Ssh – How to check if a password for an ssh key has been set with only the public key

public-keyrsassh

We have some SFTP-Chroot Environments where we only allow 4096bit RSA Keys for authentication and we only have the public key part from our users. But we have a policy that the user has to set a password for their private key parts.

Is there a way to check if thats true (that theyve really set a password) only by owning the public key part or maybe by setting something in openssh-server config?

Best Answer

You can't (with only the public key). The user may change or remove the password for the private key without affecting the server.

There is a similar question: How to tell if a public SSH key has a passphrase

If you are implementing two-factor authentication, maybe you could consider PAM or a custom script. Making it work with some SFTP clients may be a pain though.

Related Solutions

Ssh – How to change the private key passphrase

To change the passphrase on your default key:

$ ssh-keygen -p

If you need to specify a key, pass the -f option:

$ ssh-keygen -p -f ~/.ssh/id_dsa

then provide your old and new passphrase (twice) at the prompts. (Use ~/.ssh/id_rsa if you have an RSA key.)

More details from man ssh-keygen:

[...]
SYNOPSIS
    ssh-keygen [-q] [-b bits] -t type [-N new_passphrase] [-C comment]
               [-f output_keyfile]
    ssh-keygen -p [-P old_passphrase] [-N new_passphrase] [-f keyfile]
[...]
     -f filename
             Specifies the filename of the key file.
[...]
     -N new_passphrase
             Provides the new passphrase.

     -P passphrase
             Provides the (old) passphrase.

     -p      Requests changing the passphrase of a private key file instead of
             creating a new private key.  The program will prompt for the file
             containing the private key, for the old passphrase, and twice for
             the new passphrase.
[...]

Ssh – Create a public SSH key from the private key

Use the -y option to ssh-keygen:

ssh-keygen -f ~/.ssh/id_rsa -y > ~/.ssh/id_rsa.pub

From the 'man ssh-keygen'

 -y      This option will read a private OpenSSH format file and print an
         OpenSSH public key to stdout.

Specify the private key with the -f option, yours might be dsa instead of rsa. The name of your private key probably contains which you used. The newly generated public key should be the same as the one you generated before.

Best Answer

Related Solutions

Ssh – How to change the private key passphrase

Ssh – Create a public SSH key from the private key

Related Topic