On a server with strong access control, is it possible to ensure that all allowed key have a password protection.

is there a way to deny access to some key if they are no protected by password. I don't mind if users use agent or not (except if the agent is the key to ensure pasword ...). I would like to be sure that all used key are protected with password.

thanks for your ligths.

  • You're asking if there is a way for the ssh server to enforce client credential policy?
    – jdwolf
    Nov 26, 2017 at 6:51
  • 1
    No, the server can't see that, the only way to technically enforce protection that I can think of is to have the key generated unextractably on token/chipcard hardware. I'm pretty sure this is a duplicate, I'll go find the other question. Nov 26, 2017 at 7:01
  • Cross-site highly relevant: serverfault.com/q/82649/90306 Nov 26, 2017 at 7:04
  • well, I thing there exist a ssh SAS gateway that permit such a control....
    – dominix
    Nov 27, 2017 at 8:53

1 Answer 1


Short answer: you can't.

(neither can you control user won't write password in a paper next to keyboard)

Wild guess & long answer :

you might which to use password less ssh authentification from relay host where :

  • user log with central account (like active directory),
  • user have no root acces on relay host.

This involve, either using a commercial solution (and spending money) or building your own (and assuming unsecure/untested access protocol).

two shades of security

there are two main goal in access control:

  1. be compliant with some norm (survive a security audit)
  2. effective access control (prevent and stop intrusion)

Commercial solution could provide first one, thtat is log when/where from user connect, what user type, have statistics about connection time and so on.

You could develop a "stuff" on your own (I did for a customer), you'll have to spend time and money to set up your solution.

Both previous solution would allow you to pass/bargain a security audit.

Keep in mind if you realy want to control access you'll have to set up a knowledgable security team, working in shift, monitoring access and able able to understand and react to alert and attack.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.