A question came up on the Unix & Linux SE site: Checking if passwordless ssh authorization is possible without permission for sshd_config?.

I immediately thought you could possibly infer this using the commands: ssh-keyscan -t rsa <server> and ssh-keyscan -t dsa <server>.

My logic is that if a server is returning either key, then it must support that type of key for users' use as well.

Is this assumption incorrect?

1 Answer 1


There are details... but, basically, early in the connection establishment, both client and server send to each other the list of algorithms (and thus key types) that they support. See section 7.1 of RFC 4253.

Try ssh -vvv the.ssh.server.name. The debug messages will show you a lot of information of what the server returned, including the full lists of algorithms.

  • Yeah I figured the ssh -vvv would be another, probably more explicit, way but it's pretty verbose to be dumping on a noob. Hence my thinking of the ssh-keyscan approach. So is my thinking incorrect in the use of ssh-keyscan in that manner?
    – slm
    May 10, 2013 at 13:23
  • 3
    ssh-keyscan tells you which key types are used by the server for its own part. If a server has a key of a given type, then it has code to support that kind of key, but it does not necessarily mean that it will support similar key types for authenticating clients. And neither in the other direction. That's not a reliable inference to make.
    – Tom Leek
    May 10, 2013 at 13:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .