Ssh

SSH Host Private Keys

SSH host private keys authenticate servers and can enable host impersonation if copied to another system.

Metadata

id: ssh.host-private-keys
category: ssh
sensitivity: critical
artifact types: credential, private-key
tags: ssh, host-key, private-key

Path Matchers

Path	Kind	Platforms
`/etc/ssh/ssh_host_*_key`	`glob`	`linux`

Content Indicators

Regular expressions:

-----BEGIN OPENSSH PRIVATE KEY-----
-----BEGIN RSA PRIVATE KEY-----
-----BEGIN EC PRIVATE KEY-----

Credential Types

private-key

Impact

credential_access
remote_access

References

SSH Client Config

SSH client configuration can identify hosts, users, proxy settings, and key paths.

SSH Known Hosts

SSH known_hosts files can reveal previously accessed hosts.

On this page

Metadata Path Matchers Content Indicators Credential Types Impact References