Updating Debian keys for the uninterested

Updating Debian keys for the uninterested


Despite having an aversion to configuring and maintaining security and crypto software, I accepted that I had to update my system in response to the recent big Debian security problem. If I can do it, you can do it. Below are my notes, but keep in mind that my security rank is somewhere between ignorant and uninterested.

Debian's advice

For Debian's advice about about updating your system, see these three pages:

Debian's "Key Rollover" page - as far as I can tell, "key rollover" is their term for updating your keys. It's a pity they don't use plain language or explain this.

http://wiki.debian.org/SSLkeys - a Debian wiki page with info on how to do "key rollover" on various pieces of software.

Debian's initial security advisory: DSA-1571-1 openssl.

Some good news is that GnuPG and GnuTLS are not affected. By coincidence, GnuTLS fixed some other security problems yesterday, so upgrading your GnuTLS in the near future would be a good idea, but there's no need to regenerate any keys.

What I did

To fix the OpenSSL problem, you have to do two things. First you have to upgrade the package "libssl0.9.8". Then you have to check your system for weak keys and regenerate them if there are any.

Package upgrading

About updating the "libssl0.9.8", remember to mention that package explicitly. I originally just upgraded "ssh" and "openssl", thinking that the necessary packages would be automatically updated because they're dependencies, but they're not. So, explicitly update "libssl0.9.8". It's probably a good idea anyway to update "ssh", "openssl", "openssh-client", and "openssh-server". So that's five packages to upgrade, but the most important is "libssl0.9.8".

Finding and regenerating weak keys

Next is to scan for weak keys. You do this by downloading the "dowkd.pl.gz".

Optionally, if you want to confirm that the dowkd.pl.gz that you're downloading is really the official Debian scanning tool, you can do this with GnuPG's "--verify" command. For this, you will need dowkd.pl.gz.asc (the signature of the scanning tool). This is described in more detail in a section of the above linked Debian wiki page. That .asc file is the signature for dowkd.pl.gz (not for dowkd.pl), so remember to do the verification before you unzip dowkd.pl.gz.

Next you run "perl dowkd.pl help" at the command line. From there, you choose your options. For me, since I'm the only user on my computer that uses ssh, I ran "perl dowkd.pl user ciaran". I was told I had two weak keys. I manually deleted the four files (public and private key for each of the two weak keys):

  • ~/.ssh/id_rsa
  • ~/.ssh/id_rsa.pub
  • ~/.ssh/id_dsa
  • ~/.ssh/id_rsa.pub

And then I generated a new RSA key with "ssh-keygen" and a new DSA key with "ssh-keygen -t dsa".

I then ran "perl dowkd.pl user ciaran" again to verify that my new keys were not weak, and it told me I had zero weak keys. Success.

Lastly, I had to update my public key on some remote hosts. For example on sv.gnu.org, CVS write access requires a DSA key. So I went to my profile, deleted my old key and then submitted my new DSA key.

Conclusion

That was all. I hope these notes encourage some others who similarly hate security to actually fix their systems. I hope it saves some people a bit of time or frustration. And I hope I didn't give too much bad advice that would make real security people cringe :-)

(Email me on ciaran at fsfe.org if there is anything cringeworthy)

Category: 
Opinions

Author information

Ciaran O’Riordan's picture

Biography

Free Software advocate, active on political campaigns such as that against software patents in Europea, and interested in free software licences

Most forwarded

Interview with Dave Mohyla, of DTIDATA

Dave Mohyla is the president and founder of dtidata.com, a hard drive recovery facility based in Tampa, Florida.

TM: Where are you based? What does your company do?
DTI Data recovery is based in South Pasadena, Florida which is a suburb of Tampa. We have been here for over 10 years. We operate a bio-metrically secured class 100 clean room where we perform hard drive recovery on all types of hard disks, from laptop hard drives to multi drive RAID systems.

Anybody up to writing good directory software?

Since the very beginning, directories (of any kind) have had a very central role in the internet. (I have recently grown fond of Free Web Directory. Even Slashdot can be considered a directory: a collection of great news and invaluable user-generated comments. As far as software is concerned, doing a quick search on Google about software directories will return the free (as in freedom) software directories like Savannah, SourceForge, Freshmeat and so on, followed by shareware and freeware sites such as FileBuzz, PCWin Download Center and All Freeware (great if you're looking for shareware and freeware, but definitely less comprehensive than their free-as-in-freedom counterparts).

Interview with Mark Shuttleworth

Mark Shuttleworth is the founder of Thawte, the first Certification Authority to sell public SSL certificates. After selling Thawte to Verisign, Mark moved on to training as an astronaut in Russia and visiting space. Once he got back he founded Ubuntu, the leading GNU/Linux distribution. He agreed on releasing a quick interview to Free Software Magazine.

Is better education the key to finding better software?

I read David Jonathon's article Anybody Up To Writing Good Directory Software? the other day, which got me thinking about software directories in general. As David mentioned, many of the software directories one finds when doing a quick google search are free as in beer, not as in freedom. But what interests me is the software directories that already exist, providing a combination of both free as in beer software, and open source software. Sites such as Freeware Downloads and Shareware Download don't advertise themselves as providing free as in liberty software, but each of them have a good selection of open source software available... if you know where to look.

Most emailed

Free Open Document label templates

If you’ve ever spent hours at work doing mailings, cursed your printer for printing outside the lines on your labels, or moaned “There has got to be a better way to do this,” here’s the solution you’ve been looking for. Working smarter, not harder! Worldlabel.com, a manufacture of labels offers Open Office / Libre Office labels templates for downloading in ODF format which will save you time, effort, and (if you want) make really cool-looking labels

Creating a user-centric site in Drupal

A little while ago, while talking in the #drupal mailing list, I showed my latest creation to one of the core developers there. His reaction was "Wow, I am always surprised what people use Drupal for". His surprise is somehow justified: I did create a site for a bunch of entertainers in Perth, a company set to use Drupal to take over the world with Entertainers.Biz.

Update: since writing this article, I have updated the system so that the whole booking process happens online. I will update the article accordingly!

So, why, why do people and companies develop free software?

More and more people are discovering free software. Many people only do so after weeks, or even months, of using it. I wonder, for example, how many Firefox users actually know how free Firefox really is—many of them realise that you can get it for free, but find it hard to believe that anybody can modify it and even redistribute it legally.

When the discovery is made, the first instinct is to ask: why do they do it? Programming is hard work. Even though most (if not all) programmers are driven by their higher-than-normal IQs and their amazing passion for solving problems, it’s still hard to understand why so many of them would donate so much of their time to creating something that they can’t really show off to anybody but their colleagues or geek friends.

Sure, anybody can buy laptops, and just program. No need to get a full-on lab or spend thousands of dollars in equipment. But... is that the full story?

Fun articles

Santa Claus - the most successful open source project

It dawned on me the other day, as I was shopping for the dozens of gifts it seems I have to buy every December, that Santa Claus is the most successful open source project in history. (Bridget @ Illiterarty would agree with that). Santa Claus is essentially a marketing development that is embodied by everyone who stuffs a sock, gives a gift, hosts a dinner or wishes Merry Christmas over the holiday season.

Most emailed

Editorial

When I first started thinking about Free Software Magazine, I was feeling enthusiastic about the dream. I had Dave, Gianluca, and Alan willing to help me, I had established members of the free software community willing to help me out, I had writers volunteering their time and energy for free, and I had a generous offer from OpenHosting for servers, all before I'd proved myself. There was a sense of excitement in the air, and I thought maybe, just maybe, I could make this work.

Free Software Magazine uses Apollo project management software and CRM for its everyday activities!