kolide / launcher

Osquery launcher, autoupdater, and packager
https://kolide.com/launcher
Other
506 stars 103 forks source link

The kolide_keyinfo table can return misleading data about public key pem files #986

Open RebeccaMahany opened 1 year ago

RebeccaMahany commented 1 year ago

A pem file only containing a public key can show up in the kolide_keyinfo table as an unencrypted SSH key, which is misleading.

We may want to:

See:

Steps to reproduce:

Run the following in your SSH keys directory:

openssl genrsa -out test.pem 1024
openssl rsa -in test.pem -pubout > test-pub.pem

Observe that both keys show up as unencrypted SSH keys.

directionless commented 1 year ago

Thinking a bit, I think that we should probably not return data if we can't identify it.