I use a classical pair of private/public key in order to connect into servers.
For now, we have one dedicated account, let's say
foo, which is used by multiple users, each with their own pairs of public/private keys.
I am looking for a way to log which user authenticated on this
For now, I manage to found that if I raise
VERBOSE in /etc/ssh/sshd_config, ssh log the fingerprint of the public key in /var/log/auth.log.
It looks like this :
Apr 2 18:33:15 xxx-yy sshd: Connection from A.B.C.D port 43286 Apr 2 18:33:15 xxx-yy sshd: Found matching RSA key: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX Apr 2 18:33:15 xxx-yy sshd: Accepted publickey for foo from A.B.C.D port 43286 ssh2
I then manage to get fingerprint of each users with a call to
ssh-keygen -lf key.pub on their public key and then apply a sed on the log.
I would like to know if there's a simpler or a better way to have ssh log which user's key was used to authenticate on the server ?