Home / server / Questions / 339355
In Process
geoaxis
Asked: 2011-12-10 03:19:33 +0800 CST

How to findout which key was being used to login for an SSH session

  • 772

I would like to know which key was used when logging into an SSH session. I wan to correlate the key to a local database and send email to an address which corresponds to the key.

The first step is to find which key is the one being used.

bash ssh

4 Answers

  1. You will need to turn up logging.

    On the client side, "ssh -v" will which private key was used.

    On the server side, default log levels will only show that a public key was used (as opposed to password auth). You will need to set the logging level in sshd_config to at least VERBOSE.

    • 7

  2. To do this you will have to raise the LogLevel of your sshd to VERBOSE. 

    logLevel VERBOSE

    in /etc/ssh/sshd_config and restart sshd. This will cause sshd to log the fingerprint of the key used to log in, to the configured log file (/var/log/secure, /var/log/auth etc). You will get a message similar to this 

    Dec  9 11:47:15 host sshd[32282]: Found matching RSA key: 54:d2:06:cf:85:ec:89:96:3c:a8:73:c7:a1:30:c2:8b

    The 54:d2:06:cf:85:ec:89:96:3c:a8:73:c7:a1:30:c2:8b is the fingerprint of the key used to log in.

    You can obtain the fingerprint of a particular key by using the command 

    ssh-keygen -lf <keyfile>

    where keyfile is the public key

    sshkeygen -lf /tmp/test.key
2048 21:02:4b:82:83:62:49:d7:5f:e0:8f:cf:ec:a3:5f:38 /tmp/test.key (RSA)
    • 5

  3. If you want to detect the currently used ssh key from within the current ssh session, then it seems there’s a better way since OpenSSH 7.6:

    Set ExposeAuthInfo yes in your server’s sshd_config. You should be able to limit this configuration to a specific user via Match User geoaxis.

    Then, after restarting sshd and re-login, there should be an environment variable SSH_USER_AUTH that contains the path to a file with authentication information. In case of public key authentication this file contains the full public key prefixed with the string publickey .

    This way you don’t need to manually add environment variables to your ~/.ssh/authorized_keys.

    • 3

  4. The log idea from @user9517 is good and you can even have script monitoring the logs etc.

    Additionally you can add environment="SSH_KEY_ID=geoaxis" before the actual key (see sshd(8), AUTHORIZED_KEYS FILE FORMAT) and then you can probably utilize that env var in /etc/profile or similar.

    But also look at sshd_config(5)'s AuthorizedKeysCommand

    • 2