I'd like to audit the authorized_keys file on a number of servers and match them with known AWS key fingerprints.

Is there a one-liner which incorporates ssh-keygen -lf which will output the fingerprint of every key in an authorized_keys file in a nice list with line breaks?

2 Answers 2


From serverfault:

You can easily make it a function in your .bashrc:

function fingerprints() {
  local file="$1"
  while read l; do
    [[ -n $l && ${l###} = $l ]] && ssh-keygen -l -f /dev/stdin <<<$l
  done < $file

and then do:

$ fingerprints .ssh/authorized_keys

Here you go:

    find /path/to/keys/directory -type f -name "*.pub" -exec ssh-keygen -lf {} \; | awk '{print $2}'

Edit: Whops, ok. get it now.

here you go:

    while read line; do ssh-keygen -lf "$line"; done < <(cat authorised_keys_file)

(if this file have one key per line)

  • thanks. I want to operate on the authorised_keys file, though, not individual .pub files
    – codecowboy
    Apr 17, 2014 at 10:54
  • Ok, check if edited answer is the one liner you have been looking for.
    – tommy
    Apr 17, 2014 at 11:04
  • thanks. please format your answer with any code, commands etc using the '{}' icon in the text editor
    – codecowboy
    Apr 17, 2014 at 11:21
  • That doesn't work, -f expects a file name (and that file has to be a regular file as ssh-keygen opens and reads the file several times) Apr 17, 2014 at 13:22
  • Use instead: while read line; do echo "$line" > key.pub; ssh-keygen -lf key.pub ; rm key.pub; done < <(cat authorised_keys)
    – tommy
    Apr 17, 2014 at 13:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.