44

Some of my Linux & FreeBSD systems have dozens of users. Staff will use these "ssh gateway" nodes to SSH into other internal servers.

We're concerned that some of these people use an unencrypted private SSH key (A key without a passphrase. This is bad, because if a cracker ever gained access to their account on this machine, they could steal the private key and now have access to any machine which uses this same key. For security reasons, we require all users to encrypt their private SSH keys with a passphrase.

How can I tell if a private key is not-encrypted (e.g. Does not contain a passphrase)? Is there a different method to do this on an ASCII-armored key vs. a non-ASCII-armored key?

Update:

To clarify, assume I have superuser access on the machine and I can read everybody's private keys.

2
  • 2
    grumble ssh-agent grumble There shouldn't be any private keys on the gateway.
    – derobert
    Aug 30, 2012 at 15:44
  • A few pedantic notes: - Users often have poor passphrase. - Users can change passphrases. - User can store their keys in multiple places. - Users are likely to use ssh agent so they can unlock the key once, say on their laptop.
    – Ben Hyde
    Aug 19, 2015 at 17:05

3 Answers 3

59

Well, OpenSSH private keys with empty passphrases are actually not encrypted.

Encrypted private keys are declared as such in the private key file. For instance:

-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,7BD2F97F977F71FC

BT8CqbQa7nUrtrmMfK2okQLtspAsZJu0ql5LFMnLdTvTj5Sgow7rlGmee5wVuqCI
/clilpIuXtVDH4picQlMcR+pV5Qjkx7BztMscx4RCmcvuWhGeANYgPnav97Tn/zp
...
-----END RSA PRIVATE KEY-----

So something like

# grep -L ENCRYPTED /home/*/.ssh/id_[rd]sa

should do the trick.

4
  • 3
    @jmanning2k : I just created an RSA private key with no passphrase, and it does not contain the string 'Encryption: none'. Aug 18, 2010 at 17:22
  • @jmanning2k: the -L flag lists only file names that do not match the pattern. So this answer is correct on its own.
    – bahamat
    Aug 30, 2012 at 18:38
  • I stand corrected, comment removed for clarity. For the record, I have a few Putty private key files copied over, which do read 'Encryption: none'.
    – jmanning2k
    Sep 4, 2012 at 20:29
  • 2
    or string OPENSSH: see tedunangst.com/flak/post/…
    – Jack Wasey
    Oct 27, 2016 at 12:43
10

I looked all over for this and never found a satisfying answer, but I managed to construct one, so...

Note that this will update the file if it works, so if you're trying to not be noticed by the users whose keys you're testing, you may want to copy the key first. OTOH, since you just caught your user with a passwordless key, maybe you don't care if they notice. :D

$ ssh-keygen -p -P '' -N '' -f ~/.ssh/KEYTEST
Key has comment '/home/rlpowell/.ssh/KEYTEST'
Your identification has been saved with the new passphrase.
$ echo $?
0

$ ssh-keygen -p -P '' -N '' -f ~/.ssh/KEYTEST
Bad passphrase.
$ echo $?
1
3
  • 3
    Why not -N '' instead so that the passphrase is always left unchanged? Apr 1, 2015 at 21:16
  • facepalm That's perfect, thank you so much.
    – rlpowell
    Apr 2, 2015 at 7:40
  • +1 because this solution even works with SSH's new private key format. Oct 9, 2016 at 12:55
8

If you have access to the private key, I suppose, you can use it without passphrase to authenticate against the public key. If this works you know it has no passphrase. If it had, it would give you an error message.

If you don't have access to the private key, I doubt you can detect this. The passphrase's purpose is to "unlock" the private key, it has no function in regard to the public key.

In fact, if it would, it would make the system less secure. One could use the public key, that is available to try to mount brute force or other attacks trying to crack the passphrase.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.