I would like to know which key was used when logging into an SSH session. I wan to correlate the key to a local database and send email to an address which corresponds to the key.
The first step is to find which key is the one being used.
Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.Sign up to join this community
To do this you will have to raise the
LogLevel of your sshd to
/etc/ssh/sshd_config and restart sshd. This will cause sshd to log the fingerprint of the key used to log in, to the configured log file (/var/log/secure, /var/log/auth etc). You will get a message similar to this
Dec 9 11:47:15 host sshd: Found matching RSA key: 54:d2:06:cf:85:ec:89:96:3c:a8:73:c7:a1:30:c2:8b
54:d2:06:cf:85:ec:89:96:3c:a8:73:c7:a1:30:c2:8b is the fingerprint of the key used to log in.
You can obtain the fingerprint of a particular key by using the command
ssh-keygen -lf <keyfile>
where keyfile is the public key
sshkeygen -lf /tmp/test.key 2048 21:02:4b:82:83:62:49:d7:5f:e0:8f:cf:ec:a3:5f:38 /tmp/test.key (RSA)