Skip to content

Detect leaked ssh keys in backup snapshots#253

Merged
rubiojr merged 4 commits intomasterfrom
leaked-ssh-keys-detect
Sep 20, 2016
Merged

Detect leaked ssh keys in backup snapshots#253
rubiojr merged 4 commits intomasterfrom
leaked-ssh-keys-detect

Conversation

@rubiojr
Copy link
Copy Markdown
Member

@rubiojr rubiojr commented Sep 20, 2016

This adds detection of leaked SSH host keys in backup snapshots.

Detection has been added to the backup as well as restore scripts. A standalone script is also provided to verify the status of all snapshots or individual backup snapshots.

Example of a restore run:

$./bin/ghe-restore -v -f
* Leaked key found in backup snapshot.
* Snapshot file: /home/dev/backup-utils-private/data/20160826T114243/ssh-host-keys.tar
* Key file: ssh_host_rsa_key.pub
* Key: c5:23:20:32:3d:c3:23:e5:64:36:e2:09:c9:47:41:12

* The snapshot that is being restored contains a leaked SSH host key.
* We recommend rolling the SSH host keys after completing the restore.
* Roll the keys either manually or with ghe-ssh-roll-host-keys on the appliance.
* (An upgrade may be required)

Example standalone run:

$>./share/githup-backup-utils/ghe-detect-leaked-ssh-keys

* Leaked key found in backup snapshot.
* Snapshot file: /home/dev/backup-utils-private/data/20160826T114243/ssh-host-keys.tar
* Key file: ssh_host_rsa_key.pub
* Key: c5:23:20🇩🇪3d:c3:c9:e5:64:23:a1:09:c9:47:41:12

* Leaked key found in current backup snapshot.
* Snapshot file: /home/dev/backup-utils-private/data/20160614T045039/ssh-host-keys.tar
* Key file: ssh_host_rsa_key.pub
* Key: c5:11:20:ac:3d:c3:c9:e5:54:36:a1:09:c9:47:41:45

* The current backup contains leaked SSH host keys.
* current backup directory: /home/dev/backup-utils-private/data/20160614T045039
* We strongly recommend rolling your SSH host keys with ghe-ssh-roll-host-keys and making a new backup.

* One or more older backup snapshots that contain leaked SSH host keys,
* No immediate action is needed but when you use one of these older snapshots for a restore, please make sure to roll the SSH host keys after restore.
* Roll the keys either manually or with ghe-ssh-roll-host-keys on the appliance.
* (An upgrade may be required)

/cc @github/backup-utils

sridharavinash and others added 4 commits September 20, 2016 18:58
This adds detection of leaked SSH host keys in backup snapshots.

Detection has been added to the backup as well as restore scripts. A standalone script is also provided to verify the status of all snapshots or individual backup snapshots.

Example of a restore run:
```
$./bin/ghe-restore -v -f
* Leaked key found in backup snapshot.
* Snapshot file: /home/dev/backup-utils-private/data/20160826T114243/ssh-host-keys.tar
* Key file: ssh_host_rsa_key.pub
* Key: c5:23:20:32:3d:c3:23:e5:64:36:e2:09:c9:47:41:12

* The snapshot that is being restored contains a leaked SSH host key.
* We recommend rolling the SSH host keys after completing the restore.
* Roll the keys either manually or with ghe-ssh-roll-host-keys on the appliance.
* (An upgrade may be required)
```

Example standalone run:
```
$>./share/githup-backup-utils/ghe-detect-leaked-ssh-keys

* Leaked key found in backup snapshot.
* Snapshot file: /home/dev/backup-utils-private/data/20160826T114243/ssh-host-keys.tar
* Key file: ssh_host_rsa_key.pub
* Key: c5:23:20:de:3d:c3:c9:e5:64:23:a1:09:c9:47:41:12

* Leaked key found in current backup snapshot.
* Snapshot file: /home/dev/backup-utils-private/data/20160614T045039/ssh-host-keys.tar
* Key file: ssh_host_rsa_key.pub
* Key: c5:11:20:ac:3d:c3:c9:e5:54:36:a1:09:c9:47:41:45

* The current backup contains leaked SSH host keys.
* current backup directory: /home/dev/backup-utils-private/data/20160614T045039
* We strongly recommend rolling your SSH host keys with ghe-ssh-roll-host-keys and making a new backup.

* One or more older backup snapshots that contain leaked SSH host keys,
* No immediate action is needed but when you use one of these older snapshots for a restore, please make sure to roll the SSH host keys after restore.
* Roll the keys either manually or with ghe-ssh-roll-host-keys on the appliance.
* (An upgrade may be required)
```
@rubiojr rubiojr merged commit 28c01a0 into master Sep 20, 2016
@rubiojr rubiojr deleted the leaked-ssh-keys-detect branch September 20, 2016 18:20
rubiojr added a commit that referenced this pull request Sep 20, 2016
Bug fixes and required tooling to detect SSH host keys that should be
blacklisted, see https://enterprise.github.com/releases/2.7.4/notes

* Cluster: fix offline cluster node detection #253
* Detect leaked ssh keys in backup snapshots @250
@rubiojr rubiojr mentioned this pull request Sep 20, 2016
rubiojr added a commit that referenced this pull request Sep 20, 2016
Bug fixes and required tooling to detect SSH host keys that should be
blacklisted, see https://enterprise.github.com/releases/2.7.4/notes

* Cluster: fix offline cluster node detection #253
* Detect leaked ssh keys in backup snapshots @250
rubiojr added a commit that referenced this pull request Sep 20, 2016
Bug fixes and required tooling to detect SSH host keys that should be
blacklisted, see https://enterprise.github.com/releases/2.7.4/notes

* Cluster: fix offline cluster node detection #253
* Detect leaked ssh keys in backup snapshots #250
rubiojr added a commit that referenced this pull request Sep 20, 2016
Bug fixes and required tooling to detect SSH host keys that should be
blacklisted, see https://enterprise.github.com/releases/2.7.4/notes

* Cluster: fix offline cluster node detection #250
* Detect leaked ssh keys in backup snapshots #253
dooleydevin added a commit that referenced this pull request Nov 10, 2022
Sync with v3.7.0 of public backup-utils
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants