SSH 密钥卫生，主要是限制密钥能干什么

"""审计本地 SSH 密钥卫生：权限、authorized_keys 选项、算法。

只读。仅使用 Python 标准库。
缺失的文件报告为 SKIP，而不是失败。
"""

from __future__ import annotations

import stat
from pathlib import Path

# 被视为老旧的密钥类型。
WEAK_KEY_TYPES = {"ssh-rsa", "ssh-dss"}
KNOWN_KEY_TYPES = {
    "ssh-rsa",
    "ssh-dss",
    "ecdsa-sha2-nistp256",
    "ecdsa-sha2-nistp384",
    "ecdsa-sha2-nistp521",
    "ssh-ed25519",
    "sk-ssh-ed25519@openssh.com",
    "sk-ecdsa-sha2-nistp256@openssh.com",
}
# 能收窄密钥用途的 authorized_keys 选项前缀。
RESTRICTING_OPTIONS = (
    "command=",
    "from=",
    "restrict",
    "principals=",
    "no-agent-forwarding",
)
# ~/.ssh 里永远不是私钥的文件。
SKIP_NAMES = {
    "known_hosts",
    "known_hosts.old",
    "config",
    "authorized_keys",
    "environment",
}


def mode_of(path: Path) -> str:
    return oct(stat.S_IMODE(path.stat().st_mode))


def split_options(field: str) -> list[str]:
    """按逗号切分选项字段，但引号内的逗号不切。"""
    options, current, quoted = [], [], False
    for char in field:
        if char == '"':
            quoted = not quoted
            current.append(char)
        elif char == "," and not quoted:
            options.append("".join(current))
            current = []
        else:
            current.append(char)
    if current:
        options.append("".join(current))
    return options


def parse_authorized_key(line: str, lineno: int) -> dict:
    parts = line.split()
    if parts[0] in KNOWN_KEY_TYPES:
        keytype, options = parts[0], []
    else:
        options = split_options(parts[0])
        keytype = parts[1] if len(parts) > 1 else "<unparsable>"
    restricted = any(
        opt.strip().lower().startswith(RESTRICTING_OPTIONS) for opt in options
    )
    return {"lineno": lineno, "type": keytype, "restricted": restricted}


def main() -> int:
    ssh_dir = Path.home() / ".ssh"
    warnings = 0
    checked_keys = 0
    if not ssh_dir.is_dir():
        print(f"SSH 目录 {ssh_dir}：SKIP（没有 .ssh 目录）")
        print("RESULT: SKIP - nothing to audit")
        return 0
    dir_mode = mode_of(ssh_dir)
    dir_flag = "OK" if dir_mode == "0o700" else "WARN (expected 0o700)"
    if dir_flag.startswith("WARN"):
        warnings += 1
    print(f"SSH 目录 {ssh_dir}：mode {dir_mode} {dir_flag}")
    for child in sorted(ssh_dir.iterdir()):
        if not child.is_file() or child.suffix == ".pub":
            continue
        if child.name in SKIP_NAMES or child.name.startswith("."):
            continue
        head = child.read_bytes()[:64]
        looks_like_key = (
            b"PRIVATE KEY" in head
            or child.name.startswith("id_")
            or child.name.endswith((".pem", ".key"))
        )
        if not looks_like_key:
            continue
        file_mode = mode_of(child)
        exposed = bool(stat.S_IMODE(child.stat().st_mode) & 0o077)
        flag = "OK" if not exposed else f"WARN (mode {file_mode} is group/other-readable)"
        if exposed:
            warnings += 1
        print(f"私钥 {child.name}：mode {file_mode} {flag}")
    auth_keys = ssh_dir / "authorized_keys"
    if not auth_keys.is_file():
        print(f"{auth_keys}：SKIP（没有 authorized_keys 文件）")
    else:
        ak_mode = mode_of(auth_keys)
        ak_flag = "OK" if ak_mode in ("0o600", "0o400") else f"WARN (mode {ak_mode}, expected 0o600)"
        if ak_flag.startswith("WARN"):
            warnings += 1
        print(f"authorized_keys：mode {ak_mode} {ak_flag}")
        for lineno, raw in enumerate(
            auth_keys.read_text(encoding="utf-8").splitlines(), 1
        ):
            line = raw.strip()
            if not line or line.startswith("#"):
                continue
            checked_keys += 1
            entry = parse_authorized_key(line, lineno)
            notes = []
            if entry["type"] in WEAK_KEY_TYPES:
                notes.append("legacy algorithm")
            if entry["type"] == "<unparsable>":
                notes.append("could not parse key type")
            if not entry["restricted"]:
                notes.append("no restriction (no command=/from=/restrict)")
            if notes:
                warnings += 1
                print(
                    f"authorized_keys 第 {lineno} 行："
                    f"{entry['type']} WARN ({'; '.join(notes)})"
                )
            else:
                print(
                    f"authorized_keys 第 {lineno} 行："
                    f"{entry['type']} OK (restricted)"
                )
    print("passphrase: NOT CHECKED here (use `ssh-keygen -y -f <key>` separately)")
    if checked_keys == 0:
        print(f"RESULT: no authorized_keys entries checked; warnings={warnings}")
    else:
        print(f"RESULT: {checked_keys} authorized_keys entries checked; warnings={warnings}")
    return 0


if __name__ == "__main__":
    raise SystemExit(main())

SSH 目录 /home/alex/.ssh：mode 0o755 WARN (expected 0o700)
私钥 id_rsa：mode 0o644 WARN (mode 0o644 is group/other-readable)
authorized_keys：mode 0o600 OK
authorized_keys 第 1 行：ssh-rsa WARN (legacy algorithm; no restriction (no command=/from=/restrict))
authorized_keys 第 2 行：ssh-ed25519 OK (restricted)
passphrase: NOT CHECKED here (use `ssh-keygen -y -f <key>` separately)
RESULT: 2 authorized_keys entries checked; warnings=3