Test if SSH private key has password protection

Question

I'm trying to test if ~/.ssh/id_rsa is actually password protected.

When you run ssh-keygen you can choose an empty password, and I'm trying to detect this.

Is that possible with a one-liner?

Answer 1

If you execute:

ssh-keygen -y -f ~/.ssh/name_of_key

you will get key printed if there is no password like this:

ssh-keygen -y -f ~/.ssh/id_dsa
ssh-dss AAAAB3NzaC1kc3M....

If there is password of the key you will be asked for it

Answer 2

If you open the private key file in text editor you will be able to see ENCRYPTED in the second line of the RSA/DSA key file. For example:

 -----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: AES-128-CBC,373B504621779D53C72BADE597C531A0

Answer 3

I don't have enough reputation to comment, so I add here.

Thanks to @Ulrich-Schwarz , I extended his answer to check all my keys (the one i generated, so I have the puublic/private pair) in my $HOME/.ssh/ :

for l in $(ls $HOME/.ssh/*.pub)
do         key=${l%.*}
   if SSH_ASKPASS=/bin/false ssh-keygen -y -f $key < /dev/null > /dev/null 2>&1
   then
       echo -n "NO  password: "
   else
       echo -n "YES password: "
   fi
   echo ${key}
done