Tables
Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.
Apple
Linux
Windows
ChromeOS
user_ssh_keys
user_ssh_keys
Returns the private keys in the users ~/.ssh directory and whether or not they are encrypted.
| Column | Type | Description |
|---|---|---|
| encrypted | integer | 1 if key is encrypted, 0 otherwise |
| key_group_name | text | The group of the private key. Supported for a subset of key_types implemented by OpenSSL |
| key_length | integer | The cryptographic length of the cryptosystem to which the private key belongs, in bits. Definition of cryptographic length is specific to cryptosystem. -1 if unavailable |
| key_security_bits | integer | The number of security bits of the private key, bits of security as defined in NIST SP800-57. -1 if unavailable |
| key_type | text | The type of the private key. One of [rsa, dsa, dh, ec, hmac, cmac], or the empty string. |
| path | text | Path to key file |
| pid_with_namespace | integer | Pids that contain a namespace Only available on Linux |
| uid | bigint | The local user that owns the key file |
Example
SELECT * FROM users CROSS JOIN user_ssh_keys USING (uid);Identify SSH keys stored in clear text in user directories
SELECT * FROM users JOIN user_ssh_keys USING (uid) WHERE encrypted = 0;Notes
Querying this table requires joining against the users table. Learn more
Edit page
Ask us anything
Questions?
SOC2 Type 2
© 2025 Fleet Inc.
Privacy
