Static binaries, no installer, no runtime dependencies. The musl pair runs on any Linux (glibc or not); the Windows build is compile-verified and run-verified under wine. macOS is not published yet.
| File | Platform | Size | SHA-256 |
|---|---|---|---|
ssh-key-audit-aarch64-linux-musl |
Linux aarch64 · static (musl) | 812 KiB | 9b943bf52f585c27d0a02b7b6b92c53d9e87f5792f7be7571efe59a6411678fc |
ssh-key-audit-x86_64-linux-musl |
Linux x86_64 · static (musl) | 769 KiB | 13e01f1099ea384c763c4a6f834e6966e6b549bc15ee093e491d24559311085a |
ssh-key-audit-x86_64-windows.exe |
Windows x86_64 | 1.84 MiB | 9574baff76cb3b5a5135f20929a685ee57e88fdc93d439ea1447ccf9e5410472 |
sha256sums.txt |
SHA-256 checksums | 483 B | 7aaa222a35ac614f5aa5eeec1d7ee2151861ddfb1a4dd15230a88e43f886edc0 |
sha256sums.txt covers the full GitHub Release asset set; the gnu Linux pair is not mirrored here (it links a nix store interpreter and only runs in nix environments).
./ssh-key-audit-x86_64-linux-musl ~/.ssh /etc/ssh etc/ssh/ssh_host_ed25519_key private_key ssh-ed25519 SHA256:BjhLkH7i87G41bAfuOg5wCGbOnlJn9CwVS5XYZUQjjM 256 "host" (600) home/.ssh/id_ed25519 private_key ssh-ed25519 SHA256:2+pg3eobmy39bZJ1acJii31upEIpdF7kB6bAN3Sx2ow 256 "lars@workstation" (600) home/.ssh/authorized_keys authorized_keys ssh-ed25519 SHA256:sXrlTjUdyGN/mIv3OKCrrWR7PyFbSFwFg4VDdHwbZXc 256 "deploy@ci" (644) home/.ssh/known_hosts known_hosts (644) INSECURE home/.ssh/leaky_priv private_key ssh-ed25519 SHA256:2+pg3eobmy39bZJ1acJii31upEIpdF7kB6bAN3Sx2ow 256 "lars@workstation" (644) home/.ssh/legacy_rsa private_key ssh-rsa SHA256:Bm3gucZQ8CKKTbHTy4iHBzFaQUJs0g7J9Em4osaWGoI 3072 "legacy" (600) scanned 15 key(s), 1 insecure
Real output from a real run against a test machine: every key
on one line — path, kind, algorithm, an
ssh-keygen -lf-compatible fingerprint, key size,
comment, permissions — with weak permissions flagged. Add
--json for one machine-readable document,
--fail-on-insecure to fail cron jobs and CI when
anything is insecure.
curl -LO https://ssh-key-monitor.artmann.tech/download/v0.4.0/ssh-key-audit-x86_64-linux-musl curl -LO https://ssh-key-monitor.artmann.tech/download/v0.4.0/sha256sums.txt sha256sum -c --ignore-missing sha256sums.txt && chmod +x ssh-key-audit-x86_64-linux-musl ./ssh-key-audit-x86_64-linux-musl ~/.ssh /etc/ssh
The first scan is the audit — it prints every key found. Every scan after it reports the diff. No key material is ever logged, transmitted, or included in the output hashes.