I use a classical pair of private/public key in order to connect into servers.

For now, we have one dedicated account, let's say foo, which is used by multiple users, each with their own pairs of public/private keys.

I am looking for a way to log which user authenticated on this foo account.

For now, I manage to found that if I raise LogLevel to VERBOSE in /etc/ssh/sshd_config, ssh log the fingerprint of the public key in /var/log/auth.log.

It looks like this :

Apr  2 18:33:15 xxx-yy sshd[32064]: Connection from A.B.C.D port 43286
Apr  2 18:33:15 xxx-yy sshd[32064]: Found matching RSA key: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX
Apr  2 18:33:15 xxx-yy sshd[32064]: Accepted publickey for foo from A.B.C.D port 43286 ssh2

I then manage to get fingerprint of each users with a call to ssh-keygen -lf key.pub on their public key and then apply a sed on the log.

I would like to know if there's a simpler or a better way to have ssh log which user's key was used to authenticate on the server ?

1 Answer 1


sshd never sees which key filename is used by the client, so postprocessing cannot be avoided.

  • I guess I'll have to manage ssh auth. via ldap and/or local account, then.
    – Coren
    Apr 3, 2012 at 16:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .