2

How can I enforce SSH key length? Though anything above 2048-bits is fine (from various discussions I have read on this forum and others), how do I ensure that all users ssh-ing in to my servers have key length at least as large as this?

1 Answer 1

3

You can use ssh-keygen to make check the size of added public keys, for example using:

ssh-keygen -B -f ~/.ssh/authorized_keys

It will print out information about all the keys in the specified file and you can simply filter out the sizes you don't want allow.

Unfortunately, there is no way to enforce minimum accepted size in configuration (now hardcoded to by 768 bits for RSA, openssh-7.3 will increase the limit to 1024 bits release notes).

Some identity management systems may have the feature to ignore smaller keys. Or you might try AuthorizedKeysCommand to do the filter on-the-fly.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .