Debian Massive Fail

If any of you guys are running Ubuntu or Debian distros after the Sept 2006 0.9 build, make sure you upgrade your server asap: Major SSH security issue found.

Apparently someone was mucking around in the SSH code and broke the random number gen. When I say broke, I mean, reduced the possible key values from in the billions to just 32,767 keys. Metasploit has already generated a package will all possible 1024, 2048 and 4096-bit keys for Debian based systems.

Naturally the OSS fanboys on Digg/Reddit are downplaying the exploit by saying “At least its not windoze”.

??????If I was running Windows as my server OS, I wouldn’t be regenerating a few hundred SSH keys right now asshats.