How to findout which key was being used to login for an SSH session

Question

I would like to know which key was used when logging into an SSH session. I wan to correlate the key to a local database and send email to an address which corresponds to the key.

The first step is to find which key is the one being used.

Answer 1

To do this you will have to raise the LogLevel of your sshd to VERBOSE.

logLevel VERBOSE

in /etc/ssh/sshd_config and restart sshd. This will cause sshd to log the fingerprint of the key used to log in, to the configured log file (/var/log/secure, /var/log/auth etc). You will get a message similar to this

Dec  9 11:47:15 host sshd[32282]: Found matching RSA key: 54:d2:06:cf:85:ec:89:96:3c:a8:73:c7:a1:30:c2:8b

The 54:d2:06:cf:85:ec:89:96:3c:a8:73:c7:a1:30:c2:8b is the fingerprint of the key used to log in.

You can obtain the fingerprint of a particular key by using the command

ssh-keygen -lf <keyfile> 

where keyfile is the public key

sshkeygen -lf /tmp/test.key
2048 21:02:4b:82:83:62:49:d7:5f:e0:8f:cf:ec:a3:5f:38 /tmp/test.key (RSA)

Answer 2

You will need to turn up logging.

On the client side, "ssh -v" will which private key was used.

On the server side, default log levels will only show that a public key was used (as opposed to password auth). You will need to set the logging level in sshd_config to at least VERBOSE.