0

I'm doing some clean up on one of my servers and I have a bunch of keys in my .ssh/authorized_keys

The problem is I want to delete them but I'm not too sure if they are still even used. Is there a way to find out which keys have been used recently? I want to delete them if no one has logged in with them for over 3 months.

1

From what I know, you cannot retroactively access this information if you had not been logging it so far.

You should check the LogLevel here:

vi /etc/ssh/sshd_config

....
LogLevel VERBOSE
....

If it is not VERBOSE, but QUIET/FATAL/ERROR, you will not get old log records.

Else, you should see the key fingerprints for each new connection in /var/log/auth.log*.

0

If you have to ask this question it is unlikely you have taken the necessary steps to have gathered the information. Normally you have to increase the log verbosity for the ssh daemon to ensure that it logs which keys are being used. To get 3 months of info you'd have like;y had to configure your system to keep logs for that long too.

I have a vague recollection of seeing an answer/comment here on SF suggesting that more recent versions of Ubuntu log the information more readily but I can't find that now.

And a reference on what to do Is it possible to get OpenSSH to log the public key that was used in authentication?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.