I am receiving this notification from the Defender "Insecure SSH private key"

Pradeep Khantwal 55

Defender for Servers found a plaintext SSH private key that is part of a pair. It is important to secure the private key to avoid its misuse or leakage.

But on the Affected resources there is no result, please check the screenshot.

Givary-MSFT 33,391 Reputation points Microsoft Employee

2024-03-15T06:46:05.8066667+00:00

@Pradeep Khantwal Thank you for reaching out to us, could help us with the screenshot of the above mentioned issue for reference.
IgorViunov 0 Reputation points

2024-05-07T11:21:54.5333333+00:00

I also receive such notification:

Title: Unverified insecure SSH private key

Text: Defender for Servers found a plaintext SSH private key that is part of a pair. It is important to secure the private key to avoid its misuse or leakage. In addition to detecting SSH private keys, the agentless scanner verifies whether they can be used to move laterally in the network. Keys that cannot be verified are categorized as unverified.

but where these keys have been found??? I check all user profiles on the server and found nothing

1 answer

Alan La Pietra (CSA) 80 Reputation points Microsoft Employee

2024-06-21T09:21:34.5666667+00:00

Can you go into Cloud Explorer and search for SSH Cloud Keys

you get the list of items and can understand if it's true positive or not
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

I am receiving this notification from the Defender "Insecure SSH private key"

1 answer

Your answer