Home / ubuntu / Questions / 1359976
In Process
damn harshitha
Asked: 2021-08-25 22:52:33 +0800 CST

How to find the username who performed SSH?

  • 772

When one does ssh oracle@hostB on a local host say A, will the hostB know the user who performed SSH on host A? Is there a way to find out the username who performed SSH?

command-line

3 Answers

  1. When using ssh, you log in to the remote computer hostname as one of the users know to that remote computer. Thus, anyone logging in on as user oracle will be known as that single user on the remote computer.

    If you want to differentiate who logs in on the remote computer, then give each user his own account. Administer your system, i.e., set umasks, ownerships and permissions or use ACL extended permissions, to make sure any user can do what that user is expected to do.

    • 2

  2. If it helps:

    If you set the server up so that people use public and private keys to log in (and deny passwords), the key used to log into the server is recorded in the system log files by the ssh daemon.

    You can find out the matching key by running the following command on all the public keys until you find a match

    ssh-keygen -lf ~/.ssh/xxxx.pub

    where xxx is the name of a public key, when the output matches the log file entry you have the identity of the user connecting to the server.

    • 0

  3. By "host A", do you mean the host on which the command ssh oracle@hostname is performed, or the remote host hostname?

    In the first case, obviously the name of the local user who performs the command is known to the local host. It is stored for example in environment variables LOGNAME or USERNAME, or may be obtained using the command id -un.

    If you want to eg. record that name, you can replace the ssh binary with a wrapper script, that gets the local user name using any of the above methods, writes it to some logfile together with a timestamp, and then calls the "real" ssh binary with the original arguments provided to the script.

    • 0