Reverse DNS lookup to match hostname in authorized_keys

Question

I have several sysadmin laptops and a cluster of servers. I am administering / rotating ssh keys on the servers from a script (call it rotate_keys.sh) that will run on any of the sysadmin laptops.

I have established the rule that each server will retain at most 1 (the latest) ssh key of a given sysadmin laptop.

The ssh keys are stored in the file authorized_keys that takes the form:

key1 user@device1-hostname
key2 user@device2-hostname
key3 user@device3-hostname

Each server has a script (call it update_keys.sh) that upon execution via ssh, will remove all keys associated with the machine that is currently connected to it. I (attempt to) do this by removing all lines that contain the hostname of a given client.

sed -i "/$client_hostname/d" authorized_keys

On the server, I grab the hostname of the client by doing a reverse dns lookup on the ip address from the environment variable $SSH_CONNECTION (which is set at the beginning of the ssh session).

client_ip=$(echo $SSH_CONNECTION | awk '{print $1}')
client_hostname=$(nslookup $client_ip \
                | tail -2 \
                | head -1 \
                | awk '{print $4}')

This returns a hostname in the format:

device-hostname.router-hostname.

For a lack of a better term, it gives me a "fully qualified hostname".

However, the hostnames in the authorized_keys omits the hostname of the router (subnet) that these devices are connected to. They simply appear as:

device-hostname

So, when I perform the following delete command, nothing matches.

sed -i "/$client_hostname/d" authorized_keys

Is there a way to either force the ssh daemon to record "fully qualified" hostnames. Or is there a tool for dns lookup that will only give me the name of the device, minus the hostnames of the routers its connected to?

I'd rather one of the above two approaches than disabling reverse dns in the ssh daemon (on the servers) because that would require that my sysadmin laptops have static ips.

Answer 1

Try the following awk command:

nslookup $client_ip | awk '/name =/ { split($4,add,".") } END { print add[1]}'

This will run the nslookup command, look for all lines with names = and then split the 4th space delimited space field with . putting the results in the array add. We then print the first element of the array to reveal the hostname for the last entry found.