SSH Key Auditing: Detect Weak Keys, Unused Authorized Keys, and Key Sprawl

SSH Key Security

SSH keys provide passwordless authentication, but unmanaged keys become a major security liability. Regular auditing prevents unauthorized access from old, weak, or forgotten keys.

Listing Authorized Keys

cat ~/.ssh/authorized_keys
for user in $(cut -d: -f1 /etc/passwd); do
  ak="/home/$user/.ssh/authorized_keys"
  [ -f "$ak" ] && echo "$user: $(wc -l < $ak) keys"
done

Detecting Weak Key Types

# Check key types
ssh-keygen -lf ~/.ssh/authorized_keys
# Weak: ssh-dss (DSA) — deprecated
# OK: ssh-rsa (RSA 2048+)
# Best: ssh-ed25519

Host Key Audit

ls -la /etc/ssh/ssh_host_*
ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub
ssh-keygen -lf /etc/ssh/ssh_host_rsa_key.pub

Automated Audit with dargslan-sshkey-audit

pip install dargslan-sshkey-audit
dargslan-sshkey-audit