5

I am using one ssh account for all my Subversion users. They send me their public keys and I put them in .ssh/authorized_key of the svn account, then they can check out the code from Subversion using ssh tunnel.

So far everything works fine. The problem though is that I want to invalidate keys that have not been used for some time (say one month). Does anyone know a way to make sshd log the public key when a user signs in?

Thanks.

2
  • With what search phrase? I haven't found one yet that works.
    – sblom
    Apr 5, 2010 at 0:08
  • 1
    @Alex the answer of "Just Google it" is not something we encourage here. This is a valid question and obviously has support due to the upvotes.
    – Sam Cogan
    Feb 10, 2011 at 14:20

3 Answers 3

4

Everything is documented in sshd(8), under "AUTHORIZED_KEYS FILE FORMAT" section.

In .ssh/authorized_keys2 add something like environment="SSHKEY=1" at beginning of each line, so it should looks like:

environment="SSHKEY=1" ssh-dss AAAAB3N ...
environment="SSHKEY=2" ssh-rsa AAAAB3N ...

Enable PermitUserEnvironment option in /etc/ssh/sshd_config and restart sshd. Now you can add something like echo $SSHKEY >>.sshlog to ~/.bashrc for logging used ssh keys.

But I think much ease way is backup authorized_keys2 file, remove all keys from it, and just wait until people call/email/im you asking why svn doesn't work. Then you can either restore their key or ask them to resend their keys to you if you unsure which key belong to who. As side effect you'll know who is really working. :)

0

I think lastlog won't be very useful, since JH says he only has one account, with multiple real users logging in with different keys (I wonder why; you'll lose valuable author information in SVN that way).

Anyway, at least in my systems (Debian/Ubuntu), sshd does not log the key used to login by default, but it seems it is possible to force it to do so, by using "LogLevel Verbose" or something to that effect in sshd_config. You could then write/use a simple parser for the logs and store keys used, and determine based on that the info you need.

0

Add LogLevel VERBOSE to your sshd_config
You may also want to change your log turnover, so you have logs for the last month.

Note it'll show the fingerprint of the key in the log file. You can use ssh-keygen -l to show the fingerprint of a keyfile.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .