After 1.0.0, it may use OS's if available, and if not available, it still use its own.
What keys are used for:
http://www.openssl.org/docs/HOWTO/keys.txt
Vulnerabilities:
http://www.openssl.org/news/vulnerabilities.html
This topic seems to start from Debian platform. And this posts method to test on your platform, Debian based or not. Don't work on cygwin, however.
http://www.debianadmin.com/fix-for-weak-opensslopenssh-keys-in-debian.html
Quote some here:
The Debian team has provided a tool that can be used to determine if any such weak keys exist on the system, and it can be run by anyone, regardless of whether they use Debian or not. To begin, download the dowkd.pl perl script and use it to test SSH keys of the host system:
$ cd ~/tmp
$ wget http://security.debian.org/project/extra/dowkd/dowkd.pl.gz
$ wget http://security.debian.org/project/extra/dowkd/dowkd.pl.gz.asc
$ gpg
--keyserver subkeys.pgp.net --recv-keys 02D524BE
$ gpg
--verify dowkd.pl.gz.asc
$ gunzip dowkd.pl.gz
$ perl dowkd.pl host localhost
This will download the dowkd.pl perl script and also import a Debian security team member’s key from subkeys.pgp.net. If the archive verifies okay with gpg, unarchive it, and then run the script in host-checking mode against the localhost.
If the script detects that the host key is weak, it will indicate such. Next, run the script against user keys on the system:
# perl dowkd.pl user
This check should be run as root in order to obtain access to every user’s keys. The script will check the keys and also the authorized_keys file and will alert you if the fingerprint to a remote host indicates a vulnerable key as well. If you wish to check a specific user, append the user name to the command:
# perl dowkd.pl user ruchi
If the script indicates that any keys are weak, they should be removed and regenerated immediately.
Some more links:
http://www.debian.org/security/2008/dsa-1571
http://www.us-cert.gov/cas/techalerts/TA08-137A.html
No comments:
Post a Comment