Let's say I want to track my root
users. Each of them has a unique private key and their public keys have been stored in /root/.ssh/authorized_keys
.
Given that each user logs in with their unique key how can I tell from within a BASH session which key was used to authenticate? I've tried looking at the environment variables when I log in but cannot see anything that correlates my session with my public key.
You could add the username to the public key in
~/.ssh/authorized_keys
on the server and export it as an environment value:That will set the environment variable REALUSER which will then be available to use in bash. This will only work if
PermitUserEnvironment
is set to true insshd_config