Results tagged “OpenSSL” from CLICK

So who hasn't heard about the bug in OpenSSL in Debian-based distributions that renders any SSH keys created in the past two years extremely weak from a cryptographic standpoint?

The problem is that instead of many millions of potential cryptographically generated keys, due to the error there have been only 32,767. That's easy for a hacker to crack. Not a good thing at all.

According to my feeble understanding of the issue, there was a problem with the random-number generator used for the process of creating the keys needed for secure access to servers. And yes, I do use OpenSSL quite a bit and will be discarding and re-generating my keys very soon now. As soon as I figure out how to do it, that is.

Here is one of the many Debian developer/maintainer blog posts that attempts to explain the whole thing.

And here is the Debian Security announcement with instructions on how to deal with it.

Some are calling this bug the worst thing to ever happen to the Debian project. The worst part is that systems have been vulnerable for the past two years. And this means Ubuntu, too.

There's been plenty of carping and gloating about this on the OpenBSD mailing lists. OpenBSD, in case you don't know, is the project where OpenSSL originated, and there's been plenty of blaming going on. And since OpenBSD is extremely focused on security and cryptography, those who develop and use it are extremely ... interested in the snafu.

What I'd like to see is an easy way for users to know that they need to regenerate their SSH keys -- along with an equally easy way to do it. To that end:

Here's a really good Ubuntu blog post on how to make it right on your machines.

The security announcement from Ubuntu is also very helpful.

And in case it got missed in any of these others (although I can't imagine that it did), here's a post that goes into how to generate new keys for OpenSSH-server.

In my case, I think I only have server keys on my Debian Etch box. I don't recall using OpenSSL as a client on any Debian or Ubuntu installs because I've been using MacSSH on the Powerbook 1400 and PuTTY on the Windows box as clients. And the only servers affected are the aforementioned Debian Etch install.

The only other server on which I have OpenSSL-server is my OpenBSD machine, which is unaffected by all of this. As a point (or two) of information, In OpenBSD you get both the OpenSSL client and server in the base system; in Debian you get the client but must add the server if you want it.

Final note: I'm no expert when it comes to these things, hence the voluminous number of links included in this post. I'll be studying them myself over the next few days or so.