X-Git-Url: https://git.adam-barratt.org.uk/?a=blobdiff_plain;f=dsa-nagios-nrpe-config%2Fweak-ssh-keys-check;h=e35a8a10c96e5f2b069a3b8ad58d88b7d4b02cdf;hb=34816cfa599726fb4d7c33e02091a14b22069312;hp=25cde53c92d21afeea2cc3e53fcf0bd045b62f18;hpb=b45f51ebd28d645bcd4afb0c02820c01a76b8062;p=mirror%2Fdsa-nagios.git

diff --git a/dsa-nagios-nrpe-config/weak-ssh-keys-check b/dsa-nagios-nrpe-config/weak-ssh-keys-check
index 25cde53..e35a8a1 100755
--- a/dsa-nagios-nrpe-config/weak-ssh-keys-check
+++ b/dsa-nagios-nrpe-config/weak-ssh-keys-check
@@ -11,6 +11,8 @@
 #
 # Copyright (c) 2008, Alexander Wirt <formorer@debian.org> for check_weakkeys
 #
+# Copyright (c) 2008 Peter Palfrader <peter@palfrader.org>
+#
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
 # copyright notice and this permission notice appear in all copies.
@@ -116,6 +118,7 @@ tie %fpr_hash, 'BerkeleyDB::Btree',
 
 my ($weak_keys,$checked_keys) = 0;
 my $dsa_keys = 0;
+my $weird_keyfiles = 0;
 my $text = '';
 my %key_sizes;
 
@@ -128,7 +131,7 @@ my %key_sizes;
 my $status="OK";
 if ($weak_keys) {
 	$status = "CRITICAL";
-} elsif ($dsa_keys && ! $dsa_nowarn) {
+} elsif ($dsa_keys && ! $dsa_nowarn  ||  $weird_keyfiles) {
 	$status = "WARNING";
 }
 
@@ -195,7 +198,10 @@ sub from_ssh_key_file ($) {
     my $name = shift;
     if (open (my $FH, '<', $name)) {
 	my $key = <$FH>; 
-	if ($key =~ m/ssh-dss/) {
+	if (! defined $key) {
+		$weird_keyfiles++;
+		$text .= "cannot read $name properly - empty?\n";
+	} elsif ($key =~ m/ssh-dss/) {
 		$dsa_keys++;
 		$text .= "$name is a DSA key\n";
 	}
@@ -323,7 +329,8 @@ sub from_debianorg_places () {
     for my $d (qw{/etc/ssh/userkeys /var/lib/misc/userkeys}) {
 	next unless (-d $d);
 	opendir(D, $d) or die "Cannot opendir $d: $!\n";
-	for my $file (grep { $_ ne "." && $_ ne ".."  } readdir(D)) {
+	for my $file (grep { ! -d $d.'/'.$_ } readdir(D)) {
+	    next if ($file eq 'README-DSA-BUILDD');
 	    my $f = $d.'/'.$file;
 	    from_ssh_key_file $f if -r $f;
 	};