A quick bit of code to enumerate duplicate hostkey usage within the SSH Observatory for offline reporting of dups

dup_keys.rb

require 'mongo'
require 'set'

Mongo::Logger.logger.level = ::Logger::FATAL

client = Mongo::Client.new([ '127.0.0.1:27018' ], :database => 'ssh_scan')
collection = client['ssh_scan']
collection.distinct("scan.fingerprints.rsa.sha256").each do |sha256_fingerprint|
  targets = Set.new

  collection.find("scan.fingerprints.rsa.sha256": sha256_fingerprint).each do |item|
    targets << {:ip => item["scan"]["ip"], :hostname => item["scan"]["hostname"]}
  end

  if targets.count > 1
    if targets.map {|item| item[:ip]}.uniq.size > 1
      puts "These hosts share this hostkey: #{sha256_fingerprint}"
      targets.each do |target|
        puts "\t" + target[:ip] + "(" + target[:hostname] + ")"
      end
    end
  end
end