Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

A question came up on the Unix & Linux SE site: Checking if passwordless ssh authorization is possible without permission for sshd_config?.

I immediately thought you could possibly infer this using the commands: ssh-keyscan -t rsa <server> and ssh-keyscan -t dsa <server>.

My logic is that if a server is returning either key, then it must support that type of key for users' use as well.

Is this assumption incorrect?

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

There are details... but, basically, early in the connection establishment, both client and server send to each other the list of algorithms (and thus key types) that they support. See section 7.1 of RFC 4253.

Try ssh -vvv the.ssh.server.name. The debug messages will show you a lot of information of what the server returned, including the full lists of algorithms.

share|improve this answer
    
Yeah I figured the ssh -vvv would be another, probably more explicit, way but it's pretty verbose to be dumping on a noob. Hence my thinking of the ssh-keyscan approach. So is my thinking incorrect in the use of ssh-keyscan in that manner? –  slm May 10 '13 at 13:23
2  
ssh-keyscan tells you which key types are used by the server for its own part. If a server has a key of a given type, then it has code to support that kind of key, but it does not necessarily mean that it will support similar key types for authenticating clients. And neither in the other direction. That's not a reliable inference to make. –  Tom Leek May 10 '13 at 13:51
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.