ssh-vulnkey

Allows to check ssh keys against debian ssh key vulnerability database.

Setup

% make setup

This downloads the Debian blacklist files into ./blacklist. ssh-vulnkey uses that local copy automatically when /usr/share/ssh/blacklist.* is not available.

Sample Usage

% ssh-vulnkey key1.pub key2.pub

DKIM public keys can be checked after converting the DNS p= value into an OpenSSH public key:

% dig txt google._domainkey.github.com +short | ./dkim-vulnkey

Testing

% make test

Rationale

Debian removed the patch implementing ssh-vulnkey in openssh thus no tool was available anymore to check keys against the vulnerability databases as provided in openssh-blacklist(-extra).

Idea

Also provide more generic RSA key checks for eg. known weak keys.

License, Author

• License: Apache 2
• Author: Michael Gebetsroither mgebetsroither@mgit.at