I would like to know which key was used when logging into an SSH session. I wan to correlate the key to a local database and send email to an address which corresponds to the key.
The first step is to find which key is the one being used.
To do this you will have to raise the
LogLevel of your sshd to
/etc/ssh/sshd_config and restart sshd. This will cause sshd to log the fingerprint of the key used to log in, to the configured log file (/var/log/secure, /var/log/auth etc). You will get a message similar to this
Dec 9 11:47:15 host sshd: Found matching RSA key: 54:d2:06:cf:85:ec:89:96:3c:a8:73:c7:a1:30:c2:8b
54:d2:06:cf:85:ec:89:96:3c:a8:73:c7:a1:30:c2:8b is the fingerprint of the key used to log in.
You can obtain the fingerprint of a particular key by using the command
ssh-keygen -lf <keyfile>
where keyfile is the public key
sshkeygen -lf /tmp/test.key
2048 21:02:4b:82:83:62:49:d7:5f:e0:8f:cf:ec:a3:5f:38 /tmp/test.key (RSA)
If you want to detect the currently used ssh key from within the current ssh session, then it seems there’s a better way since OpenSSH 7.6:
ExposeAuthInfo yes in your server’s sshd_config. You should be able to limit this configuration to a specific user via
Match User geoaxis.
Then, after restarting sshd and re-login, there should be an environment variable
SSH_USER_AUTH that contains the path to a file with authentication information. In case of public key authentication this file contains the full public key prefixed with the string
This way you don’t need to manually add environment variables to your
The log idea from @user9517 is good and you can even have script monitoring the logs etc.
Additionally you can add
environment="SSH_KEY_ID=geoaxis" before the actual key (see
AUTHORIZED_KEYS FILE FORMAT) and then you can probably utilize that env var in /etc/profile or similar.
But also look at