I use a classical pair of private/public key in order to connect into servers.

For now, we have one dedicated account, let's say foo, which is used by multiple users, each with their own pairs of public/private keys.

I am looking for a way to log which user authenticated on this foo account.

For now, I manage to found that if I raise LogLevel to VERBOSE in /etc/ssh/sshd_config, ssh log the fingerprint of the public key in /var/log/auth.log.

It looks like this :

Apr  2 18:33:15 xxx-yy sshd[32064]: Connection from A.B.C.D port 43286
Apr  2 18:33:15 xxx-yy sshd[32064]: Found matching RSA key: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX
Apr  2 18:33:15 xxx-yy sshd[32064]: Accepted publickey for foo from A.B.C.D port 43286 ssh2

I then manage to get fingerprint of each users with a call to ssh-keygen -lf key.pub on their public key and then apply a sed on the log.

I would like to know if there's a simpler or a better way to have ssh log which user's key was used to authenticate on the server ?


sshd never sees which key filename is used by the client, so postprocessing cannot be avoided.

  • I guess I'll have to manage ssh auth. via ldap and/or local account, then. – Coren Apr 3 '12 at 16:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.