Re: Enforce Passphrase on keys

On Thu, 2008-07-03 at 09:31 -0500, Michael Wisniewski wrote:

I've been trying to dig around and find a way to enforce passphrases
on private keys when you authenticate. The closest post that I can
find would be...

if openssl rsa -noout -passin pass:none -in /path/to/key ; then
echo user is a dork

However, how does one go about implementing this if their private key
is on the local system? If the private key is on your server, you
could probably put it in a login script. But being that it is on the
local system, how would you go about verifying the passphrase?

The reason why I'm going down this road is because we have had
problems where a user's private key is compromised. Some user's do
not use passphrases on their private keys. Once a key is copied off
the system, the attacker then logs in without worrying about
passwords. My idea is to have the server deny the connection if a
passphrase does not exist on a private key.


don't thing something like this is possible. the way to go is to enforce
the security policies on the local system (so it does not get
compromised) and user education. appropriate action against the user who
did not follow company security policies should be taken, let them be
aware of that.

other method would be to replace the keys authentication with something
more scalable, e.g. Kerberos.