I'm looking to lock down our Solaris 10, RHEL 5, and SLES 11.2 servers. It has come to my attention that some of the users have no passphrase for their SSH keys. Is there a way I can check for this with a script?UpdateBelow I have posted the script I wrote from the answer @tylerl gave me. I'm posting this incase someone else needs this info in the future. There is most likely better ways to do this, but this works. I still need to write additional scripts for the accounts that are not automounted. Thanks everyone for all the help#!/bin/bash# This script is for checking for a blank passphrase. Meaning no passphrase to secure your SSH key.# Script most be run as root.# Example: sudo ./check-sshkeysmount share:/vol/home /mntls /mnt >/tmp/lsfor s in `cat /tmp/ls`do echo -e \e[1m User $s \033[0m if ls /mnt/$s/.ssh/id_rsa 2>/dev/null        then grep ENCRYPTED /mnt/$s/.ssh/id_rsa || echo -e No RSApassphrase        else echo RSA key not foundfiif ls /mnt/$s/.ssh/id_dsa 2>/dev/null        then grep ENCRYPTED /mnt/$s/.ssh/id_dsa || echo -e No DSApassphrase        else echo DSA key not foundfidonerm /tmp/lsumount /mnt
Is there a way to check a users SSH key to see if the passphrase is blank
ssh;ssh agent
If you're checking from the server that people are connecting to, then no dice. The SSH key has to be decrypted in memory before use, which means to the server they look the same. Unless you can get a copy of the actual key file, you're sunk.But if you're on the machine people are connecting from, well then it's trivial -- just look at the key file.Passwords on SSH keys are used to encrypt the key, and the file indicates whether encryption is used as well as what type.An encypted private key looks like this:-----BEGIN RSA PRIVATE KEY-----Proc-Type: 4,ENCRYPTEDDEK-Info: AES-128-CBC,259001658E2E5C2618A9648EA35122F4GFzPnlYdGYVTmK5t45xv/m0Nok9czOuFNNuS+Sm5vzGaOa7LBMtRNJgWFBCGsfFlwouThpuKxV+ArgmzPa9hnEmy18QW0sbza8SKm/3Hbqi8XwCliz2xP2xS+iGSkYDt...LAB/DZasuYBSsVadfemDsmrRvUz7/4eJZTxoEvwNQtAWhTS8j9RbRPee4rk1fwew-----END RSA PRIVATE KEY-----While an unencrypted one looks like this:-----BEGIN RSA PRIVATE KEY-----MIIEpAIBAAKCAQEAtdKjJa18HbagmuMvb/gDCpXXYPVqRsXDdwTcG3YY5RlJtdxYTJD+626tLTyuzzw6ZsGJtScrSjm2Jp5uUrDXnkek39Zxj24bTM9k/tZBeAQubrwO....I8u05jPL1WZmre5SVexfFEvAGqMdiWLvURpnQkI7Wn6nXJjEbUOdGQ==-----END RSA PRIVATE KEY-----The trained eye might notice that the second line contains the word ENCRYPTED. That's your clue. If the file contains the word ENCRYPTED then it is, if it doesn't then it's not. So here's your script:grep -L ENCRYPTED /home/*/.ssh/id_rsamodify to suit your environment, but you get the idea. Obviously people could fool your script by put the word ENCRYPTED down at the bottom of the file, but we're assuming that they wont.