We have a hosted CentOS 6.5 server in which we have a single user account. That account has been configured to use SSH keyfile authentication for the users who need to access it.

I would like to be able to see which keyfile was used to authenticate each login; effectively telling me which end-user logged into the single unix user account. Is there a mechanism for doing so?

  • The fingerprint used for each login ought to be logged in /var/log/auth.log. This question on serverfault tells how to get a list of all the fingerprints in the authorized_keys file ( which ought to include the user@host who generated each key), so you can grep for the fingerprint in that list. – Mark Plotnick Jul 29 '14 at 19:44

On CentOS there is /var/log/secure. This holds the fingerprints of the logins:

 Aug  7 23:12:57 my-server sshd[2584]: Accepted publickey for user from port 58279 ssh2: RSA 32:f1:aa:aa:aa:aa:aa:aa:bb:be:ef:c3:aa:bb:cc:f8

Map these back to the keys and you have the info you need. You can get the key fingerprints by doing:

ssh-keygen -l -f ~/.ssh/*.pub

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.