ssh server : control ssh-key protection with password

Question

On a server with strong access control, is it possible to ensure that all allowed key have a password protection.

is there a way to deny access to some key if they are no protected by password. I don't mind if users use agent or not (except if the agent is the key to ensure pasword ...). I would like to be sure that all used key are protected with password.

thanks for your ligths.

Answer 1

Short answer: you can't.

(neither can you control user won't write password in a paper next to keyboard)

Wild guess & long answer :

you might which to use password less ssh authentification from relay host where :

• user log with central account (like active directory),
• user have no root acces on relay host.

This involve, either using a commercial solution (and spending money) or building your own (and assuming unsecure/untested access protocol).

two shades of security

there are two main goal in access control:

1. be compliant with some norm (survive a security audit)
2. effective access control (prevent and stop intrusion)

Commercial solution could provide first one, thtat is log when/where from user connect, what user type, have statistics about connection time and so on.

You could develop a "stuff" on your own (I did for a customer), you'll have to spend time and money to set up your solution.

Both previous solution would allow you to pass/bargain a security audit.

Keep in mind if you realy want to control access you'll have to set up a knowledgable security team, working in shift, monitoring access and able able to understand and react to alert and attack.