3

I need to run an SSH server and log the IP & public key of any client that attempts to connect (without actually granting access).

The use case is this: I deploy this web app to a remote host that, during the build process, fetches some dependencies from github/bitbucket (git uses ssh which uses keys). Now if I want this hosting server to have access to some private repos, I need to whitelist it's public key, however the host doesn't provide access to read the key directly off the filesystem. But I can point it to any SSH host and it will make a connection, presumably handing out it's public key. I'd like to log this.

Any suggestions appreciated.

Improve this question

2 Answers 2

Reset to default
3

If you need the public key for whitelisting, you cannot pick it from failed attempt. It is not about sshd or its configuration at all, but the protocol itself, as public key authentication goes this way:

  1. Client sends an ID for the key pair.
  2. Server compares the ID to the authorized_keys file.
  3. Server generates a random number and uses the matching public key to encrypt it.
  4. Server sends it to the client.
  5. Client decrypts it, combines it with shared session key and sends back MD5 of this.
  6. Server calculates the same checksum on its own and compares them together.

In failed attempts this stops on step 2 preventing everything further happen. Nevertheless, the whole public key is never sent to the server, just the ID.

One does not simply log something he doesn't even know.

Improve this answer
2
  • OK, that mostly makes sense. Maybe what I actually need the ID that should exist in authorized_keys. I thought this was the public key, but I could be wrong. Basically, I need the key that goes in the whitelist like so: dropbox.com/s/hylf5aqc70m146s/…
    – sstur
    Mar 28, 2015 at 13:39
  • Oops, I slightly misunderstood that. Now I realize what you mean. The ID is like a key fingerprint and it is used to reference the public key that the server is expected to already have. So the public key is never sent over the wire and there is no way to get it during the handshake process. Thanks for your detailed answer!
    – sstur
    Mar 28, 2015 at 14:00
0

sshd doesn't actually log the publickeys used in login attempts, successful or otherwise. The closest it gets is to log the fingerprint of the public key at LogLevel VERBOSE.

  1. Push the publickey via some other method than failed login attempt. E.g. upload to a cgi/php script that records (either rate controlled appends or overrides ) the key to a file based on the ip address of the client connection as seen by the server.
  2. Have the setup issue a GET request to a specific URL on your webserver and grab it that way. (I feel this is an inferior version of 1.)
  3. Have the application publish its publickey in a public place and then fetch it. It's a web application and part of the beauty of publickeys is that they aren't shared secrets.

Also, as this is ServerFault, I feel compelled to mention that your deployment process is incorrect. You should be distributing (signed) packages as used by package managers, .rpm, .deb, etc.. In these packages you might include a configuration script if necessary.

Improve this answer
2
  • Hi @84104. Those three options make an assumption that my code running on the hosting server has read access to the public key, which it does not. The deployment process may be sub-optimal, but it is all that is provided by the host (RedHat OpenShift). I push my code (NodeJS project) to the host using git and the host uses npm to load and build the required packages. Private packages are generally kept in private repositories on bitbucket.
    – sstur
    Mar 28, 2015 at 13:52
  • To quote the original question "... however the host doesn't provide access to read the key directly off the filesystem."
    – sstur
    Mar 28, 2015 at 14:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .