Get SSH public key details for a user

get https://{sandfly-api-host}/v4/sshhunter/users/{username}

Get details of a user with SSH public keys from SSH Hunter.

Responses

Response body

object

data

object

required

username

string

required

Username.

keys_current

integer

required

Number of keys this user currently has.

keys_total

integer

required

Total number of keys that have been seen for this user.

hosts_current

integer

required

Number of hosts on which this user currently has keys.

hosts_total

integer

required

Total number of hosts this user has had keys on.

first_seen

date-time

required

First time keys associated with this user were seen.

last_seen

date-time

required

Most recent time keys associated with this user were seen.

has_duplicate_keys

boolean

required

This user has duplicate key entries in an authorized_keys file.

hosts_timeline

array of objects

required

Timeline over which this user was seen with keys on hosts.

hosts_timeline*

object

begin

date-time

required

Begin date of this time interval.

end

date-time

required

End date of this time interval.

count

integer

required

Number of data points during this time interval.

hosts

array of objects

required

Hosts on which this user has keys.

hosts*

object

key_entries

array of objects

key_entries

object

active

boolean

required

This key is currently in an authorized_keys file.

is_duplicate

boolean

required

This key has duplicate entries.

entry_num

integer

required

Which position in the authorized_keys file this key appears in.

key_file

string

required

File path of the authorized_keys file where this key appears.

key_file_created

date-time

required

Create time of the file in which this key appears.

key_file_modified

date-time

required

Modification time of the file in which this key appears.

options

string

required

Key options.

comment

string

required

Key comment.

banned_key_violation

boolean

required

Indicates this is a banned key.

zone_violation

boolean

required

This key entry is in violation of an SSH security zone covering the host that the key is found on.

integer

required

Database-assigned SSH key ID.

friendly_name

string

required

Generated (but globally consistent for this key) friendly name for key.

key_type

string

required

OpenSSH key type identifiers

ssh-ed25519 ssh-dss ssh-rsa ecdsa-sha2-nistp256 ecdsa-sha2-nistp384 ecdsa-sha2-nistp521 sk-ecdsa-sha2-nistp256@openssh.com sk-ssh-ed25519@openssh.com unknown

hash

object

required

key_value

string

required

The public key.

first_seen

date-time | null

required

Time when this key was first seen on a host during a scan. If a user directly added the key to Sandfly and it hasn't yet been found on any scanned host, the value will be null.

last_seen

date-time | null

required

Time when this key was most recently seen on a host during a scan. If a user directly added the key to Sandfly and it hasn't yet been found on any scanned host, the value will be null.

key_tags

array

required

SSH key tags.

key_tags*

key_bits

integer

required

Number of bits in the key.

key_parse_error

boolean

required

Flag indicating that the key data was unable to be parsed as a valid SSH public key.

node_name

string

required

Hostname of host.

tags

array of strings

required

A list of tags for this host.

tags*

host_id

string

required

Unique ID of the host this summary record is for.

host_sequence_id

integer

required

Host sequence ID.

target_address

string

required

date_first_seen

date-time

required

Date and time this host was first seen.

date_last_seen

date-time

required

Date and time this host was last seen.

last_seen_ip_addr

string

required

IP address this host was last seen on.

os_info_arch

string

required

OS architecture.

os_info_machine

string

required

OS machine.

os_info_os_release_name

string

required

OS release name.

os_info_os_release_pretty_name

string

required

Human friendly OS release name.

os_info_release

string

required

OS release.

results_alert

integer

required

≥ 0

Total alert results on this host.

results_error

integer

required

≥ 0

Total error results on this host.

results_pass

integer

required

≥ 0

Total pass results on this host.

results_total

integer

required

≥ 0

Total results on this host.

users_with_key

integer | null

required

≥ 0

Total users with this key.

key_first_seen

date-time

First time a key associated with this host was seen.

key_last_seen

date-time

Most recent time a key associated with this host was seen.

users_current

integer

≥ 0

Number of users on this host that currently have an SSH key.

users_total

integer

≥ 0

Number of all-time users on this host that have, or in the past have had, an SSH key.

keys_current

integer

≥ 0

Current number of SSH keys on this host.

keys_total

integer

≥ 0

Total number of SSH keys this host has had.

has_duplicate_keys

boolean

required

Does this key appear more then once in the key file.

banned_key_violation

boolean

required

Indicates the presence of a banned SSH key on this host.

zone_violation_keys

integer

required

Number of keys on this host in violation of the SSH security zone policies covering this host.

banned_key_violation

boolean

required

Indicates this user has a banned SSH key.

zone_violation_hosts

integer

required

Number of hosts on which this user has keys that are in violation of an SSH security zone.

402

Product license does not allow SSH Hunter features.

Language

Credentials

Bearer

JWT

URL


xxxxxxxxxx
1
curl --request GET \
2
     --url https://sandfly-api-host/v4/sshhunter/users/username \
3
     --header 'accept: application/json'

Click Try It! to start a request and see the response here! Or choose an example:

application/json

200SSH user details retrieved.

defaultUnexpected error