snag.page

Every check ยท Exposed files

Private SSH keys

exposure/ssh-key

What it checks

/.ssh/id_rsa, /id_rsa

Why it matters

Anyone with it can sign in wherever it is trusted.

How to fix it

  1. Delete it from the server.
  2. Remove it from every authorized_keys file it is in, and make a new key.

Check a site for this and everything else: snag.page. More on exposed files: Exposed files Keys in scripts Git repository Environment files wp-config.php copies Database dumps AWS and npm credentials Editor upload settings Spring Boot actuator Terraform state Git credentials Kubernetes config phpinfo() pages Debug panels Subversion and Mercurial Backup archives Password files PHP error logs Laravel logs ELMAH error logs Database admin pages Apache server-status Go's pprof docker-compose.yml Directory listings .DS_Store files WordPress users