Man page of SSH-VULNKEY
Section: User Commands (1)
Return to Main Contents
- check blacklist of compromised keys
[-q | -v
checks a key against a blacklist of compromised keys.
A substantial number of keys are known to have been generated using a broken
version of OpenSSL distributed by Debian which failed to seed its random
number generator correctly.
Keys generated using these OpenSSL versions should be assumed to be
This tool may be useful in checking for such keys.
Keys that are compromised cannot be repaired; replacements must be generated
Make sure to update
files on all systems where compromised keys were permitted to authenticate.
The argument list will be interpreted as a list of paths to public key files
If no suitable file is found at a given path,
and retry, in case it was given a private key file.
If no files are given as arguments,
as well as the system's host keys if readable.
is given as an argument,
will read from standard input.
This can be used to process output from
$ ssh-keyscan -t rsa remote.example.org | ssh-vulnkey
option is used,
will reject attempts to authenticate with keys in the compromised list.
The output from
looks like this:
/etc/ssh/ssh_host_key:1: COMPROMISED: RSA1 2048 xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx [email protected]
/home/user/.ssh/id_dsa:1: Not blacklisted: DSA 1024 xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx /home/user/.ssh/id_dsa.pub
/home/user/.ssh/authorized_keys:3: Unknown (blacklist file not installed): RSA 1024 xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx [email protected]
Each line is of the following format (any lines beginning with
should be ignored by scripts):
filename : line : status : type size fingerprint comment
It is important to distinguish between the possible values of
These keys are listed in a blacklist file, normally because their
corresponding private keys are well-known.
Replacements must be generated using
- Not blacklisted
A blacklist file exists for this key type and size, but this key is not
listed in it.
Unless there is some particular reason to believe otherwise, this key
may be used safely.
(Note that DSA keys used with the broken version of OpenSSL distributed
by Debian may be compromised in the event that anyone captured a network
trace, even if they were generated with a secure version of OpenSSL.)
- Unknown (blacklist file not installed)
No blacklist file exists for this key type and size.
You should find a suitable published blacklist and install it before
deciding whether this key is safe to use.
The options are as follows:
Check keys of all users on the system.
You will typically need to run
as root to use this option.
For each user,
It will also check the system's host keys.
outputs the fingerprint of each key scanned, with a description of its
This option suppresses that output.
does not output anything for keys that are not listed in their corresponding
blacklist file (although it still produces output for keys for which there
is no blacklist file, since their status is unknown).
This option causes
to produce output for all keys.
will exit zero if any of the given keys were in the compromised list,
BLACKLIST FILE FORMAT
The blacklist file may start with comments, on lines starting with
After these initial comments, it must follow a strict format:
All the lines must be exactly the same length (20 characters followed by a
newline) and must be in sorted order.
Each line must consist of the lower-case hexadecimal MD5 key fingerprint,
without colons, and with the first 12 characters removed (that is, the least
significant 80 bits of the fingerprint).
The key fingerprint may be generated using
$ ssh-keygen -l -f /path/to/key
This strict format is necessary to allow the blacklist file to be checked
quickly, using a binary-search algorithm.
If present, contains the protocol version 2 RSA authentication identity of
If present, contains the protocol version 2 DSA authentication identity of
If present, contains the protocol version 1 RSA authentication identity of
If present, lists the public keys (RSA/DSA) that can be used for logging in
as this user.
Obsolete name for
This file may still be present on some old systems, but should not be
created if it is missing.
If present, contains the protocol version 2 RSA identity of the system.
If present, contains the protocol version 2 DSA identity of the system.
If present, contains the protocol version 1 RSA identity of the system.
- /usr/share/ssh/blacklist. TYPE - LENGTH
If present, lists the blacklisted keys of type
and bit length
The format of this file is described above.
RSA1 keys are converted to RSA before being checked in the blacklist.
Note that the fingerprints of RSA1 keys are computed differently, so you
will not be able to find them in the blacklist by hand.
- /etc/ssh/blacklist. TYPE - LENGTH
/usr/share/ssh/blacklist. TYPE - LENGTH
but may be edited by the system administrator to add new blacklist entries.
An Colin Watson Aq [email protected]
Florian Weimer suggested the option to check keys of all users, and the idea
- EXIT STATUS
- BLACKLIST FILE FORMAT
- SEE ALSO
This document was created by
using the manual pages.
Time: 03:41:18 GMT, September 24, 2010