Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I use a classical pair of private/public key in order to connect into servers.

For now, we have one dedicated account, let's say foo, which is used by multiple users, each with their own pairs of public/private keys.

I am looking for a way to log which user authenticated on this foo account.

For now, I manage to found that if I raise LogLevel to VERBOSE in /etc/ssh/sshd_config, ssh log the fingerprint of the public key in /var/log/auth.log.

It looks like this :

Apr  2 18:33:15 xxx-yy sshd[32064]: Connection from A.B.C.D port 43286
Apr  2 18:33:15 xxx-yy sshd[32064]: Found matching RSA key: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX
Apr  2 18:33:15 xxx-yy sshd[32064]: Accepted publickey for foo from A.B.C.D port 43286 ssh2

I then manage to get fingerprint of each users with a call to ssh-keygen -lf key.pub on their public key and then apply a sed on the log.

I would like to know if there's a simpler or a better way to have ssh log which user's key was used to authenticate on the server ?

share|improve this question
up vote 2 down vote accepted

sshd never sees which key filename is used by the client, so postprocessing cannot be avoided.

share|improve this answer
I guess I'll have to manage ssh auth. via ldap and/or local account, then. – Coren Apr 3 '12 at 16:12

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.