What restrict actually disables
The restrict option disables TCP, agent and X11 forwarding, PTY allocation and user rc execution. Later options such as port-forwarding or pty can enable an individual feature again. The auditor applies supported options in source order and shows the winning option for each capability. A later restrict disables those features again.
command="…" forces a session command but does not disable forwarding. permitopen limits local TCP-forwarding destinations and permitlisten limits remote-forwarding listen endpoints; neither re-enables forwarding. They do not govern Unix-domain socket forwarding or tun devices. Final behavior also depends on server policy such as AllowTcpForwarding, DisableForwarding, GatewayPorts, PermitTunnel and ForceCommand.
Duplicate keys are alternative authorization paths
The SHA256 fingerprint identifies the decoded public-key blob regardless of its comment or options. If the same key has a restricted entry and another broader entry, combining their restrictions would hide the risk. This tool groups duplicates and reports each line separately. The eligible line selected during an actual authentication attempt depends on the server and connection conditions.
Certificate authorities and principals
cert-authority trusts the listed key as a certificate signer; it does not authorize a direct login using that key. For supplied certificate principal names, this tool checks exact names in a principals="deploy,release" list. Without that option it checks the target username. A match verifies only this principal condition. Certificate signatures, lifetime, critical options and the most restrictive combination of certificate and key options remain unverified.
The portable OpenSSH 10.2 source rejects a principals option on a non-CA key during authorization. Some manual versions describe it as ignored, so confirm the installed server’s behavior before relying on such an entry.
Supported format and limits
This bounded independent analyzer follows OpenSSH portable 10.2 common authorized_keys options. It structurally reads plain Ed25519, RSA (1024–16384 bits), uncompressed NIST P-256/P-384/P-521 ECDSA and OpenSSH Ed25519/P-256 security keys. It checks wire-string bounds, type consistency and lengths; it does not prove curve membership, cryptographic strength, private-key possession or signer identity. RSA key type does not determine the negotiated RSA signature algorithm.
Supported options include restrict; positive/negative forwarding, PTY, user-rc, touch and verification flags; cert-authority; command; from; principals; repeated permitopen/permitlisten; environment (first name wins); expiry-time; and tunnel. Unknown options, malformed values and unsupported key types withhold effective restrictions. Certificates, DSA, SSH1, RFC 4716 PEM-style blocks, AuthorizedPrincipalsFile and allowed_signers formats are outside this parser.
from= is inventoried without validating or evaluating hostname patterns, negation, CIDR or DNS. Local-time expiry remains unresolved; UTC expiry is compared only with an explicit reference time, with the earliest timestamp taking precedence. Environment and tunnel settings require server policy. It does not read sshd_config, accounts, revocation lists, real filesystem permissions or additional key files, contact hosts, execute forced commands, or edit authorized_keys. Downloaded reports can contain your comments, commands and host restrictions; review them before sharing.
Verify with the installed OpenSSH tools
Compare public-key fingerprints with ssh-keygen -lf authorized_keys -E sha256. Inspect server configuration using target-version sshd -T, including appropriate -C connection context for Match blocks, and validate configuration with sshd -t. These commands alone do not prove a key’s effective authorization; use an isolated authentication test with the intended source, account and certificate.
References: OpenSSH authorized_keys manual, portable 10.2 option parser, principal and authorization checks, and ssh-keygen fingerprint verification.
Frequently asked questions
Does a forced command prevent a port-forwarding session?
No. Forced commands and forwarding restrictions address separate capabilities. Review no-port-forwarding or restrict plus the server’s forwarding policy.
Why are some effective results withheld?
An unknown option, unsupported key format or invalid line can change whether the server accepts the entry at all. The tool preserves the evidence and avoids showing a reassuring partial policy.
Does a matching principal mean the certificate can log in?
No. It checks one condition using names you supplied. The actual certificate and server policy still require authoritative verification.
Can I audit confidential public-key comments?
Yes. File contents are processed locally in a Web Worker and masked from session analytics. Exports contain review evidence and stay local until you choose to share them.