3 # Debian/OpenSSL Weak Key Detector
5 # Written by Florian Weimer <fw@deneb.enyo.de>, with blacklist data
6 # from Kees Cook, Peter Palfrader and James Strandboge.
8 # Patches and comments are welcome.
15 usage: $0 [OPTIONS...] COMMAND [ARGUMENTS...]
19 file: examine files on the command line for weak keys
20 host: examine the specified hosts for weak SSH keys
21 user: examine user SSH keys for weakness; examine all users if no
23 help: show this help screen
27 -c FILE: set the database cache file name (default: dowkd.db)
29 dowkd currently handles OpenSSH host and user keys and OpenVPN shared
30 secrets, as long as they use default key lengths and have been created
31 on a little-endian architecture (such as i386 or amd64). Note that
32 the blacklist by dowkd may be incomplete; it is only intended as a
45 my $db_file = 'dowkd.db';
51 $db = tie
%db, 'DB_File', $db_file, O_RDWR
| O_CREAT
, 0777, $DB_BTREE
52 or die "error: could not open database: $!\n";
54 $db{''} = $db_version;
55 while (my $line = <DATA
>) {
56 next if $line =~ /^\**$/;
58 $line =~ /^[0-9a-f]{32}$/ or die "error: invalid data line";
59 $line =~ s/(..)/chr(hex($1))/ge;
68 $db = tie
%db, 'DB_File', $db_file, O_RDONLY
, 0777, $DB_BTREE
69 or die "error: could not open database: $!\n";
70 my $stored_version = $db{''};
71 $stored_version && $stored_version eq $db_version or create_db
;
78 sub safe_backtick
(@
) {
82 or die "error: failed to spawn $args[0]: $!\n";
88 @result = scalar(<$fh>);
91 $?
== 0 or return undef;
100 my $keys_vulnerable = 0;
103 print STDERR
"summary: keys found: $keys_found, weak keys: $keys_vulnerable\n";
106 sub check_hash
($$) {
107 my ($name, $hash) = @_;
109 if (exists $db{$hash}) {
111 print "$name: weak key\n";
115 sub ssh_fprint_file
($) {
117 my $data = safe_backtick qw
/ssh-keygen -l -f/, $name;
118 defined $data or return ();
119 my @data = $data =~ /^(\d+) ([0-9a-f]{2}(?::[0-9a-f]{2}){15})/;
120 return @data if @data == 2;
124 sub ssh_fprint_check
($$$) {
125 my ($name, $length, $hash) = @_;
126 if ($length == 1024 || $length == 2048) {
128 $hash =~ s/(..)/chr(hex($1))/ge;
129 check_hash
$name, $hash;
131 warn "$name: warning: no suitable blacklist\n";
135 sub from_ssh_key_file
($) {
137 my ($length, $hash) = ssh_fprint_file
$name;
138 if ($length && $hash) {
139 ssh_fprint_check
"$name:1", $length, $hash;
141 warn "$name:1: warning: failed to parse SSH key file\n";
147 seek $tmp, 0, 0 or die "seek: $!";
148 truncate $tmp, 0 or die "truncate: $!";
151 sub from_ssh_auth_file
($) {
154 unless (open $auth, '<', $name) {
155 warn "$name:0: error: open failed: $!\n";
158 my $tmp = new File
::Temp
;
159 while (my $line = <$auth>) {
163 print $tmp "$line\n" or die "print: $!";
165 my ($length, $hash) = ssh_fprint_file
"$tmp";
166 if ($length && $hash) {
167 ssh_fprint_check
"$name:$lineno", $length, $hash;
169 warn "$name:$lineno: warning: unparsable line\n";
174 sub from_openvpn_key
($) {
177 unless (open $key, '<', $name) {
178 warn "$name:0: open failed: $!\n";
183 while (my $line = <$key>) {
185 if ($line =~ /^-----BEGIN OpenVPN Static key V1-----/) {
188 if ($line =~ /^([0-9a-f]{32})/) {
190 $line =~ s/(..)/chr(hex($1))/ge;
191 check_hash
"$name:$.", $line;
194 warn "$name:$.: warning: illegal OpenVPN file format\n";
201 sub from_ssh_host
(@
) {
204 push @lines, safe_backtick qw
/ssh-keyscan -t rsa/, @names;
205 push @lines, safe_backtick qw
/ssh-keyscan -t dsa/, @names;
207 my $tmp = new File
::Temp
;
208 for my $line (@lines) {
209 next if $line =~ /^#/;
210 my ($host, $data) = $line =~ /^(\S+) (.*)$/;
212 print $tmp "$data\n" or die "print: $!";
214 my ($length, $hash) = ssh_fprint_file
"$tmp";
215 if ($length && $hash) {
216 ssh_fprint_check
"$host", $length, $hash;
218 warn "$host: warning: unparsable line\n";
225 my ($name,$passwd,$uid,$gid,
226 $quota,$comment,$gcos,$dir,$shell,$expire) = getpwnam($user);
227 my $file = "$dir/.ssh/authorized_keys";
228 from_ssh_auth_file
$file if -r
$file;
229 $file = "$dir/.ssh/authorized_keys2";
230 from_ssh_auth_file
$file if -r
$file;
231 $file = "$dir/.ssh/id_rsa.pub";
232 from_ssh_key_file
$file if -r
$file;
233 $file = "$dir/.ssh/id_dsa.pub";
234 from_ssh_key_file
$file if -r
$file;
237 sub from_user_all
() {
238 # This was one loop initially, but does not work with some Perl
242 while (my $name = getpwent) {
246 from_user
$_ for @names;
249 if (@ARGV && $ARGV[0] eq '-c') {
251 $db_file = shift @ARGV if @ARGV;
255 my $cmd = shift @ARGV;
256 if ($cmd eq 'file') {
257 for my $name (@ARGV) {
258 next if from_openvpn_key
$name;
259 from_ssh_auth_file
$name;
261 } elsif ($cmd eq 'host') {
263 } elsif ($cmd eq 'user') {
265 from_user
$_ for @ARGV;
269 } elsif ($cmd eq 'help') {
273 die "error: invalid command, use \"help\" to get help\n";