Sstrhsrtj

Could it be automated via ksh/bash, so via a schellscript to check all users ~/.ssh/authorized_keys file for bad = or == ending?

One of my friend deleted the = and the == from the end of the SSH keys, so users got locked out, because that was the part of their key :)

pattern it went from this (it could be ssh-rsa and with different key length):

from="1.2.3.4" ssh-dss AAAAB....0bOJKs= COMMENTHERE COMMENTHERE

to this:

from="1.2.3.4" ssh-dss AAAAB....0bOJKs COMMENTHERE COMMENTHERE

example solution: is there a fix length for the keys? how to filter out the bad keys?

The = mark is just padding, to fill out a base64 conversion. You can read more about that in

• 
  What is the meaning of an equal sign = or == at the end of a SSH public key?, which gets the information from RFC 4716" SSH Public Key File Format
  


• 
  Why does a base64 encoded string have an = sign at the end, based on RFC 2045: Multipurpose Internet Mail Extensions
  (MIME)
  

You could automate a fix/check for this because the total number of characters in a base64 value (disregarding those outside the encoding such as whitespace) would be a multiple of 4.

A quick fix in Perl:

perl -lane '$a = -1; for(0..$#F) {$a = $_ + 1 if $F[$_] =~ /^ssh-|^ecdsa-/; };

    die if $a == -1;  $p = (4 - length($F[$a]) % 4) % 4; 

    $F[$a] .= "=" x $p;  print join " ", @F' < authorized_keys > authorized_keys2

For each line (-n) Autosplit (-a) the fields to @F along spaces, then find the field that contains the key type, the next is the key. Subtract from 4 the length modulo 4 to get the number of = signs we need to add, except take another modulo to turn a 4 to a 0 in case the field is already the correct length.

The manual says that

Protocol 2 public key consist of: options, keytype, base64-encoded key, comment. The options field is optional; its presence is determined by whether the line starts with a number or not

but that's not quite right since v2 key types don't start with numbers either. The options field an contain spaces so the position of the key type can be anything. We should actually parse the options to find any quoted strings, but heuristically looking for the known key types should do.

cut -d: -f6 /etc/passwd | 

  while read oneuserraw; do

    if [ -s "${oneuserraw}/.ssh/authorized_keys" ]; then

      echo "${oneuserraw}/.ssh/authorized_keys"

    fi

  done |

  perl -pe 's//////g' |

  while read oneuser; do

    echo checking: "$oneuser"

    cat "$oneuser" | while read oneline; do

      if [[ "$oneline" == from* ]]; then

        key=$(echo "$oneline" | cut -d' ' -f3)

      fi

      if [[ "$oneline" == ssh* ]]; then

        key=$(echo "$oneline" | cut -d' ' -f2)

      fi

      length=$(echo "$key" | awk '{ print length }')

      if ! (( $length % 4 == 0 )); then

        echo "$oneline"

      fi

    done

  done

I wrote a checker myself too.

This even throws out the bad lines where someone hit enter at the ex.: middle of the ssh key AND not divisible with 4.

tested on AIX/Linux so ksh and bash.

Noah, great article! This is something I have struggled with for my business, and you lay it in simple steps. Thanks!