Ensure SSH/certificate private keys are protected by a passphrase

command -v ssh-keygen >/dev/null 2>&1 || { echo "NOT APPLICABLE: ssh-keygen unavailable"; exit 0; }
fail=0
# Candidate private-key files in the standard locations.
for k in /root/.ssh/id_* /home/*/.ssh/id_*; do
  [ -f "$k" ] || continue
  case "$k" in *.pub) continue ;; esac
  # -P '' supplies an empty passphrase: succeeds (exit 0) ONLY if the key
  # is unencrypted; an encrypted key rejects the empty passphrase (no prompt).
  if ssh-keygen -y -P '' -f "$k" >/dev/null 2>&1; then
    echo "FAIL: $k is an unencrypted private key"
    fail=1
  fi
done
if [ "$fail" -eq 0 ]; then
  echo "OK: no unencrypted private keys found in standard locations"
  exit 0
fi
exit 1

expected_exit:

0

note:

Add a passphrase to each unencrypted key: ssh-keygen -p -f <keyfile>. Note: SSH host keys (/etc/ssh/ssh_host_*_key) are intentionally passphrase-less; scope enforcement to user/authentication keys per site policy.