mjhjmtu

Could it be automated via ksh/bash, so via a schellscript to check all users ~/.ssh/authorized_keys file for bad = or == ending?

One of my friend deleted the = and the == from the end of the SSH keys, so users got locked out, because that was the part of their key :)

pattern it went from this (it could be ssh-rsa and with different key length):

from="1.2.3.4" ssh-dss AAAAB....0bOJKs= COMMENTHERE COMMENTHERE

to this:

from="1.2.3.4" ssh-dss AAAAB....0bOJKs COMMENTHERE COMMENTHERE

example solution: is there a fix length for the keys? how to filter out the bad keys?

The = mark is just padding, to fill out a base64 conversion. You can read more about that in

• 
  What is the meaning of an equal sign = or == at the end of a SSH public key?, which gets the information from RFC 4716" SSH Public Key File Format
  


• 
  Why does a base64 encoded string have an = sign at the end, based on RFC 2045: Multipurpose Internet Mail Extensions
  (MIME)
  

You could automate a fix/check for this because the total number of characters in a base64 value (disregarding those outside the encoding such as whitespace) would be a multiple of 4.

A quick fix in Perl:

perl -lane '$a = -1; for(0..$#F) ^ecdsa-/; ;
 die if $a == -1; $p = (4 - length($F[$a]) % 4) % 4; 
 $F[$a] .= "=" x $p; print join " ", @F' < authorized_keys > authorized_keys2

For each line (-n) Autosplit (-a) the fields to @F along spaces, then find the field that contains the key type, the next is the key. Subtract from 4 the length modulo 4 to get the number of = signs we need to add, except take another modulo to turn a 4 to a 0 in case the field is already the correct length.

The manual says that

Protocol 2 public key consist of: options, keytype, base64-encoded key, comment. The options field is optional; its presence is determined by whether the line starts with a number or not

but that's not quite right since v2 key types don't start with numbers either. The options field an contain spaces so the position of the key type can be anything. We should actually parse the options to find any quoted strings, but heuristically looking for the known key types should do.

cut -d: -f6 /etc/passwd | 
 while read oneuserraw; do
 if [ -s "$oneuserraw/.ssh/authorized_keys" ]; then
 echo "$oneuserraw/.ssh/authorized_keys"
 fi
 done |
 perl -pe 's//////g' |
 while read oneuser; do
 echo checking: "$oneuser"
 cat "$oneuser" | while read oneline; do
 if [[ "$oneline" == from* ]]; then
 key=$(echo "$oneline" | cut -d' ' -f3)
 fi
 if [[ "$oneline" == ssh* ]]; then
 key=$(echo "$oneline" | cut -d' ' -f2)
 fi
 length=$(echo "$key" | awk ' print length ')
 if ! (( $length % 4 == 0 )); then
 echo "$oneline"
 fi
 done
 done

I wrote a checker myself too.

This even throws out the bad lines where someone hit enter at the ex.: middle of the ssh key AND not divisible with 4.

tested on AIX/Linux so ksh and bash.