Can I find out which ssh key was used to access an account?

Question

Is it possible to find out which ssh key was used to access an account? I have an account on a server that I let several (trusted!) people have access to via ssh. I'd find it useful to be able to know who logged in and when. I have root access so I can look at the logs, but there doesn't seem to be anything there. Is there some configuration switch that will put some way of identifying the key in the logs?

Answer 1

If you go into the sshd config file (usually /etc/ssh/sshd_config) and change the LogLevel directive to VERBOSE:

LogLevel VERBOSE

...you can see something like this in the logs:

Jun 24 22:43:42 localhost sshd[29779]: Found matching RSA key: d8:d5:f3:5a:7e:27:42:91:e6:a5:e6:9e:f9:fd:d3:ce
Jun 24 22:43:42 localhost sshd[29779]: Accepted publickey for caleb from 127.0.0.1 port 59630 ssh2

From man sshd_config:

   LogLevel
          Gives  the  verbosity  level that is used when logging messages from
          sshd(8).  The possible values are: QUIET, FATAL, ERROR,  INFO,  VER-
          BOSE,  DEBUG,  DEBUG1,  DEBUG2,  and  DEBUG3.   The default is INFO.
          DEBUG and DEBUG1 are equivalent.  DEBUG2  and  DEBUG3  each  specify
          higher  levels of debugging output.  Logging with a DEBUG level vio-
          lates the privacy of users and is not recommended.

Answer 2

Some scripts for proper installation

There is a full useable method to track/log ssh connections by key with expention to username.

Introduction

In addition to @Caleb 's anwer, I would like to share some little tricks there:

Nota: I'm working on Debian 6.0.

Server installation

SSHD Log level

First ensuring that server config has sufficient logging level:

as root, this will set and active verbose loggin:

sed -e '/^LogLevel/s/ .*$/ VERBOSE/' -i /etc/ssh/sshd_config

Or more precisely (this will modify sshd_config file only if needed and comment out old config):

sed '/LogLevel.*\(QUIET\|FATAL\|ERROR\|INFO\)/{/^ *#/!s/^/# /;h;s/$/\nLogLevel VERBOSE/};${p;g;/./!{iLogLevel VERBOSE'$'\n;};D}'  -i /etc/ssh/sshd_config

Could be written:

sed '
    /LogLevel.*\(QUIET\|FATAL\|ERROR\|INFO\)/{
        /^ *#/!s/^/# /;
        h;
        s/$/\nLogLevel VERBOSE/
    };
    ${
        p;
        g;
        /./!{
            iLogLevel VERBOSE
        };
        D
    }'  -i /etc/ssh/sshd_config

or in a sed script:

#!/bin/sed -f
/LogLevel.*\(QUIET\|FATAL\|ERROR\|INFO\)/{
    /^ *#/!s/^/# /;
    h;
    s/$/\nLogLevel VERBOSE/
};
${
    p;
    g;
    /./!{
        iLogLevel VERBOSE
    };
    D
}

Which could be run as:

patchSshdConfigLogLevel.sed -i /etc/ssh/sshd_config

Than for activating this:

service ssh restart

Syslog: making fingerprints user readable

Now take fingerprints in user readable file:

echo ':msg, regex, "Found matching .* key:" -/var/log/sshdusers.log' \
    > /etc/rsyslog.d/ssh_key_user.conf 

service rsyslog restart

chmod 644 /var/log/sshdusers.log

Usage

This will print current sessions's fingerprint:

sed -ne "/sshd.$PPID.:.*matching .SA key/{s/^.* //g;p;q}" /var/log/sshdusers.log

Plug-in for .bashrc

And finally, there is a little add-on to put at end of your /etc/bash.bashrc or user's .bashrc :

ssh_oPwd=$OLDPWD
ssh_oUmask=$(umask)
umask 077
ssh_tempdir=$(mktemp -d /tmp/ssh-id-XXXXXXX)
cd $ssh_tempdir || exit 1

ssh_crtFp=$(
    sed -ne "/sshd.$PPID.:.*matching .SA key/{s/^.* //g;p;q}" /var/log/sshdusers.log
)
for ((ssh_i=1;ssh_i<=$(wc -l <$HOME/.ssh/authorized_keys);ssh_i++));do
    export ssh_line="$(sed -ne ${ssh_i}p <$HOME/.ssh/authorized_keys)"
    echo "$ssh_line" >tempKey
    export ssh_lFp=($(ssh-keygen -l -f tempKey))
    if [ "${ssh_lFp[1]}" == "$ssh_crtFp" ] ;then
        export SSH_KEY_USER=${ssh_line##* }
        break
      fi
  done

cd $OLDPWD
OLDPWD=$ssh_oPwd
rm -fR $ssh_tempdir
umask $ssh_oUmask
unset ssh_lFp ssh_line ssh_i ssh_crtFp ssh_tempdir ssh_oUmask ssh_oPwd

so after re-login from SSH, you will see:

set | grep ^SSH
SSH_CLIENT='192.168.1.31 43734 22'
SSH_CONNECTION='192.168.1.31 43734 192.168.1.2 22'
SSH_KEY_USER=user@mydesk
SSH_TTY=/dev/pts/2

Nota On some installation, the authorized key file maybe someting differently named, like $HOME/.ssh/authorized_keys2...

Answer 3

You can try this:

ssh-add -L | awk '{ print $2 }' | xargs -i grep '{}' ~/.ssh/authorized_keys  | head -1

Answer 4

Suppose that users "joe" and "deb" have access to account "x". Then in account x's .ssh_authorized_keys you add the lines:

command='wrapper joe' joe public key
command='wrapper deb' deb public key

Also in the wrapper script you can do anything you want, logging that joe's private key has been using ssh at a particular date & time with command $ORIGINAL_COMMAND.