ssh_authkey_fingerprints must use sha256 not md5

[ubuntu-server-builder]

This bug was originally filed in Launchpad as LP: #1860789

Launchpad details

affected_projects = ['cloud-init (Ubuntu)']
assignee = None
assignee_name = None
date_closed = 2020-02-20T21:29:29.959055+00:00
date_created = 2020-01-24T13:28:11.619949+00:00
date_fix_committed = 2020-02-20T21:29:29.959055+00:00
date_fix_released = 2020-02-20T21:29:29.959055+00:00
id = 1860789
importance = undecided
is_complete = True
lp_url = https://bugs.launchpad.net/cloud-init/+bug/1860789
milestone = None
owner = oddbloke
owner_name = Dan Watkins
private = False
status = fix_released
submitter = xnox
submitter_name = Dimitri John Ledkov
tags = []
duplicates = []

Launchpad user Dimitri John Ledkov(xnox) wrote on 2020-01-24T13:28:11.619949+00:00

ssh_authkey_fingerprints must use sha256sum not md5

on focal and up.

or maybe you should show both, becuase old ssh clients might only show md5 checksums, and like ssh clients on Windows, etc.

If you switch to show both, it then can be backported to all stable releases, as md5 is no longer secure for this purpose.

[ubuntu-server-builder]

Launchpad user Dimitri John Ledkov(xnox) wrote on 2020-01-24T13:30:00.301806+00:00

ssh-add manpage has

 -E fingerprint_hash
         Specifies the hash algorithm used when displaying key fingerprints.  Valid options are: “md5” and “sha256”.  The default is “sha256”.

[ubuntu-server-builder]

Launchpad user Ryan Harper(raharper) wrote on 2020-01-24T14:37:58.920686+00:00

#188

[ubuntu-server-builder]

Launchpad user Dan Watkins(oddbloke) wrote on 2020-01-27T15:44:43.313769+00:00

A fix for this bug was committed to cloud-init master in 28aa8c5

[ubuntu-server-builder]

Launchpad user Launchpad Janitor(janitor) wrote on 2020-02-05T23:11:40.127613+00:00

This bug was fixed in the package cloud-init - 19.4-56-g06e324ff-0ubuntu1

---

cloud-init (19.4-56-g06e324ff-0ubuntu1) focal; urgency=medium

• New upstream snapshot.
  • sysconfig: distro-specific config rendering for BOOTPROTO option (- Handle different values for the common BOOTPROTO configuration option #162)
    [Robert Schweikert] (LP: #1800854)
  • cloudinit: replace "from six import X" imports (except in util.py) (cloudinit: replace "from six import X" imports (except in util.py) #183)
  • run-container: use 'test -n' instead of 'test ! -z' (run-container: use 'test -n' instead of 'test ! -z' #202)
    [Paride Legovini]
  • net/cmdline: correctly handle static ip= config (net/cmdline: correctly handle static ip= config #201)
    [Dimitri John Ledkov] (LP: #1861412)
  • Replace mock library with unittest.mock (Replace mock library with unittest.mock #186)
  • HACKING.rst: update CLA link (HACKING.rst: update CLA link #199)
  • Scaleway: Fix DatasourceScaleway to avoid backtrace (Scaleway: Fix DatasourceScaleway to avoid backtrace #128)
    [Louis Bouchard]
  • cloudinit/cmd/devel/net_convert.py: add missing space (cloudinit/cmd/devel/net_convert.py: add missing space #191)
  • tools/run-container: drop support for python2 (tools/run-container: drop support for python2 #192) [Paride Legovini]
  • Print ssh key fingerprints using sha256 hash (upgrade from md5 to sha256 #188) (LP: #1860789)
  • Make the RPM build use Python 3 (Make the RPM build use Python 3 #190) [Paride Legovini]
  • cc_set_password: increase random pwlength from 9 to 20 (cc_set_password: increase random pwlength from 9 to 20 #189)
    (LP: #1860795) (CVE-2020-8632)
  • .travis.yml: use correct Python version for xenial tests (.travis.yml: use correct Python version for xenial tests #185)
  • cloudinit: remove ImportError handling for mock imports (cloudinit: remove ImportError handling for mock imports #182)
  • Do not use fallocate in swap file creation on xfs. (Do not use fallocate in swap file creation on xfs. #70)
    [Eduardo Otubo] (LP: #1781781)
  • .readthedocs.yaml: install cloud-init when building docs (.readthedocs.yaml: install cloud-init when building docs #181)
    (LP: #1860450)
  • Introduce an RTD config file, and pin the Sphinx version to the RTD
    default (Introduce an RTD config file, and pin the Sphinx version to the RTD default #180)
  • Drop most of the remaining use of six (Drop most of the remaining use of six #179)
  • Start removing dependency on six (Start removing dependency on six #178)
  • Add Rootbox & HyperOne to list of cloud in README (Add Rootbox & HyperOne to list of cloud in README #176) [Adam Dobrawy]
  • docs: add proposed SRU testing procedure (docs: add proposed SRU testing procedure #167)
  • util: rename get_architecture to get_dpkg_architecture (util: rename get_architecture to get_dpkg_architecture #173)
  • Ensure util.get_architecture() runs only once (Ensure util.get_architecture() runs only once #172)

-- Chad Smith chad.smith@canonical.com Wed, 05 Feb 2020 13:56:17 -0700

[ubuntu-server-builder]

Launchpad user Dan Watkins(oddbloke) wrote on 2020-02-20T21:29:30.733006+00:00

This bug is believed to be fixed in cloud-init in version 20.1. If this is still a problem for you, please make a comment and set the state back to New

Thank you.