Due to the recent security hole discovered in Debian, which has also concerned various distributions – of course including Ubuntu – for 2 years, I simply closed all my SSH and OpenVPN accesses.
I have had no time so far to check all the keys on my server. I prefer to stay on the safe side, though I have some reason to believe that my keys might not be so vulnerable : I generated them a long time ago, maybe before the Debian maintainer sad mistake.
It is going to be pretty easy now, for those who are motivated, to get access to the ssh server running keys generated during the 2 last years…
I recommend this article which summarize pretty well the situation. You may also use this tool, which checks if your keys are vulnerable :
$ perl dowkd.pl file ~/.ssh/*.pub
It find it funny to think that I chose to use certificates for security (avoiding brute force attacks).
What’s less funny is the pure disaster for the reputation of Debian.
I already noticed in the past that some companies switched their servers from Debian to Red Hat because of such security problems. They claimed about some security holes being patch much too slowly and about the lack of official support to rely on in such a crisis.
This kind of news is not going to enforce trust from companies.
I myself will think twice in the future about what system to use when I design my networks.
JC :: May.15.2008 ::
Security ::
1 Comment »
