Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am using one ssh account for all my Subversion users. They send me their public keys and I put them in .ssh/authorized_key of the svn account, then they can check out the code from Subversion using ssh tunnel.

So far everything works fine. The problem though is that I want to invalidate keys that have not been used for some time (say one month). Does anyone know a way to make sshd log the public key when a user signs in?

Thanks.

share|improve this question
    
With what search phrase? I haven't found one yet that works. –  sblom Apr 5 '10 at 0:08
1  
@Alex the answer of "Just Google it" is not something we encourage here. This is a valid question and obviously has support due to the upvotes. –  Sam Feb 10 '11 at 14:20
add comment

3 Answers

up vote 2 down vote accepted

Everything is documented in sshd(8), under "AUTHORIZED_KEYS FILE FORMAT" section.

In .ssh/authorized_keys2 add something like environment="SSHKEY=1" at beginning of each line, so it should looks like:

environment="SSHKEY=1" ssh-dss AAAAB3N ...
environment="SSHKEY=2" ssh-rsa AAAAB3N ...

Enable PermitUserEnvironment option in /etc/ssh/sshd_config and restart sshd. Now you can add something like echo $SSHKEY >>.sshlog to ~/.bashrc for logging used ssh keys.

But I think much ease way is backup authorized_keys2 file, remove all keys from it, and just wait until people call/email/im you asking why svn doesn't work. Then you can either restore their key or ask them to resend their keys to you if you unsure which key belong to who. As side effect you'll know who is really working. :)

share|improve this answer
add comment

I think lastlog won't be very useful, since JH says he only has one account, with multiple real users logging in with different keys (I wonder why; you'll lose valuable author information in SVN that way).

Anyway, at least in my systems (Debian/Ubuntu), sshd does not log the key used to login by default, but it seems it is possible to force it to do so, by using "LogLevel Verbose" or something to that effect in sshd_config. You could then write/use a simple parser for the logs and store keys used, and determine based on that the info you need.

share|improve this answer
add comment

Add LogLevel VERBOSE to your sshd_config
You may also want to change your log turnover, so you have logs for the last month.

Note it'll show the fingerprint of the key in the log file. You can use ssh-keygen -l to show the fingerprint of a keyfile.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.