Giter Club home page Giter Club logo

ssh-key-algo's Introduction

ssh-key-algo

A script to check if the SSH key is using an algorithm that will continue working after GitHub deprecates some insecure algorithms. For more information see the blog post at https://github.blog/2021-09-01-improving-git-protocol-security-github/.

This script was tested on MacOS, Debian stretch or higher and CentOS 6 or higher.

License

MIT (c) GitHub 2021

See the full license text in the LICENSE file.

ssh-key-algo's People

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

ssh-key-algo's Issues

Script incorrectly reports key type for OpenSSH 7.6

Using a key specifically generated with ssh-keygen -t rsa-sha2-512 on a Ubuntu 18.04 server running OpenSSH 7.6 (possibly others) erroneously reports

You're using an RSA key with SHA-1.
This key will continue to work if it's already set up, but you should strongly
consider generating a new key with the following command and using it instead:
ssh-keygen -t ed25519
If the key hasn't been set up by the deadline, you'll either need to generate a
new one as listed above, or upgrade to OpenSSH 7.2 or newer.

The debug statement for this version of OpenSSH for the sign_and_send_pubkey looks like debug3: sign_and_send_pubkey: RSA SHA256:<KEY_IDENTIFIER>. It is missing the 'signing' portion that the script is expecting. However, adding this key to a repository and cloning still works since the key is valid.

script report 'You're all set!' but I cannot clone

I just added a ssh key to my profile as instructed in https://docs.github.com/en/authentication/connecting-to-github-with-ssh
authentication with ssh -T [email protected] is successful
then I run the script:
jano@cata  ~  /usr/bin/sh ./ssh-key-algo [email protected]
using: /usr/bin/ssh
You're using an Ed25519 key. You're all set!

then I try to clone something:

jano@cata  ~  git clone git://github.com/DreamSourceLab/DSView.git
Cloning into 'DSView'...
fatal: remote error:
The unauthenticated git protocol on port 9418 is no longer supported.
Please see https://github.blog/2021-09-01-improving-git-protocol-security-github/ for more information.

I cannot clone, is the script lying or am I doing something wrong?

ssh-key-algo says "you're all set" but ssh fingerprinting still failing

I have two systems each running Xcode Server. Since around the 16th, both are unable to sense commits to repos and therefore do not trigger builds. When I investigate the server bot settings, I see the message that "SSH fingerprint could not be verified". I told both systems to trust the fingerprint, and all was good for one week. Then it happened again yesterday, and a colleague pointed me to the github blog post: https://github.blog/2021-09-01-improving-git-protocol-security-github/

I rotated one system to ecdsa, and this morning I realized this ssh-key-algo script exists.
So I ran ssh-key-algo on the server that is yet to update and I'm told "You're using an RSA key with SHA-2 (algorithm rsa-sha2-512). You're all set!"
That is the same key type that was failing on both of my servers. The ecdsa system also tells me "You're all set!" but this morning I see that server encountered a fingerprint problem again after updating in accordance with the blog post.

I can't tell if this means that this script is giving me a false positive, or if there is something deeper wrong.

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.