On 5/14/08, Darrin Chandler  wrote:

quoted text
> Sure. Lots of those keys out there already. So is something like

>  ssh-vulnkey the right approach? I do have a couple of users on one of my

>  boxes. Mind, they're all good OpenBSD people and I really hope their

>  keys didn't come from a debian box. It'll be nice to find out that the

>  keys are ok.

Probably the best that can be done.  This is a lot worse than a weak

prng making numbers such that you can predict the next one given a

previous one.  Personally, I haven't given much thought to the problem

as I don't have users.  But I think a safe, complete response goes a

lot farther than just replacing a few bad keys.