Utility to scan for unpassworded SSH privkeys?

[Dan Mahoney, System Admin]

Hey all,

Let's make an assumption:

1) I am a root user on a system.

2) I don't want said system being used as a jumping-off point if either a 
user account or the root account is compromised.

Given an unencrypted private key, plus a known_hosts file, plus 
bash_history, it's a pretty easy avenue of attack once you're in the front 
door.  And it's happened before*.

Thus, what I'd like to do is (in the spirit of crack's "nastygram" 
script), trawl through user .ssh directories and warn users with insecure 
keys (or warn root).

I'm shocked I can't find something that does this with a basic google 
search.  Debian offers their ssh-vulnkey tool, but that checks for 
something different (weak RNG-seeded keys).

Has anyone come across something like this?  Better still, written it?

It seems to me that something like this should be in /contrib, but that's 
just me.

My ears are open.

-Dan

*(http://it.slashdot.org/story/12/11/17/143219/freebsd-project-discloses-security-breach-via-stolen-ssh-key)
http://threatpost.com/apache-site-hacked-through-ssh-key-compromise-082809/

-- 

--------Dan Mahoney--------
Techie,  Sysadmin,  WebGeek
Gushi on efnet/undernet IRC
ICQ: 13735144   AIM: LarpGM
Site:  http://www.gushi.org
---------------------------