3

I know this way to find out which key was used to authenticate when using keys stored in a key agent:

ssh-add -L 2>/dev/null | awk '{print $1}' | while read identity; do grep -v '^#' ~/.ssh/authorized_keys | grep "${identity}" ; done 

List agent's identities line by line, extract the key and look it up in the authorized_keys file

When the client does not use a key agent no keys will be listed by ssh-add -L.

Is there any other way to identify the public key? Note that passing or setting custom "user environment" variables using SetEnv or environment="VAR=VALUE" as key option is not possible (allowed).

  • 1
    I don't think there's a way to do this. Even the script you included does not actually work. All it can do is show you which keys (since there could be more than one in the list) might have been used to authenticate the present session; there can be both false positives and false negatives. What you are trying to achieve is normally done with environment="USER=something" annotations in ~/.ssh/authorized_keys` and I wonder why that option is not available to you. – Celada Apr 19 '15 at 17:26
  • Thanks for your opinion on this, Celada. "[...] why that option is not available to you." Because the operators sayed so. :) I know that there might be multiple matching keys and false positives but assuming there's only one key of a user in authorized_keys and when only public key based authentication is avaiable there should be a 100% match (no false negative). Shoulnd't it? – try-catch-finally Apr 19 '15 at 17:39
3

The only place where sshd records how the user authenticated is in the system logs. This information is not made available to the logged-in session. The only identifying information about the origin of the connection that is made available in the environment is the IP address and port on the client, in the variables SSH_CLIENT and SSH_CONNECTION.

You can add a directive in ~/.ssh/authorized_keys to set an environment variable if the user logs in with a particular key:

environment="SSH_KEY=foo" ssh-rsa AAAA…

If the user didn't log in with a key, you have no way to tell how they logged in (password, .shosts, Kerberos, …) except by looking in the system logs (which only the system administrator can do).

If your system administrator doesn't let you modify the authorized_keys file, you'll need to work out with them how you can do whatever it is that you want to do. Be sure to explain to them what information you need to know and why.

Note that what you did with the agent is not a reliable way of identifying the origin of the connection, and tells you nothing about how the user logged in. You'll get nothing if the user didn't forward their agent, or if they had no keys in their agent. You might get multiple keys, and there's no particular reason why the user would have used one of these keys to log in (they could have used a password, or some other key, or any other method). I don't recommend doing anything with this information, it's too unreliable.

  • 1
    FYI in order to use the prepending environment="NAME=value" method to the authorized_keys file, you need two things. You need access to edit the ~/.ssh/authorized_keys file, AND The sshd server needs to have the "PermitUserEnvironment" variable enabled in sshd_config, which is not the default. Keep in mind that depending on your ssh permissioning layout, that might be a security risk (see this serverfault.com/questions/527638/…). But if you're allowing full machine access via SSH already for all authorized clients then it's not an issue. – Scott Feb 16 '16 at 20:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.