5

I would like to know which key was used when logging into an SSH session. I wan to correlate the key to a local database and send email to an address which corresponds to the key.

The first step is to find which key is the one being used.

5

You will need to turn up logging.

On the client side, "ssh -v" will which private key was used.

On the server side, default log levels will only show that a public key was used (as opposed to password auth). You will need to set the logging level in sshd_config to at least VERBOSE.

1
  • I would suggest ssh -vvv Oct 10 at 5:19
4

To do this you will have to raise the LogLevel of your sshd to VERBOSE.

logLevel VERBOSE

in /etc/ssh/sshd_config and restart sshd. This will cause sshd to log the fingerprint of the key used to log in, to the configured log file (/var/log/secure, /var/log/auth etc). You will get a message similar to this

Dec  9 11:47:15 host sshd[32282]: Found matching RSA key: 54:d2:06:cf:85:ec:89:96:3c:a8:73:c7:a1:30:c2:8b

The 54:d2:06:cf:85:ec:89:96:3c:a8:73:c7:a1:30:c2:8b is the fingerprint of the key used to log in.

You can obtain the fingerprint of a particular key by using the command

ssh-keygen -lf <keyfile> 

where keyfile is the public key

sshkeygen -lf /tmp/test.key
2048 21:02:4b:82:83:62:49:d7:5f:e0:8f:cf:ec:a3:5f:38 /tmp/test.key (RSA)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.