Match = SSHFingerprint.match(output)
g = Match.groups()
+ key_size = g[0]
+ fingerprint = g[1]
- if int(g[0]) < 1024 and (typekey != "ed25519"):
- try:
- # Body
- Subst["__ERROR__"] = "SSH keysize %s is below limit 1024" % (g[0])
- ErrReply = TemplateSubst(Subst,open(TemplatesDir+"admin-info","r").read())
-
- Child = os.popen("/usr/sbin/sendmail -t","w")
- Child.write(ErrReplyHead)
- Child.write(ErrReply)
- if Child.close() != None:
- raise UDExecuteError, "Sendmail gave a non-zero return code"
- except:
- sys.exit(EX_TEMPFAIL)
+ if typekey == "rsa":
+ key_size_ok = (int(key_size) >= 2048)
+ elif typekey == "ed25519":
+ key_size_ok = True
+ else:
+ key_size_ok = False
- # And now break and stop processing input, which sends a reply to the user.
- raise UDFormatError, "SSH keys must have at least 1024 bits, processing halted, NOTHING MODIFIED AT ALL"
- elif g[1] in badkeys:
+ if not key_size_ok:
+ return "SSH key fails formal criteria, not added. We only accept RSA keys (>= 2048 bits) or ed25519 keys."
+ elif fingerprint in badkeys:
try:
# Body
Subst["__ERROR__"] = "SSH key with fingerprint %s known as bad key" % (g[1])
# And now break and stop processing input, which sends a reply to the user.
raise UDFormatError, "Submitted SSH Key known to be bad and insecure, processing halted, NOTHING MODIFIED AT ALL"
- if (typekey == "dss"):
- return "DSA keys not accepted anymore"
-
global SeenKey;
if SeenKey:
Attrs.append((ldap.MOD_ADD,"sshRSAAuthKey",Str));
- return "SSH Key added "+FormatSSHAuth(Str);
-
+ return "SSH Key added: %s %s [%s]"%(key_size, fingerprint, FormatSSHAuth(Str))
+
Attrs.append((ldap.MOD_REPLACE,"sshRSAAuthKey",Str));
SeenKey = 1;
- return "SSH Keys replaced with "+FormatSSHAuth(Str);
+ return "SSH Keys replaced with: %s %s [%s]"%(key_size, fingerprint, FormatSSHAuth(Str))
# Handle changing a dns entry
# host IN A 12.12.12.12