
ud-mailgate
userdir-ldap.conf
------------------------------------------------------------
revno: 349.2.37
committer: Joerg Jaspert <joerg at ganneff.de>
branch nick: userdir-ldap-common
timestamp: Wed 2008-05-14 16:56:04 +0200
message:
Merge sshkeys check with the alioth userdir-ldap-common
modified:
debian/changelog
ud-mailgate
ud-replicate
------------------------------------------------------------
revno: 391.1.1
committer: Joerg Jaspert <joerg at ganneff.de>
branch nick: ud-ldap-sshkey
timestamp: Wed 2008-05-14 16:43:40 +0200
message:
Check ssh keys:
- reject all DSA keys, similar to RSA1 keys.
- reject and mail the admins for broken keys, ie keys
- of size below 1024 or
- known to be bad (fingerprintlist)
modified:
ud-mailgate
userdir-ldap.conf
------------------------------------------------------------
revno: 349.2.38
committer: Joerg Jaspert <joerg at ganneff.de>
branch nick: userdir-ldap-common
timestamp: Wed 2008-05-14 17:34:01 +0200
message:
Add missing admin info template
added:
templates/admin-info
-------------- next part --------------
=== modified file 'debian/changelog'
--- a/debian/changelog 2008-05-14 15:37:21 +0000
+++ b/debian/changelog 2008-05-14 15:47:17 +0000
@@ -4,8 +4,11 @@
about it. [zobel]
* Add IPv6-Adresses (and IPv4 in v6 notation - ::ffff:192.0.2.1) to
ssh_known_hosts. [aba]
+ * ud-mailgate no longer accepts ssh dss keys, keys with a size smaller
+ than 1024. Additionally it checks new keys against a blacklist of
+ ssh key fingerprints. [joerg]
- -- Peter Palfrader <weasel at debian.org> Wed, 14 May 2008 17:33:47 +0200
+ -- Peter Palfrader <weasel at debian.org> Wed, 14 May 2008 17:44:17 +0200
userdir-ldap (0.3.21) unstable; urgency=low
=== added file 'templates/admin-info'
--- a/templates/admin-info 1970-01-01 00:00:00 +0000
+++ b/templates/admin-info 2008-05-14 15:34:01 +0000
@@ -0,0 +1,17 @@
+To: __ADMIN__
+MIME-Version: 1.0
+Content-Type: text/plain; charset="utf-8"
+Content-Transfer-Encoding: 8bit
+Subject: User trying to add a bad or too small key to LDAP
+
+Hello admins!
+
+I (__USER__) just tried to add a known bad or too small SSH key
+to LDAP:
+
+__ERROR__
+
+Please lart me, thanks.
+
+--
+Thanks, __USER__
\ No newline at end of file
=== modified file 'ud-mailgate'
--- a/ud-mailgate 2008-05-10 12:19:22 +0000
+++ b/ud-mailgate 2008-05-14 14:56:04 +0000
@@ -3,11 +3,12 @@
# Prior copyright probably rmurray, troup, joey, jgg -- weasel 2008
# Copyright (c) 2008 Peter Palfrader <peter at palfrader.org>
+# Copyright (c) 2008 Joerg Jaspert <joerg at debian.org>
-import userdir_gpg, userdir_ldap, sys, traceback, time, ldap, os;
-import pwd
-from userdir_gpg import *;
-from userdir_ldap import *;
+import userdir_gpg, userdir_ldap, sys, traceback, time, ldap, os, commands
+import pwd, tempfile
+from userdir_gpg import *
+from userdir_ldap import *
# Error codes from /usr/include/sysexits.h
ReplyTo = ConfModule.replyto;
@@ -15,6 +16,7 @@
ChPassFrom = ConfModule.chpassfrom;
ChangeFrom = ConfModule.changefrom;
ReplayCacheFile = ConfModule.replaycachefile;
+SSHFingerprintFile = ConfModule.fingerprintfile
EX_TEMPFAIL = 75;
EX_PERMFAIL = 65; # EX_DATAERR
@@ -27,6 +29,8 @@
SeenList = {}
DNS = {}
+SSHFingerprint = re.compile('^(\d+) ([0-9a-f\:]{47}) (.+)$')
+
ArbChanges = {"c": "..",
"l": ".*",
"facsimileTelephoneNumber": ".*",
@@ -218,16 +222,87 @@
Attrs.append((ldap.MOD_REPLACE,"longitude",sLong));
return "Position set to %s/%s (%s/%s decimal degrees)"%(sLat,sLong,Lat,Long);
+# Load bad ssh fingerprints
+def LoadBadSSH():
+ f = open(SSHFingerprintFile, "r")
+ bad = []
+ FingerprintLine = re.compile('^([0-9a-f\:]{47}).*$')
+ for line in f.readlines():
+ Match = FingerprintLine.match(line)
+ if Match is not None:
+ g = Match.groups()
+ bad.append(g[0])
+ return bad
+
# Handle an SSH authentication key, the line format is:
# [options] 1024 35 13188913666680[..] [comment]
-def DoSSH(Str,Attrs):
+def DoSSH(Str, Attrs, badkeys, uid):
Match = SSH2AuthSplit.match(Str);
+ g = Match.groups()
+ typekey = g[1]
if Match == None:
Match = re.compile('^1024 (\d+) ').match(Str)
if Match is not None:
return "SSH1 keys not supported anymore"
return None;
-
+
+ (fd, path) = tempfile.mkstemp(".pub", "sshkeytry", "/tmp")
+ f = open(path, "w")
+ f.write("%s\n" % (Str))
+ f.close()
+ cmd = "/usr/bin/ssh-keygen -l -f %s < /dev/null" % (path)
+ (result, output) = commands.getstatusoutput(cmd)
+ os.remove(path)
+ if (result != 0):
+ raise Error, "ssh-keygen -l invocation failed!\n%s\n" % (output)
+
+
+ # Head
+ Date = time.strftime("%a, %d %b %Y %H:%M:%S +0000",time.gmtime(time.time()))
+ ErrReplyHead = "From: %s\nCc: %s\nReply-To: %s\nDate: %s\n" % (os.environ['SENDER'],os.environ['SENDER'],ReplyTo,Date)
+ Subst = {}
+ Subst["__ADMIN__"] = ReplyTo
+ Subst["__USER__"] = uid
+
+ Match = SSHFingerprint.match(output)
+ g = Match.groups()
+
+ if int(g[0]) < 1024:
+ try:
+ # Body
+ Subst["__ERROR__"] = "SSH keysize %s is below limit 1024" % (g[0])
+ ErrReply = TemplateSubst(Subst,open(TemplatesDir+"admin-info","r").read())
+
+ Child = os.popen("/usr/sbin/sendmail -t","w")
+ Child.write(ErrReplyHead)
+ Child.write(ErrReply)
+ if Child.close() != None:
+ raise Error, "Sendmail gave a non-zero return code"
+ except:
+ sys.exit(EX_TEMPFAIL)
+
+ # And now break and stop processing input, which sends a reply to the user.
+ raise Error, "SSH keys must have at least 1024 bits, processing halted, NOTHING MODIFIED AT ALL"
+ elif g[1] in badkeys:
+ try:
+ # Body
+ Subst["__ERROR__"] = "SSH key with fingerprint %s known as bad key" % (g[1])
+ ErrReply = TemplateSubst(Subst,open(TemplatesDir+"admin-info","r").read())
+
+ Child = os.popen("/usr/sbin/sendmail -t","w")
+ Child.write(ErrReplyHead)
+ Child.write(ErrReply)
+ if Child.close() != None:
+ raise Error, "Sendmail gave a non-zero return code"
+ except:
+ sys.exit(EX_TEMPFAIL)
+
+ # And now break and stop processing input, which sends a reply to the user.
+ raise Error, "Submitted SSH Key known to be bad and insecure, processing halted, NOTHING MODIFIED AT ALL"
+
+ if (typekey == "dss"):
+ return "DSA keys not accepted anymore"
+
global SeenKey;
if SeenKey:
Attrs.append((ldap.MOD_ADD,"sshRSAAuthKey",Str));
@@ -370,12 +445,13 @@
Result = Result + "> "+Line+"\n";
try:
if Line == "show":
- Show = 1;
- Res = "OK";
+ Show = 1;
+ Res = "OK";
else:
- Res = DoPosition(Line,Attrs) or DoDNS(Line,Attrs,DnRecord) or \
- DoArbChange(Line,Attrs) or DoSSH(Line,Attrs) or \
- DoDel(Line,Attrs) or DoRBL(Line,Attrs);
+ badkeys = LoadBadSSH()
+ Res = DoPosition(Line,Attrs) or DoDNS(Line,Attrs,DnRecord) or \
+ DoArbChange(Line,Attrs) or DoSSH(Line,Attrs,badkeys,GetAttr(DnRecord,"uid")) or \
+ DoDel(Line,Attrs) or DoRBL(Line,Attrs)
except:
Res = None;
Result = Result + "==> %s: %s\n" %(sys.exc_type,sys.exc_value);
=== modified file 'userdir-ldap.conf'
--- a/userdir-ldap.conf 2007-12-27 16:17:13 +0000
+++ b/userdir-ldap.conf 2008-05-14 14:56:04 +0000
@@ -24,6 +24,7 @@
templatesdir = "/etc/userdir-ldap/templates/";
replaycachefile = "/var/cache/userdir-ldap/mail/replay";
#replaycachefile = "/tmp/replay";
+fingerprintfile = "/etc/userdir-ldap/badfingerprints"
# Echelon
ech_errorlog = "/org/db.debian.org/mail/Log/ech-errors.log"
More information about the Da-tools-commits
mailing list