Assuming I have found several OpenSSH private keys on my client's system, how can I detect (at scale) which of them are:
- completely unprotected (i.e. no passphrase)
- using an old hashing algorithm for the passphrase (I read somewhere that it used to be MD5)
Is there a way to get this information using standard tools? One way might be to download the keys and check them with ssh2john, but I'd rather not have them on my machine and hence my conscience.