From: Peter Palfrader Date: Wed, 14 May 2008 15:47:17 +0000 (+0200) Subject: Merge: ud-mailgate no longer accepts ssh dss keys, keys with a size smaller than... X-Git-Tag: userdir-ldap-0.3.22~1 X-Git-Url: https://git.adam-barratt.org.uk/?p=mirror%2Fuserdir-ldap.git;a=commitdiff_plain;h=b077ff6ff0a392ea268afeb9b09f2121ab76660e;hp=746a7e9fd846ce621ac16c781937d37bebc712ea Merge: ud-mailgate no longer accepts ssh dss keys, keys with a size smaller than 1024. Additionally it checks new keys against a blacklist of ssh key fingerprints. [joerg] --- diff --git a/debian/changelog b/debian/changelog index d937a98..8a41153 100644 --- a/debian/changelog +++ b/debian/changelog @@ -4,8 +4,11 @@ userdir-ldap (0.3.21+X) Xunstable; urgency=low about it. [zobel] * Add IPv6-Adresses (and IPv4 in v6 notation - ::ffff:192.0.2.1) to ssh_known_hosts. [aba] + * ud-mailgate no longer accepts ssh dss keys, keys with a size smaller + than 1024. Additionally it checks new keys against a blacklist of + ssh key fingerprints. [joerg] - -- Peter Palfrader Wed, 14 May 2008 17:33:47 +0200 + -- Peter Palfrader Wed, 14 May 2008 17:44:17 +0200 userdir-ldap (0.3.21) unstable; urgency=low diff --git a/templates/admin-info b/templates/admin-info new file mode 100644 index 0000000..22a3d43 --- /dev/null +++ b/templates/admin-info @@ -0,0 +1,17 @@ +To: __ADMIN__ +MIME-Version: 1.0 +Content-Type: text/plain; charset="utf-8" +Content-Transfer-Encoding: 8bit +Subject: User trying to add a bad or too small key to LDAP + +Hello admins! + +I (__USER__) just tried to add a known bad or too small SSH key +to LDAP: + +__ERROR__ + +Please lart me, thanks. + +-- +Thanks, __USER__ \ No newline at end of file diff --git a/ud-mailgate b/ud-mailgate index f705497..51942f1 100755 --- a/ud-mailgate +++ b/ud-mailgate @@ -3,11 +3,12 @@ # Prior copyright probably rmurray, troup, joey, jgg -- weasel 2008 # Copyright (c) 2008 Peter Palfrader +# Copyright (c) 2008 Joerg Jaspert -import userdir_gpg, userdir_ldap, sys, traceback, time, ldap, os; -import pwd -from userdir_gpg import *; -from userdir_ldap import *; +import userdir_gpg, userdir_ldap, sys, traceback, time, ldap, os, commands +import pwd, tempfile +from userdir_gpg import * +from userdir_ldap import * # Error codes from /usr/include/sysexits.h ReplyTo = ConfModule.replyto; @@ -15,6 +16,7 @@ PingFrom = ConfModule.pingfrom; ChPassFrom = ConfModule.chpassfrom; ChangeFrom = ConfModule.changefrom; ReplayCacheFile = ConfModule.replaycachefile; +SSHFingerprintFile = ConfModule.fingerprintfile EX_TEMPFAIL = 75; EX_PERMFAIL = 65; # EX_DATAERR @@ -27,6 +29,8 @@ mailWhitelist = {} SeenList = {} DNS = {} +SSHFingerprint = re.compile('^(\d+) ([0-9a-f\:]{47}) (.+)$') + ArbChanges = {"c": "..", "l": ".*", "facsimileTelephoneNumber": ".*", @@ -218,16 +222,87 @@ def DoPosition(Str,Attrs): Attrs.append((ldap.MOD_REPLACE,"longitude",sLong)); return "Position set to %s/%s (%s/%s decimal degrees)"%(sLat,sLong,Lat,Long); +# Load bad ssh fingerprints +def LoadBadSSH(): + f = open(SSHFingerprintFile, "r") + bad = [] + FingerprintLine = re.compile('^([0-9a-f\:]{47}).*$') + for line in f.readlines(): + Match = FingerprintLine.match(line) + if Match is not None: + g = Match.groups() + bad.append(g[0]) + return bad + # Handle an SSH authentication key, the line format is: # [options] 1024 35 13188913666680[..] [comment] -def DoSSH(Str,Attrs): +def DoSSH(Str, Attrs, badkeys, uid): Match = SSH2AuthSplit.match(Str); + g = Match.groups() + typekey = g[1] if Match == None: Match = re.compile('^1024 (\d+) ').match(Str) if Match is not None: return "SSH1 keys not supported anymore" return None; - + + (fd, path) = tempfile.mkstemp(".pub", "sshkeytry", "/tmp") + f = open(path, "w") + f.write("%s\n" % (Str)) + f.close() + cmd = "/usr/bin/ssh-keygen -l -f %s < /dev/null" % (path) + (result, output) = commands.getstatusoutput(cmd) + os.remove(path) + if (result != 0): + raise Error, "ssh-keygen -l invocation failed!\n%s\n" % (output) + + + # Head + Date = time.strftime("%a, %d %b %Y %H:%M:%S +0000",time.gmtime(time.time())) + ErrReplyHead = "From: %s\nCc: %s\nReply-To: %s\nDate: %s\n" % (os.environ['SENDER'],os.environ['SENDER'],ReplyTo,Date) + Subst = {} + Subst["__ADMIN__"] = ReplyTo + Subst["__USER__"] = uid + + Match = SSHFingerprint.match(output) + g = Match.groups() + + if int(g[0]) < 1024: + try: + # Body + Subst["__ERROR__"] = "SSH keysize %s is below limit 1024" % (g[0]) + ErrReply = TemplateSubst(Subst,open(TemplatesDir+"admin-info","r").read()) + + Child = os.popen("/usr/sbin/sendmail -t","w") + Child.write(ErrReplyHead) + Child.write(ErrReply) + if Child.close() != None: + raise Error, "Sendmail gave a non-zero return code" + except: + sys.exit(EX_TEMPFAIL) + + # And now break and stop processing input, which sends a reply to the user. + raise Error, "SSH keys must have at least 1024 bits, processing halted, NOTHING MODIFIED AT ALL" + elif g[1] in badkeys: + try: + # Body + Subst["__ERROR__"] = "SSH key with fingerprint %s known as bad key" % (g[1]) + ErrReply = TemplateSubst(Subst,open(TemplatesDir+"admin-info","r").read()) + + Child = os.popen("/usr/sbin/sendmail -t","w") + Child.write(ErrReplyHead) + Child.write(ErrReply) + if Child.close() != None: + raise Error, "Sendmail gave a non-zero return code" + except: + sys.exit(EX_TEMPFAIL) + + # And now break and stop processing input, which sends a reply to the user. + raise Error, "Submitted SSH Key known to be bad and insecure, processing halted, NOTHING MODIFIED AT ALL" + + if (typekey == "dss"): + return "DSA keys not accepted anymore" + global SeenKey; if SeenKey: Attrs.append((ldap.MOD_ADD,"sshRSAAuthKey",Str)); @@ -370,12 +445,13 @@ def HandleChange(Reply,DnRecord,Key): Result = Result + "> "+Line+"\n"; try: if Line == "show": - Show = 1; - Res = "OK"; + Show = 1; + Res = "OK"; else: - Res = DoPosition(Line,Attrs) or DoDNS(Line,Attrs,DnRecord) or \ - DoArbChange(Line,Attrs) or DoSSH(Line,Attrs) or \ - DoDel(Line,Attrs) or DoRBL(Line,Attrs); + badkeys = LoadBadSSH() + Res = DoPosition(Line,Attrs) or DoDNS(Line,Attrs,DnRecord) or \ + DoArbChange(Line,Attrs) or DoSSH(Line,Attrs,badkeys,GetAttr(DnRecord,"uid")) or \ + DoDel(Line,Attrs) or DoRBL(Line,Attrs) except: Res = None; Result = Result + "==> %s: %s\n" %(sys.exc_type,sys.exc_value); diff --git a/userdir-ldap.conf b/userdir-ldap.conf index 048e907..d3a37bb 100644 --- a/userdir-ldap.conf +++ b/userdir-ldap.conf @@ -24,6 +24,7 @@ changefrom = "change@" + maildomain; templatesdir = "/etc/userdir-ldap/templates/"; replaycachefile = "/var/cache/userdir-ldap/mail/replay"; #replaycachefile = "/tmp/replay"; +fingerprintfile = "/etc/userdir-ldap/badfingerprints" # Echelon ech_errorlog = "/org/db.debian.org/mail/Log/ech-errors.log"