#
# Copyright (c) 2008, Alexander Wirt <formorer@debian.org> for check_weakkeys
#
+# Copyright (c) 2008 Peter Palfrader <peter@palfrader.org>
+#
# Permission to use, copy, modify, and/or distribute this software for any
# purpose with or without fee is hereby granted, provided that the above
# copyright notice and this permission notice appear in all copies.
my ($weak_keys,$checked_keys) = 0;
my $dsa_keys = 0;
+my $weird_keyfiles = 0;
my $text = '';
my %key_sizes;
-&from_user_all;
+#&from_user_all;
+&from_debianorg_places;
&from_ssh_host(qw(localhost));
my $status="OK";
if ($weak_keys) {
$status = "CRITICAL";
-} elsif ($dsa_keys && ! $dsa_nowarn) {
+} elsif ($dsa_keys && ! $dsa_nowarn || $weird_keyfiles) {
$status = "WARNING";
}
my $name = shift;
if (open (my $FH, '<', $name)) {
my $key = <$FH>;
- if ($key =~ m/ssh-dss/) {
+ if (! defined $key) {
+ $weird_keyfiles++;
+ $text .= "cannot read $name properly - empty?\n";
+ } elsif ($key =~ m/ssh-dss/) {
$dsa_keys++;
$text .= "$name is a DSA key\n";
}
}
+sub from_debianorg_places () {
+ open(F, "/etc/ssh/sshd_config") or die ("Cannot open /etc/ssh/sshd_config: $!\n");
+ my @lines = <F>;
+ close(F);
+
+ my @ak = grep { /^AuthorizedKeysFile\s/i } @lines;
+ my @ak2 = grep { /^AuthorizedKeysFile2\s/i } @lines;
+
+ if (scalar @ak != 1) {
+ print $fh "UNKNOWN\n";
+ print $fh "There is more than one AuthorizedKeysFile definition in sshd_config\n";
+ exit
+ }
+ if (scalar @ak2 != 1) {
+ print $fh "UNKNOWN\n";
+ print $fh "There is more than one AuthorizedKeysFile2 definition in sshd_config\n";
+ exit
+ }
+ unless ($ak[0] =~ m#^((?i)AuthorizedKeysFile)\s+/etc/ssh/userkeys/%u$# ) {
+ print $fh "UNKNOWN\n";
+ print $fh "The AuthorizedKeysFile definition has an unexpected value. Should be /etc/ssh/userkeys/%u\n";
+ exit
+ }
+ unless ($ak2[0] =~ m#^((?i)AuthorizedKeysFile2)\s+/var/lib/misc/userkeys/%u$# ) {
+ print $fh "UNKNOWN\n";
+ print $fh "The AuthorizedKeysFile2 definition has an unexpected value. Should be /var/lib/misc/userkeys/%u\n";
+ exit
+ }
+
+ for my $d (qw{/etc/ssh/userkeys /var/lib/misc/userkeys}) {
+ next unless (-d $d);
+ opendir(D, $d) or die "Cannot opendir $d: $!\n";
+ for my $file (grep { ! -d $d.'/'.$_ } readdir(D)) {
+ next if ($file eq 'README-DSA-BUILDD');
+ my $f = $d.'/'.$file;
+ from_ssh_key_file $f if -r $f;
+ };
+ };
+}
+
+