Bug 1319 - ssh-keygen does not properly handle multiple keys
Summary: ssh-keygen does not properly handle multiple keys
Status: CLOSED FIXED
Alias: None
Product: Portable OpenSSH
Classification: Unclassified
Component: ssh-keygen (show other bugs)
Version: 4.5p1
Hardware: Other All
: P2 normal
Assignee: Assigned to nobody
URL:
Keywords:
Depends on:
Blocks: 1544 V_7_2
  Show dependency treegraph
 
Reported: 2007-06-05 23:36 AEST by Chris Pepper
Modified: 2016-08-02 10:42 AEST (History)
1 user (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Chris Pepper 2007-06-05 23:36:01 AEST
When pointed at a file containing multiple keys, ssh-keygen only fingerprints the first key, and does not either fingerprint the additional keys or warn in any way that there are (or might be) additional keys in the specified file.

pepper@salt:~/.ssh$ ssh-keygen -l -f authorized_keys
1024 5c:3a:b3:94:5d:ef:28:2c:4d:76:8a:9f:36:81:5c:af authorized_keys
pepper@salt:~/.ssh$ wc -l authorized_keys
       3 authorized_keys
Comment 1 Damien Miller 2008-06-15 05:19:42 AEST
the problem here is that in ssh-keygen.c:do_fingerprint() we try key_load_public() first. If this finds a key then we bail, if not then we continue though the file a line at a time assuming authorized_keys format.

The difficulty in fixing this comes from the fact that key_load_public() opens, reads and closes the file in one go. We need a variant that operates on an open file (or just a line), so we can continue.
Comment 2 Damien Miller 2011-06-03 13:40:19 AEST
We can do this with the new authfile.c code that supports parsing from memory buffers.
Comment 3 Damien Miller 2011-09-06 10:34:16 AEST
Retarget unresolved bugs/features to 6.0 release
Comment 4 Damien Miller 2011-09-06 10:36:29 AEST
Retarget unresolved bugs/features to 6.0 release
Comment 5 Damien Miller 2011-09-06 10:39:03 AEST
Retarget unresolved bugs/features to 6.0 release

(try again - bugzilla's "change several" isn't)
Comment 6 Damien Miller 2011-12-02 12:19:01 AEDT
Fixing this is trickier than I thought. The cases that need to be supported are:

1. SSH1 public key in a private blob
2. SSH1/SSH2 public key in text form
3. known_hosts
4. authorized_keys

We can deal with case #1 by using key_load_public_type() instead of key_load_public.

It is a little more tricky to support the other cases together though. For a start, known_hosts always has a hostname before the key string whereas a public key in text format never does. authorized_keys has optional key restrictions that need to be recognised and skipped.

A final (?) complication comes in the printing - when printing fingerprints from known_hosts, one wants to print the hostname obtained from the start of the line, but when printing everything else the key comment (end of the line, or baked into the a binary SSH1 private key) is the most important thing.

So, do_fingerprint needs to be rewritten to look something like this:

k = key_load_public_type(KEY_RSA1, identity_file, comment)
if (k != NULL)
  print fingerprint+comment and exit
for line in identity_file
  split_key_line(line, &preamble, &key, &comment)
  if (auth_parse_options(preamble)) {
    // If it has options then it's definitely authorized keys
    authorized_keys = 1
  } else if (*preamble != '\0') {
    // If the preamble doesn't look like options, then it's probably
    // known_hosts
    known_hosts = 1
  } else {
    // If no preamble at all then it's a plain key or authorized_keys
  }
  print_fingerprint(key)
  print_comment(known_hosts ? preamble : comment)
}
Comment 7 Damien Miller 2012-02-24 10:34:25 AEDT
Retarget from 6.0 to 6.1
Comment 8 Damien Miller 2012-02-24 10:38:04 AEDT
Retarget 6.0 => 6.1
Comment 9 Damien Miller 2012-09-07 11:38:03 AEST
Retarget uncompleted bugs from 6.1 => 6.2
Comment 10 Damien Miller 2012-09-07 11:40:33 AEST
Retarget bugs from 6.1 => 6.2
Comment 11 Damien Miller 2013-03-08 10:23:42 AEDT
retarget to openssh-6.3
Comment 12 Damien Miller 2013-07-25 12:17:43 AEST
Retarget to openssh-6.4
Comment 13 Damien Miller 2013-07-25 12:20:37 AEST
Retarget 6.3 -> 6.4
Comment 14 Damien Miller 2014-02-06 10:17:56 AEDT
Retarget incomplete bugs / feature requests to 6.6 release
Comment 15 Damien Miller 2014-02-06 10:19:53 AEDT
Retarget incomplete bugs / feature requests to 6.6 release
Comment 16 Damien Miller 2014-04-12 14:48:46 AEST
Retarget to 6.7 release, since 6.6 was mostly bugfixing.
Comment 17 Damien Miller 2014-04-12 14:55:14 AEST
Remove from 6.6 tracking bug
Comment 18 Damien Miller 2014-07-07 18:08:47 AEST
Remove from 6.7 blocker list. I'm not sure yet sure how to do this reliably
Comment 19 Damien Miller 2015-11-17 09:54:09 AEDT
This is fixed in HEAD and will be in the openssh-7.2 release.
Comment 20 Damien Miller 2015-11-17 11:27:18 AEDT
This is now implemented in HEAD, supporting RSA1 private keys, v2 public keys, authorized_keys, known_hosts and allowing ssh-keygen -lf- to read from stdin.

https://anongit.mindrot.org/openssh.git/commit/?id=c56a255162c2166884539c0a1f7511575325b477

It will be in the forthmcoming openssh-7.2 release
Comment 21 Damien Miller 2016-08-02 10:42:59 AEST
Close all resolved bugs after 7.3p1 release