2

Ubuntu 14.04: Using the auth.log im able to see: accepted publickey for $user from 192.168.xx.xx port xxxxx ssh2: RSA xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx

Using that RSA Key how do i know which public key it is in /home/$user/.ssh/authorized_keys

/home/$user/.ssh/authorized_keys are not in hexadecimal format which is what im guessing the RSA key format is in auth.log???

  • 1
    I believe the auth.log only shows the key fingerprint, not the key itself. – DopeGhoti Dec 11 '17 at 19:09
2

As pointed out in the comments, the auth.log entries show the public key fingerprint and not the key itself.

You can compare the fingerprints in the auth.log file with the fingerprint of the keys listed in ~/.ssh/authorized_keys by using the ssh-keygen -E -lf command.

The -E option allows you to set the hash as either MD5 or SHA256. The -lf option shows the fingerprint of a public key file. The colon separated hash is the MD5 form.

You can copy the public keys from the ~/.ssh/authorized_keys file and store the them in individual text files. From there, it's easy to get the hashes of each public key.

ssh-keygen -E MD5 -lf pkey.txt

The public key is the entire line starting with ssh- and ending with the key identifier.

  • The copy to pkey.txt isn't strictly necessary, since the command doesn't alter the file? – xenoid Aug 10 '18 at 9:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.