Inventory your SSH host keys
Every SSH server announces its host-key algorithm to anyone who connects — before authentication. PQLens reads exactly that, so your fleet goes in the inventory without credentials or a login attempt.
How it works
- Open the SSH tab in the app and type a host (add
:portif it isn’t 22). - PQLens connects from its edge only as far as the key exchange and reads the host-key algorithm the server presents — it never authenticates.
- Ed25519 and ECDSA host keys are classified quantum-vulnerable (normal today); anything RSA-1024 or DSA-era is flagged broken / deprecated.
- Sync the result into the same inventory as every other surface.
Why SSH belongs in a cryptographic inventory
SSH host keys are long-lived production cryptography that almost never appears in anyone’s inventory — they were generated when the box was provisioned and forgotten. A fleet still presenting ssh-rsa with small keys, or DSA keys from a 2012 image, is exactly the kind of finding PCI DSS 12.3.3 exists to surface.
No credentials, by design
The probe stops before authentication: it reads what the server offers to every client and disconnects. Like the TLS probe, it runs from PQLens’s edge (a browser can’t open a raw socket) — only the host you name is ever contacted, and there is nothing to configure or authenticate.
Frequently asked questions
Do I need SSH credentials to scan?
No. The host-key algorithm is presented pre-authentication, to any client that connects. PQLens reads it and disconnects — it never attempts a login.
Is an Ed25519 host key a problem?
Not today. Ed25519 is a modern, well-regarded choice against classical attackers; like all elliptic-curve signatures it is quantum-vulnerable, so it goes in the inventory with that status — nothing more alarming than that.
Will this trip intrusion detection?
It looks like a TCP connection that completes key exchange and leaves — similar to a monitoring probe. If your IDS alerts on that, expect it from PQLens's edge IP ranges.