Re: [SAGE] The danger of SSH keys..

[Bryan Fullerton <bryanf@samurai.com>]

Dustin Puryear wrote:
> A key difference here is that with a system password, I can at least
> force the user to set a password rather than leaving it blank. I can
> also require a minimum strength. With SSH keys, I can't do *any* of
> that.
>   
It doesn't seem like it would be monumentally hard to add a check in the 
various OpenSSH binaries to require a non-empty key passphrase of a 
certain minimum length.

If you're not up to coding it yourself you could submit a feature 
request (with associated offer to fund development if you really want 
it). If the OpenSSH folks added it themselves it could likely be managed 
via an associated config option.

Bryan