Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

A question came up on the Unix & Linux SE site: Checking if passwordless ssh authorization is possible without permission for sshd_config?.

I immediately thought you could possibly infer this using the commands: ssh-keyscan -t rsa <server> and ssh-keyscan -t dsa <server>.

My logic is that if a server is returning either key, then it must support that type of key for users' use as well.

Is this assumption incorrect?

share|improve this question
up vote 1 down vote accepted

There are details... but, basically, early in the connection establishment, both client and server send to each other the list of algorithms (and thus key types) that they support. See section 7.1 of RFC 4253.

Try ssh -vvv The debug messages will show you a lot of information of what the server returned, including the full lists of algorithms.

share|improve this answer
Yeah I figured the ssh -vvv would be another, probably more explicit, way but it's pretty verbose to be dumping on a noob. Hence my thinking of the ssh-keyscan approach. So is my thinking incorrect in the use of ssh-keyscan in that manner? – slm May 10 '13 at 13:23
ssh-keyscan tells you which key types are used by the server for its own part. If a server has a key of a given type, then it has code to support that kind of key, but it does not necessarily mean that it will support similar key types for authenticating clients. And neither in the other direction. That's not a reliable inference to make. – Tom Leek May 10 '13 at 13:51

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.