4

I inherited some code; among other things, there is a custom authorized_keys file with X.509 keys in a format like this one:

x509v3-sign-rsa subject:O=GrandsChocolatiers Ltd.,OU=Management,OU=Top

The process is such, that the SSH reads from the custom /mydir/authorized_keys file, if the /.ssh/authorized_keys file does not provide the correct key. This was all going ok, except, there was a change in one key, and a comma (,) had to be added to one key value.

subject:O=GrandsChocolatiers, Ltd.,OU=Management,OU=Top

Now, I get an sshd error

error: x509key_str2X509NAME: cannot parse 'Ltd.'

error: key_read: uudecode subject:O=GrandsChocolatiers, Ltd.,...

I have tried to escape this in the keys file using \,,\\, putting the string in single and double quotes, but the error is still there, although the error text changes with the inserted symbol.

Is there any way for SSH to escape the comma when reading the keys? Is there a way to put a different format of the key?

I did a man authorized_keys on the box and read the manual. It says that a slash can also be used to separate, but, it is used in combination with a comma, so no go there.

Note: The key cannot be changed.

5
  • Just a wild guess here, but this page suggests that whitespace in the authorized_keys entires are used to separate options. Have you tried getting rid of the space in GrandsChocolatiers, Ltd. or escaping it?
    – amccormack
    Dec 11, 2015 at 14:33
  • A nice guess :) But, it's how the keys are, and they cannot be changed. It's not the space that's causing the issue, it's the comma. Reading the authorization_keys manual, it's said: Separator of Subject items can be ‘/’ (slash), ‘,’ (comma) or mixed and order is not important.
    – dzookatz
    Dec 11, 2015 at 14:49
  • 1
    if I read right, this is openssh with x509 patch which brings this extension to authorized keys. It looks like the logic is broken, if you can break it by comma in the subject value. If putting the value into quotes does not help, it is probably content for bug report for the author of this patch.
    – Jakuje
    Dec 11, 2015 at 16:19
  • If the order is not important, what if you tried using: subject:OU=Top,OU=Management,O=GrandsChocolatiers, Ltd.?
    – Castaglia
    Feb 2, 2016 at 4:45
  • Reversing the order won't solve the fact that it will just cut the part between the two commas :) It will still be recognized as a special element - ` Ltd.`.
    – dzookatz
    Feb 2, 2016 at 8:59

1 Answer 1

0

After some time I tried to dig little bit in to see if there is something I can do about it. Browsing through the patch and the manual page, there are several things mentioned:

[...] line must contain base64 encoded X.509 certicate (old style) or a keyword (new style), optionally followed by symbol '=' (equal) or ':' (colon), zero or more spaces and X.509 certificate ``Distinguished Name'' (Subject). Keyword is case insensitive and can be one of 'Subject' , 'Distinguished Name' , 'Distinguished-Name' , 'Distinguished_Name' , 'DistinguishedName' or 'DN'. Separator of Subject items can be '/' (slash), ',' (comma) or mixed and order is not important.

We can observe that we can separate the key-values also with a slash, which can make the parser happier:

subject:O=GrandsChocolatiers, Ltd./OU=Management/OU=Top

But unfortunately not. The parser looks very "dummy", parses both of the separators regardless context and does not support any escape sequences:

+static const char*
+x509key_find_subject(const char* s) {
+   static const char *keywords[] = {
+       "subject",
+       "distinguished name",
+       "distinguished-name",
+       "distinguished_name",
+       "distinguishedname",
+       "dn",
+       NULL
+   };
+   const char **q, *p;
+   size_t len;
+
+   if (s == NULL) {
+       error("x509key_find_subject: no input data");
+       return(NULL);
+   }
+   for (; *s && ISSPACE(*s); s++)
+   {/*skip space*/}
+
+   for (q=keywords; *q; q++) {
+       len = strlen(*q);
+       if (strncasecmp(s, *q, len) != 0) continue;
+
+       for (p = s + len; *p && ISSPACE(*p); p++)
+       {/*skip space*/}
+       if (!*p) {
+           error("x509key_find_subject: no data after keyword");
+           return(NULL);
+       }
+       if (*p == ':' || *p == '=') {
+           for (p++; *p && ISSPACE(*p); p++)
+           {/*skip space*/}
+           if (!*p) {
+               error("x509key_find_subject: no data after separator");
+               return(NULL);
+           }
+       }
+       if (*p == '/' || *p == ',') {
+           /*skip leading [Relative]DistinguishedName elements separator*/
+           for (p++; *p && ISSPACE(*p); p++)
+           {/*skip space*/}
+           if (!*p) {
+               error("x509key_find_subject: no data");
+               return(NULL);
+           }
+       }
+       return(p);
+   }
+   return(NULL);
+}

So if it is still a concern for you, you would probably need to patch the code and/or write to the author of this code to fix that (probably on this mailing list).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .