Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have some SFTP-Chroot Environments where we only allow 4096bit RSA Keys for authentication and we only have the public key part from our users. But we have a policy that the user has to set a password for their private key parts.

Is there a way to check if thats true (that theyve really set a password) only by owning the public key part or maybe by setting something in openssh-server config?

share|improve this question
up vote 3 down vote accepted

You can't (with only the public key). The user may change or remove the password for the private key without affecting the server.

There is a similar question: How to tell if a public SSH key has a passphrase

If you are implementing two-factor authentication, maybe you could consider PAM or a custom script. Making it work with some SFTP clients may be a pain though.

share|improve this answer
thank you for your answer. i already thought that its not possible but was unsure. thanks for ensure. – martinseener Feb 12 '13 at 14:48

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.