Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #225981 > unrolled thread

ssh key used for login

Back to article view | Back to linux.debian.user

Contents

  ssh key used for login Rainer Dorsch <ml@bokomoko.de> - 2020-08-07 17:40 +0200
    Re: ssh key used for login john doe <johndoe65534@mail.com> - 2020-08-07 17:50 +0200
      Re: ssh key used for login Rainer Dorsch <ml@bokomoko.de> - 2020-08-07 19:20 +0200
        Re: ssh key used for login <tomas@tuxteam.de> - 2020-08-07 21:10 +0200
    Re: ssh key used for login Kushal Kumaran <kushal@locationd.net> - 2020-08-08 02:30 +0200
      Re: ssh key used for login echo test <echotest09@gmail.com> - 2020-08-08 16:50 +0200
      Re: ssh key used for login Rainer Dorsch <ml@bokomoko.de> - 2020-08-09 22:00 +0200

#225981 — ssh key used for login

Hi,

can anybody tell if there is a way to find out the ssh key (out of the ones 
listed in authorized keys) was used for login to the current session?

Thanks
Rainer

-- 
Rainer Dorsch
http://bokomoko.de/

[toc] | [next] | [standalone]

#225982

On 8/7/2020 5:07 PM, Rainer Dorsch wrote:
> Hi,
>
> can anybody tell if there is a way to find out the ssh key (out of the ones
> listed in authorized keys) was used for login to the current session?
>

Try to increase the log verbosity to 'debug[1|2|3]'.

--
John Doe

[toc] | [prev] | [next] | [standalone]

#225986

[Multipart message — attachments visible in raw view] — view raw

Am Freitag, 7. August 2020, 17:47:31 CEST schrieb john doe:
> On 8/7/2020 5:07 PM, Rainer Dorsch wrote:
> > Hi,
> > 
> > can anybody tell if there is a way to find out the ssh key (out of the
> > ones
> > listed in authorized keys) was used for login to the current session?
> 
> Try to increase the log verbosity to 'debug[1|2|3]'.
> 

Thanks for the reply, but it seems my question was not precise enough.

I want to find it out in a script which runs on the server, e.g.

ssh server.domain myscript.sh

Is there a way to find out in myscript.sh which ssh key was used for login. 

There are a number of ssh environment vars, but none of them contains the ssh 
key (or even better the "user label" after the public key):

declare -x SHLVL="1" 
declare -x SSH_CLIENT="192.168.7.203 56018 22" 
declare -x SSH_CONNECTION="192.168.7.203 56018 192.168.7.1 22" 
declare -x SSH_TTY="/dev/pts/2"

Thanks
Rainer

-- 
Rainer Dorsch
http://bokomoko.de/

[toc] | [prev] | [next] | [standalone]

#225990

[Multipart message — attachments visible in raw view] — view raw

On Fri, Aug 07, 2020 at 07:09:34PM +0200, Rainer Dorsch wrote:
> Am Freitag, 7. August 2020, 17:47:31 CEST schrieb john doe:
> > On 8/7/2020 5:07 PM, Rainer Dorsch wrote:
> > > Hi,
> > > 
> > > can anybody tell if there is a way to find out the ssh key (out of the
> > > ones
> > > listed in authorized keys) was used for login to the current session?
> > 
> > Try to increase the log verbosity to 'debug[1|2|3]'.
> > 
> 
> Thanks for the reply, but it seems my question was not precise enough.
> 
> I want to find it out in a script which runs on the server, e.g.
> 
> ssh server.domain myscript.sh
> 
> Is there a way to find out in myscript.sh which ssh key was used for login. 
> 
> There are a number of ssh environment vars, but none of them contains the ssh 
> key (or even better the "user label" after the public key):
> 
> declare -x SHLVL="1" 
> declare -x SSH_CLIENT="192.168.7.203 56018 22" 
> declare -x SSH_CONNECTION="192.168.7.203 56018 192.168.7.1 22" 
> declare -x SSH_TTY="/dev/pts/2"

The ssh(1) man page says, in the section "ENVIRONMENT":

  SSH_USER_AUTH  Optionally set by sshd(8), this variable may contain
                 a pathname to a file that lists the authentication
                 methods successfully used when the session was established,
                 including any public keys that were used.

so you need to convince sshd to do that trick for you. In sshd_config, you have

  ExposeAuthInfo
          Writes a temporary file containing a list of authentication
          methods and public credentials (e.g. keys) used to authenticate
          the user.  The location of the file is exposed to the user
          session through the SSH_USER_AUTH environment variable.  The
          default is no.

So perhaps those are the bricks you need. Note that I haven't tried it out.

Cheers
 - t

[toc] | [prev] | [next] | [standalone]

#225996

Rainer Dorsch <ml@bokomoko.de> writes:

> Hi,
>
> can anybody tell if there is a way to find out the ssh key (out of the ones 
> listed in authorized keys) was used for login to the current session?
>

See the environment="NAME=value" part in the authorized_keys(5) manpage.
You can have each entry in authorized_keys set a different value for
some variable you pick.

You may also be able to use command="command" creatively.  This is what
gitolite does: https://gitolite.com/gitolite/glssh

-- 
regards,
kushal

[toc] | [prev] | [next] | [standalone]

#226015

[Multipart message — attachments visible in raw view] — view raw

If what you use is a certificate based authentication, you can add user
identity to the certificate with -I .
Any auth attempt will make that identity logged automatically. Then you
just have to get it from syslogs.



Le sam. 8 août 2020 à 02:26, Kushal Kumaran <kushal@locationd.net> a écrit :

> Rainer Dorsch <ml@bokomoko.de> writes:
>
> > Hi,
> >
> > can anybody tell if there is a way to find out the ssh key (out of the
> ones
> > listed in authorized keys) was used for login to the current session?
> >
>
> See the environment="NAME=value" part in the authorized_keys(5) manpage.
> You can have each entry in authorized_keys set a different value for
> some variable you pick.
>
> You may also be able to use command="command" creatively.  This is what
> gitolite does: https://gitolite.com/gitolite/glssh
>
> --
> regards,
> kushal
>
>

[toc] | [prev] | [next] | [standalone]

#226044

Am Samstag, 8. August 2020, 02:26:20 CEST schrieb Kushal Kumaran:
> Rainer Dorsch <ml@bokomoko.de> writes:
> > Hi,
> > 
> > can anybody tell if there is a way to find out the ssh key (out of the
> > ones
> > listed in authorized keys) was used for login to the current session?
> 
> See the environment="NAME=value" part in the authorized_keys(5) manpage.
> You can have each entry in authorized_keys set a different value for
> some variable you pick.
> 
> You may also be able to use command="command" creatively.  This is what
> gitolite does: https://gitolite.com/gitolite/glssh

Many thanks, for your suggestion, that looks promising, I will give it a try.

Rainer

-- 
Rainer Dorsch
http://bokomoko.de/

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web