As you probably know already, there has been a security alert for OpenSSL.
Canonical:
”A weakness has been discovered in the random number generator used by OpenSSL on Debian and Ubuntu systems. As a result of this weakness, certain encryption keys are much more common than they should be, such that an attacker could guess the key through a brute-force attack given minimal knowledge of the system. This particularly affects the use of encryption keys in OpenSSH.”
Debian:
“It is strongly recommended that all cryptographic key material which has been generated by OpenSSL versions starting with 0.9.8c-1 on Debian systems is recreated from scratch. Furthermore, all DSA keys ever used on affected Debian systems for signing or authentication purposes should be considered compromised; the Digital Signature Algorithm relies on a secret random value used during signature generation.” (From the Debian Alert).
Launchpad:
“You need to take action to continue using Launchpad features such as code hosting. We have deleted your SSH key from Launchpad because we have discovered a potential security vulnerability in the way your key was generated.”
Also reported on “The Fridge” for Ubuntu (http://fridge.ubuntu.com/node/1445/).
The following Ubuntu/Kubuntu/Xubuntu releases are affected: 7.04, 7.10 and 8.04 LTS.
How to fix this:
Update your system:
Install the security updates
Ubuntu 7.04: openssh-client 1:4.3p2-8ubuntu1.3 openssh-server 1:4.3p2-8ubuntu1.3.
Ubuntu 7.10: openssh-client 1:4.6p1-5ubuntu0.3 openssh-server 1:4.6p1-5ubuntu0.3.
Ubuntu 8.04 LTS: openssh-client 1:4.7p1-8ubuntu1.1 openssh-server 1:4.7p1-8ubuntu1.1.
Once the update is applied, weak user keys will be automatically rejected where possible.
Update OpenSSH known_hosts files.
Check whether your key is affected by running the ssh-vulnkey tool, included in the security update. (If in doubt, destroy the key and generate a new one.)
To check all your own keys, assuming they are in the standard locations (~/.ssh/id_rsa, ~/.ssh/id_dsa, or ~/.ssh/identity):
$ ssh-vulnkey.
To check all keys on your system:
$ sudo ssh-vulnkey -a.
To check a key in a non-standard location:
$ ssh-vulnkey /path/to/key/.
If ssh-vulnkey says "COMPROMISED", the key is vulnerable and should be replaced.
Regenerate any affected user keys OpenSSH or, generate new keys using ssh-keygen, e.g.:
$ ssh-keygen.
If necessary, update authorized_keys files.
However, this situation occurred as the result of a programming bug, not as the result of making a weak key.
We all thank to Luciano Bello, who discovered that the random number generator in Debian's
OpenSSL package is predictable.
.
..: