14

This is probably a noob question, but how can I determine if the public SSH key someone gives me has a passphrase or not?

We have a situation where I am not generating the SSH keys for users, but I want to make sure every SSH key I put on a server has a passphrase, but I get the feeling the passphrase is only part of the private key.

Thanks!

Improve this question

3 Answers 3

Reset to default
28

This is not something you can determine from the public half of the key. Even if you could determine it, what's to stop the user from subsequently removing it?

When you remove the passphrase from the private side of the key, the public side doesn't change.

Improve this answer
0
7

You can not tell if a private key has a pass phrase or not.

Improve this answer
1
  • 3
    More accurately, public keys don't have pass phrases. Only private keys do.
    – Swoogan
    Jul 23, 2009 at 22:04
-2

I think the passphrase is synchronous encryption of the private key so would not affect the public key. Technically it doesn't affect either key, as it is simply encrypting the data of the private key.

If you have a policy regarding requiring passphrases, you might also want to establish a policy regarding ssh-agent and agent forwarding since this stores the socket used to access the ssh-agent process in /tmp without much security outside of unix file permissions to protect it.

Improve this answer
2
  • I do not believe the key is stored unencrypted in /tmp. I believe it is stored in memory on the original machine the user entered the phase on.
    – James
    Jul 26, 2009 at 14:03
  • Sorry, you're right, an unencrypted key not stored in /tmp. The ssh-agent socket is stored in /tmp and anyone with unix perms to access said socket can use the keys ssh-agent has for you. Still a pretty major security concern.
    – James
    Jul 27, 2009 at 19:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .