Damage control: Cleaning up compromised SSH keys

2010.09.22

This morning, my laptop was stolen from my parked car while I was jogging. I do not want to make a big deal out of it.

Still, even though I am sure it was not targetted at my data (three other people at least were reporting similar facts in the same area), and the laptop’s disk will probably just be reformatted, I am trying to limit the possible impact of my cryptographic identification being in somebody else’s hands.

GPG makes it easy: I had on that machine just my old 1024D key, so it is just matter of generating a revocation certificate. I have done that, and uploaded it to the SKS keyservers - Anyway, here is my revocation certificate:

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: A revocation certificate should follow

iHIEIBEIADIFAkyaOZwrHQJBIGNvbXB1dGVyIGNvbnRhaW5pbmcgdGhpcyBrZXkg
d2FzIHN0b2xlbgAKCRDYDvNai7UnrzWAAKC34eF76JQjxrZqSjNwcC0dU/5VbACg
gMIMmYg91Sl3y8KsZXdGj/rV7UE=
=rdlT
-----END PGP PUBLIC KEY BLOCK-----

But… What worries me more is access to the computers my ssh key works for. Yes, the ssh key uses a nontrivial passphrase, but still — SSH keys cannot be revoked (and this makes sense, as SSH should not add the delay, or potential impossibility, to check with a remote infrastructure whenever you want to start a session).

So, I generated a new key (and stored it at ~/.ssh/id_rsa.new / ~/.ssh/id_rsa.new.pub) and came up with this snippet:

$ OLDKEY=xyHywJuHD3nsfLh03G1TqUEBKSj6NlzMfB1T759haoAQ $ for host in $(cat .ssh/known_hosts | cut -f 1 -d \ |cut -f 1 -d , | sort | uniq); do echo == $host ssh-copy-id -i .ssh/id_rsa.new.pub $host && ssh $host "perl -n -i -e 'next if /$OLDKEY/;print' .ssh/authorized_keys" done

Points about it you might scratch your head about:

.ssh/known_hosts' lines start with the server's name (or names, if more than one, comma-separated), followed by the key algorithm and the key fingerprint (space-separated). That's the reason for the double cut – It could probably be better using a regex-enabled thingy understanding /[, ]/, but... I didn't think of that. Besides, the savings would be just for academic purposes ;-)
I thought about not having the ssh line conditionally depend on ssh-copy-id. But OTOH, this makes sure I only try to remove the old key from the servers it is present on, and that I don't start sending my new key everywhere just for the sake of it.
my $OLDKEY (declared in Shell, and only literally interpolated in the Perl one-liner below) contains the final bits of my old key. It is long enough for me not to think I'm risking collision with any other key. Why did I choose that particular length? Oh, it was a mouse motion.
perl -n -i -e is one of my favorite ways to invoke perl. -i means in-line editing, it allows me to modify a file on the fly. This line just skips (removes) any keys containing $OLDKEY; -n tells it to loop all the lines over the provided program (and very similarly, -p would add a print at the end – Which in this particular ocassion, I prefer not to have). It is a sed lookalike, if you wish, but with a full Perl behind.

Caveats:

This assumes you have set HashKnownHosts: no in your .ssh/config. It is a tradeoff, after all – I use a lot tab-expansion (via bash_completion) for hostnames, so I do have the fully parseable list of hosts I have used on each of my computers.
I have always requested my account names to be gwolf. If you use more than one username... well, you will have to probably do more than one run of it connecting to foo@$host instead.
Although most multiuser servers stick to the usual port 22, many people change the ports (me included) either because they perceive concealing them gives extra security, or (as in my case) because they are fed up with random connection attempts. Those hosts are stored as [hostname]:port (i.e. [foo.gwolf.org]:22000). Of course, a little refinement takes care of it all.,/li>
Oh, I am not storing results... I should, so for successive runs I won't try to connect to a system I already did, or that already denied me access. Why would I want to? Because some computers are not currently turned on. So I'll run this script at least a couple of times.

something

I almost always store and carry my laptop suspended to RAM. Of course, there is still one layer of password-protection to do anything useful (i.e. the session is locked).

the monkeysphere project

  ssh $SERVER "cd .ssh && git pull"

#!/usr/bin/perl
# Matt Ford
# Setup git repo

use strict;
use warnings;
use File::Path;

my $ssh_dir="$ENV{HOME}/.ssh";
my $git_dir="$ssh_dir/.git";
my $remote_repo='ssh://zzalsmf3@storage008.vidar.ngs.manchester.ac.uk/~zzalsmf3/git/ssh';
my $FH;

# Remove existing $ssh_dir
if ( -d $ssh_dir ) {
    rmtree($ssh_dir) or die "Cannot remove $ssh_dir: $!";
}

# Create new bare bones repo and add remote repo to sync with
mkpath($ssh_dir,{mode => 0700}) or die "Cannot make $ssh_dir: $!";
chdir($ssh_dir)
    or die "Cannot change to $ssh_dir: $!";
! system(qw/git init/) 
    or die "Cannot create git repo: $!";
# Add gitignore settings to prevent the wrong files getting into origin
open ($FH,'>',".gitignore");
print $FH <<EOF;
identity
id_dsa
id_rsa
known_hosts
EOF
close $FH;
# ! system(qw/git commit --allow-empty -m/, "Create empty Master branch")
#     or die "Cannot create empty master branch: $!";
! system(qw/git add .gitignore/)
    or die "Cannot add .gitignore to repo:$!";
! system(qw/git commit -m/,"Initial import")
    or die "Cannot commit to repo:$!";
! system(qw/git remote add origin/, $remote_repo)
    or die "Cannot add remote repo: $!";

# Add remote branch
open ($FH,">>","$git_dir/config") 
    or die "Cannot open $git_dir: $!";
print $FH <<'EOF';
[branch "master"]
    remote = origin
    merge = refs/heads/master
EOF
close $FH;

# Add git hooks to ensure ssh client files have correct permissions
chdir("$git_dir/hooks") 
    or die "Cannot change to $git_dir/hooks: $!";
foreach ("pre-commit","post-merge","post-checkout") {
    open ($FH,'>',$_);
    print $FH <<'EOF';
#!/bin/sh
echo "Checking permissions..."
$HOME/sysadm/ssh-fix-permissions
EOF
    close $FH;
    chmod 0755, $_;
};


# Pull down repo
chdir($ssh_dir);
! system(qw/git pull/) 
    or die "Cannot pull from git repo: $!";