From: Joerg Jaspert <joerg@ganneff.de>
Date: Wed, 14 May 2008 14:43:40 +0000 (+0200)
Subject: Check ssh keys:
X-Git-Tag: userdir-ldap-0.3.22~1^2~1^2
X-Git-Url: https://git.adam-barratt.org.uk/?p=mirror%2Fuserdir-ldap.git;a=commitdiff_plain;h=529a3f21a560e3f6ff85c875ccd4b2a9fb3b37bd

Check ssh keys:
 - reject all DSA keys, similar to RSA1 keys.
 - reject and mail the admins for broken keys, ie keys
   - of size below 1024 or
   - known to be bad (fingerprintlist)
---

diff --git a/ud-mailgate b/ud-mailgate
index 6b8cd38..48a38a1 100755
--- a/ud-mailgate
+++ b/ud-mailgate
@@ -3,11 +3,12 @@
 
 #   Prior copyright probably rmurray, troup, joey, jgg -- weasel 2008
 #   Copyright (c) 2008 Peter Palfrader <peter@palfrader.org>
+#   Copyright (c) 2008 Joerg Jaspert <joerg@debian.org>
 
-import userdir_gpg, userdir_ldap, sys, traceback, time, ldap, os;
-import pwd
-from userdir_gpg import *;
-from userdir_ldap import *;
+import userdir_gpg, userdir_ldap, sys, traceback, time, ldap, os, commands
+import pwd, tempfile
+from userdir_gpg import *
+from userdir_ldap import *
 
 # Error codes from /usr/include/sysexits.h
 ReplyTo = ConfModule.replyto;
@@ -15,6 +16,7 @@ PingFrom = ConfModule.pingfrom;
 ChPassFrom = ConfModule.chpassfrom;
 ChangeFrom = ConfModule.changefrom;
 ReplayCacheFile = ConfModule.replaycachefile;
+SSHFingerprintFile = ConfModule.fingerprintfile
 
 EX_TEMPFAIL = 75;
 EX_PERMFAIL = 65;      # EX_DATAERR
@@ -27,6 +29,8 @@ mailWhitelist = {}
 SeenList = {}
 DNS = {}
 
+SSHFingerprint = re.compile('^(\d+) ([0-9a-f\:]{47}) (.+)$')
+
 ArbChanges = {"c": "..",
 	      "l": ".*",
 	      "facsimileTelephoneNumber": ".*",
@@ -216,16 +220,87 @@ def DoPosition(Str,Attrs):
    Attrs.append((ldap.MOD_REPLACE,"longitude",sLong));
    return "Position set to %s/%s (%s/%s decimal degrees)"%(sLat,sLong,Lat,Long);
 
+# Load bad ssh fingerprints
+def LoadBadSSH():
+   f = open(SSHFingerprintFile, "r")
+   bad = []
+   FingerprintLine = re.compile('^([0-9a-f\:]{47}).*$')
+   for line in f.readlines():
+      Match = FingerprintLine.match(line)
+      if Match is not None:
+         g = Match.groups()
+         bad.append(g[0])
+   return bad
+
 # Handle an SSH authentication key, the line format is:
 #  [options] 1024 35 13188913666680[..] [comment]
-def DoSSH(Str,Attrs):
+def DoSSH(Str, Attrs, badkeys, uid):
    Match = SSH2AuthSplit.match(Str);
+   g = Match.groups()
+   typekey = g[1]
    if Match == None:
       Match = re.compile('^1024 (\d+) ').match(Str)
       if Match is not None:
          return "SSH1 keys not supported anymore"
       return None;
-   
+
+   (fd, path) = tempfile.mkstemp(".pub", "sshkeytry", "/tmp")
+   f = open(path, "w")
+   f.write("%s\n" % (Str))
+   f.close()
+   cmd = "/usr/bin/ssh-keygen -l -f %s < /dev/null" % (path)
+   (result, output) = commands.getstatusoutput(cmd)
+   os.remove(path)
+   if (result != 0):
+      raise Error, "ssh-keygen -l invocation failed!\n%s\n" % (output)
+
+
+   # Head
+   Date = time.strftime("%a, %d %b %Y %H:%M:%S +0000",time.gmtime(time.time()))
+   ErrReplyHead = "From: %s\nCc: %s\nReply-To: %s\nDate: %s\n" % (os.environ['SENDER'],os.environ['SENDER'],ReplyTo,Date)
+   Subst = {}
+   Subst["__ADMIN__"] = ReplyTo
+   Subst["__USER__"] = uid
+
+   Match = SSHFingerprint.match(output)
+   g = Match.groups()
+
+   if int(g[0]) < 1024:
+      try:
+         # Body
+         Subst["__ERROR__"] = "SSH keysize %s is below limit 1024" % (g[0])
+         ErrReply = TemplateSubst(Subst,open(TemplatesDir+"admin-info","r").read())
+
+         Child = os.popen("/usr/sbin/sendmail -t","w")
+         Child.write(ErrReplyHead)
+         Child.write(ErrReply)
+         if Child.close() != None:
+            raise Error, "Sendmail gave a non-zero return code"
+      except:
+         sys.exit(EX_TEMPFAIL)
+
+      # And now break and stop processing input, which sends a reply to the user.
+      raise Error, "SSH keys must have at least 1024 bits, processing halted, NOTHING MODIFIED AT ALL"
+   elif g[1] in badkeys:
+      try:
+         # Body
+         Subst["__ERROR__"] = "SSH key with fingerprint %s known as bad key" % (g[1])
+         ErrReply = TemplateSubst(Subst,open(TemplatesDir+"admin-info","r").read())
+
+         Child = os.popen("/usr/sbin/sendmail -t","w")
+         Child.write(ErrReplyHead)
+         Child.write(ErrReply)
+         if Child.close() != None:
+            raise Error, "Sendmail gave a non-zero return code"
+      except:
+         sys.exit(EX_TEMPFAIL)
+
+      # And now break and stop processing input, which sends a reply to the user.
+      raise Error, "Submitted SSH Key known to be bad and insecure, processing halted, NOTHING MODIFIED AT ALL"
+
+   if (typekey == "dss"):
+      return "DSA keys not accepted anymore"
+
    global SeenKey;
    if SeenKey:
      Attrs.append((ldap.MOD_ADD,"sshRSAAuthKey",Str));
@@ -368,12 +443,13 @@ def HandleChange(Reply,DnRecord,Key):
       Result = Result + "> "+Line+"\n";
       try:
          if Line == "show":
-           Show = 1;
-	   Res = "OK";
+            Show = 1;
+            Res = "OK";
          else:
-           Res = DoPosition(Line,Attrs) or DoDNS(Line,Attrs,DnRecord) or \
-                 DoArbChange(Line,Attrs) or DoSSH(Line,Attrs) or \
-		 DoDel(Line,Attrs) or DoRBL(Line,Attrs);
+            badkeys = LoadBadSSH()
+            Res = DoPosition(Line,Attrs) or DoDNS(Line,Attrs,DnRecord) or \
+                  DoArbChange(Line,Attrs) or DoSSH(Line,Attrs,badkeys,GetAttr(DnRecord,"uid")) or \
+                  DoDel(Line,Attrs) or DoRBL(Line,Attrs)
       except:
          Res = None;
          Result = Result + "==> %s: %s\n" %(sys.exc_type,sys.exc_value);
diff --git a/userdir-ldap.conf b/userdir-ldap.conf
index 048e907..d3a37bb 100644
--- a/userdir-ldap.conf
+++ b/userdir-ldap.conf
@@ -24,6 +24,7 @@ changefrom = "change@" + maildomain;
 templatesdir = "/etc/userdir-ldap/templates/";
 replaycachefile = "/var/cache/userdir-ldap/mail/replay";
 #replaycachefile = "/tmp/replay";
+fingerprintfile = "/etc/userdir-ldap/badfingerprints"
 
 # Echelon
 ech_errorlog = "/org/db.debian.org/mail/Log/ech-errors.log"