Lion Cipher Lab
Audit SSH authorized_keys across a fleet for leaver, shared, weak and unrestricted keys
- Identity & Access Management
- Intermediate
- ~90 min
- Free · no account required
Why it matters
Most organisations that use SSH have never counted their keys. Every authorized_keys file is a small, local list of 'whoever holds the matching private key may log in here', and nothing in SSH itself expires those entries, ties them to a person, or tells HR when one is left behind. So the key of an engineer who left in July still opens the database server in October, a contractor's key quietly sits on the root account, three people share one private key so nobody can be held to what it did, and a CI pipeline's key can open an interactive shell from anywhere. NIST wrote a whole report (IR…
What you'll learn
- Reading an authorized_keys line the way sshd(8) does: options, key type, base64 key blob, free-text comment
- Parsing an SSH public key blob (RFC 4251 string and mpint fields) to read the key type and its size in bits
- Computing the SHA256 fingerprint that ssh-keygen -l prints, and checking your result against ssh-keygen
- Joining on-disk keys to a key inventory, an HR leaver roster and an entitlement list to find access nobody approved
- Spotting keys shared across people, weak DSA and sub-2048-bit RSA keys, expired keys and unrestricted service-account keys
- Measuring an audit before and after remediation, and proving why the comment field cannot be trusted as an owner
- Naming what a file-based audit cannot see: AuthorizedKeysCommand, nonstandard AuthorizedKeysFile paths, and why certificates are the long-term fix
Steps in this lab
- What you are auditing, with every term defined once
- What this is NOT: where it sits next to its neighbours
- Set up: open a terminal, check Python and ssh-keygen, make a folder
- Read one authorized_keys line the way sshd does
- Inside the base64: parse the key blob and compute the fingerprint
- Build the synthetic fleet, the roster, the inventory and the entitlements
- Write the auditor: seven rules, each tied to a reason
- Run it twice, and watch the naive scope miss keys
- Measure it: the comment field is not an owner
- Remediate, then re-measure: once from the naive scan, once properly
- When NOT to trust a clean report: what a file audit cannot see
- How a pro does it, and the long-term fix
- Where this goes next