Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a production system where several different people are allowed to log in to a single account - the account is for the application and not for the person as we don't have personal accounts on production servers.

For auditing purposes I want to be able to tell who logged in at what time, and as we use SSH keys to log in it seems logical to track that (as there is no other identifier to track).

When SSH authenticates a user, it logs the user name to the system's security log, but it does not log which of the authorized public keys was used in the log in. Is it possible to get OpenSSH to also report which public key was used, or maybe just the comment associated with that key?

The operating system being used is CentOS 5.6, but I'd like to also hear if its possible on other operating systems.

share|improve this question
add comment

4 Answers

up vote 19 down vote accepted

If you raise the LogLevel to VERBOSE in /etc/sshd/sshd_config it will log the fingerprint of the public key used to authenticate the user.

LogLevel VERBOSE

then you get messages like this

Jul 19 11:23:13 centos sshd[13431]: Connection from 192.168.1.104 port 63529
Jul 19 11:23:13 centos sshd[13431]: Found matching RSA key: 54:a2:0a:cf:85:ef:89:96:3c:a8:93:c7:a1:30:c2:8b
Jul 19 11:23:13 centos sshd[13432]: Postponed publickey for user from 192.168.1.104 port 63529 ssh2
Jul 19 11:23:13 centos sshd[13431]: Found matching RSA key: 54:a2:0a:cf:85:ef:89:96:3c:a8:93:c7:a1:30:c2:8b
Jul 19 11:23:13 centos sshd[13431]: Accepted publickey for user from 192.168.1.104 port 63529 ssh2

You can use

 ssh-keygen -lf /path/to/public_key_file

to get the fingerprint of a particular public key.

share|improve this answer
    
Thanks! I need to confirm the key fingerprints against the authorized_keys file, so I made this little script to printout the fingerprints of authorized keys: (p="$(mktemp)";cat ~/.ssh/authorized_keys|while IFS="$(printf "\n")" read key; do echo $key > $p; ssh-keygen -lf $p; done; rm -f $p) –  Guss Jul 19 '11 at 13:06
    
I noticed that SSH now logs the key twice for each login - any idea why and/or how to get it to log it once? –  Guss Jul 19 '11 at 13:10
    
Why, that's a level of detail I'm not familiar with. Can you stop it, probably not without poking around with the source code. –  Iain Jul 19 '11 at 14:05
add comment

If your people are using ssh-agent, you could put this in your .bashrc:

SSH_KEY_NAME=$(ssh-add -L | cut -d' ' -f 3 || 'unknown')
if [[ ! $SSH_KEY_NAME ]]; then SSH_KEY_NAME="no agent"; fi
echo `/bin/date` $SSH_KEY_NAME >> ~/.login.log
share|improve this answer
    
Its a good idea, unfortunately one of the reasons I want to log this is that I'm using authorized_keys commands for the users that I want to log, and they don't normally get a bash shell. –  Guss Jun 17 '13 at 12:40
add comment

Try playing around with the LogLevel parameter in sshd_config. For details, refer to man sshd_config

share|improve this answer
add comment

A nice blog post answers your question: http://www.screenage.de/blog/2012/02/10/how-to-log-history-and-logins-from-multiple-ssh-keys-under-one-user-account-with-puppet/

share|improve this answer
3  
Welcome to Server Fault! Generally we like answers on the site to be able to stand on their own - Links are great, but if that link ever breaks the answer should have enough information to still be helpful. Please consider editing your answer to include more detail. See the FAQ for more info. –  slm Jun 17 '13 at 9:45
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.