Tables

Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.

Apple

user_ssh_keys

Returns the private keys in the users ~/.ssh directory and whether or not they are encrypted.

Column	Type	Description
encrypted	integer	1 if key is encrypted, 0 otherwise
key_group_name	text	The group of the private key. Supported for a subset of key_types implemented by OpenSSL
key_length	integer	The cryptographic length of the cryptosystem to which the private key belongs, in bits. Definition of cryptographic length is specific to cryptosystem. -1 if unavailable
key_security_bits	integer	The number of security bits of the private key, bits of security as defined in NIST SP800-57. -1 if unavailable
key_type	text	The type of the private key. One of [rsa, dsa, dh, ec, hmac, cmac], or the empty string.
path	text	Path to key file
pid_with_namespace	integer	Pids that contain a namespace Only available on Linux
uid	bigint	The local user that owns the key file

SELECT * FROM users CROSS JOIN user_ssh_keys USING (uid);

Identify SSH keys stored in clear text in user directories

SELECT * FROM users JOIN user_ssh_keys USING (uid) WHERE encrypted = 0;

Querying this table requires joining against the users table. Learn more

Edit page

Ask us anything

Multi platform Device management Orchestration Software management Integrations Pricing

Documentation Support Docs API Release notes Get your license

Company About News Jobs Logos/artwork Why open source?

SOC2 Type 2

Tried Fleet yet?

Get started with Fleet