Static binaries, no installer, no runtime dependencies. The musl pair runs on any Linux (glibc or not); the Windows build is compile-verified and run-verified under wine. macOS is not published yet.
| File | Platform | Size | SHA-256 |
|---|---|---|---|
ssh-key-audit-aarch64-linux-musl |
Linux aarch64 · static (musl) | 815 KiB | 38f6a660d76d783e63eff04d438d865435ce1957e60c83678af81c4314a4ffb5 |
ssh-key-audit-x86_64-linux-musl |
Linux x86_64 · static (musl) | 783 KiB | 80cc053f3d0d27ea8936bcfdfa9df28ad63a462bf39eb25cd61ba5e54ab7687d |
ssh-key-audit-x86_64-windows.exe |
Windows x86_64 | 1.87 MiB | d17e8ab16dd409d07050ed2a6f58e2a00d152f38f9f0b50c20a958af36781a32 |
sha256sums.txt |
SHA-256 checksums | 483 B | b601c9b132d02eab0a462f954a4661a83e30533b12310dd3acae875327505d3c |
sha256sums.txt covers the full GitHub Release asset set; the gnu Linux pair is not mirrored here (it links a nix store interpreter and only runs in nix environments).
./ssh-key-audit-x86_64-linux-musl home/.ssh etc/ssh etc/ssh/ssh_host_ed25519_key private_key ssh-ed25519 SHA256:evKnVLolqQtVkd3USueNPNdTHvn3Qrrnz3yAXcG8mko 256 "host" (600) etc/ssh/ssh_host_ed25519_key.pub public_key ssh-ed25519 SHA256:evKnVLolqQtVkd3USueNPNdTHvn3Qrrnz3yAXcG8mko 256 "host" (644) home/.ssh/authorized_keys authorized_keys ssh-ed25519 SHA256:b3qKGeDjn7vlC0pRb2C7jMrI9rJbC6ESs68t8WInVGg 256 "lars@workstation" (644) home/.ssh/authorized_keys authorized_keys ssh-ed25519 SHA256:yYH5mEPAv84wjrYKsueCjZZOQJgMlIzsT0xzq/3MdKg 256 "deploy@ci" (644) home/.ssh/deploy_key private_key ssh-ed25519 SHA256:yYH5mEPAv84wjrYKsueCjZZOQJgMlIzsT0xzq/3MdKg 256 "deploy@ci" (600) home/.ssh/deploy_key.pub public_key ssh-ed25519 SHA256:yYH5mEPAv84wjrYKsueCjZZOQJgMlIzsT0xzq/3MdKg 256 "deploy@ci" (644) home/.ssh/id_ed25519 private_key ssh-ed25519 SHA256:b3qKGeDjn7vlC0pRb2C7jMrI9rJbC6ESs68t8WInVGg 256 "lars@workstation" (600) home/.ssh/id_ed25519.pub public_key ssh-ed25519 SHA256:b3qKGeDjn7vlC0pRb2C7jMrI9rJbC6ESs68t8WInVGg 256 "lars@workstation" (644) home/.ssh/known_hosts known_hosts 1 host ssh-ed25519 SHA256:evKnVLolqQtVkd3USueNPNdTHvn3Qrrnz3yAXcG8mko 256 (644) INSECURE home/.ssh/leaky_priv private_key ssh-ed25519 SHA256:KZiejCe4zjexTDqU5ABeXO2sqH2xONTFwqBZyNB9nck 256 "leaky" (644) home/.ssh/leaky_priv.pub public_key ssh-ed25519 SHA256:KZiejCe4zjexTDqU5ABeXO2sqH2xONTFwqBZyNB9nck 256 "leaky" (644) home/.ssh/legacy_rsa private_key ssh-rsa SHA256:xRJNMjyshGGY8xZf9Qc9zHJeSDJD25UYSsb/wTRTWIM 3072 "legacy" (600) home/.ssh/legacy_rsa.pub public_key ssh-rsa SHA256:xRJNMjyshGGY8xZf9Qc9zHJeSDJD25UYSsb/wTRTWIM 3072 "legacy" (644) scanned 13 key(s), 1 insecure
Real output from a real run against a test machine: every key
on one line — path, kind, algorithm, an
ssh-keygen -lf-compatible fingerprint, key size,
comment, permissions — with weak permissions flagged and
known_hosts entries showing how many hosts they cover. Add
--json for one machine-readable document,
--fail-on-insecure to fail cron jobs and CI when
anything is insecure.
curl -LO https://ssh-key-monitor.artmann.tech/download/v0.4.1/ssh-key-audit-x86_64-linux-musl curl -LO https://ssh-key-monitor.artmann.tech/download/v0.4.1/sha256sums.txt sha256sum -c --ignore-missing sha256sums.txt && chmod +x ssh-key-audit-x86_64-linux-musl ./ssh-key-audit-x86_64-linux-musl ~/.ssh /etc/ssh
curl -LO https://ssh-key-monitor.artmann.tech/download/v0.4.1/ssh-key-audit-aarch64-linux-musl curl -LO https://ssh-key-monitor.artmann.tech/download/v0.4.1/sha256sums.txt sha256sum -c --ignore-missing sha256sums.txt && chmod +x ssh-key-audit-aarch64-linux-musl ./ssh-key-audit-aarch64-linux-musl ~/.ssh /etc/ssh
The aarch64 binary is fully static — the same download runs
on Raspberry Pi-class ARM boards and ARM servers. On an
x86_64 host you can smoke it under qemu-user before
deploying:
qemu-aarch64 ./ssh-key-audit-aarch64-linux-musl --version.
curl -LO https://ssh-key-monitor.artmann.tech/download/v0.4.1/ssh-key-audit-x86_64-windows.exe curl -LO https://ssh-key-monitor.artmann.tech/download/v0.4.1/sha256sums.txt certutil -hashfile ssh-key-audit-x86_64-windows.exe SHA256 ssh-key-audit-x86_64-windows.exe %USERPROFILE%\.ssh
Compare the certutil hash against the
ssh-key-audit-x86_64-windows.exe line in
sha256sums.txt. Windows builds report no permission modes —
the POSIX permission model does not apply there — so
INSECURE flags are POSIX platforms only; on Windows the
audit is an inventory of keys and identities.
The first scan is the audit — it prints every key found. Every scan after it reports the diff. No key material is ever logged, transmitted, or included in the output hashes.