How can I enforce SSH key length? Though anything above 2048-bits is fine (from various discussions I have read on this forum and others), how do I ensure that all users ssh-ing in to my servers have key length at least as large as this?
1 Answer
You can use ssh-keygen
to make check the size of added public keys, for example using:
ssh-keygen -B -f ~/.ssh/authorized_keys
It will print out information about all the keys in the specified file and you can simply filter out the sizes you don't want allow.
Unfortunately, there is no way to enforce minimum accepted size in configuration (now hardcoded to by 768 bits for RSA, openssh-7.3 will increase the limit to 1024 bits release notes).
Some identity management systems may have the feature to ignore smaller keys. Or you might try AuthorizedKeysCommand
to do the filter on-the-fly.