4

Say for some reason, there is only a "user" account on a shhd server. Everyone has his own private key to ssh to the server, as "user".

Then, is there a way to see who is he (during or after his session)?

1 Answer 1

7

You can see which SSH public key was used in the syslog.

The authentication subset of the syslog is usually at /var/log/auth.log. For the whole syslog, you can try /var/log/syslog or /var/log/messages.

The log lines should look something like this:

Sep 10 19:17:00 server.example.com sshd[1337]: Accepted publickey for ansible from 127.0.0.1 port 59934 ssh2: RSA 5a:5d:18:5d:21:b4:e3:f3:8a:ec:c3:d6:93:99:87:ae

You should be able to parse this log with a tool like logstash to build real statistics.

1
  • This is probably the best way, but there is nothing stopping users from exchanging keys with each other. Users can add new keys to ~/.ssh/authorized_keys. So you probably want to also secure authorized_keys as suggested in the other answer.
    – emory
    Sep 12, 2014 at 2:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .