I have several sysadmin laptops and a cluster of servers. I am administering / rotating ssh keys on the servers from a script (call it rotate_keys.sh
) that will run on any of the sysadmin laptops.
I have established the rule that each server will retain at most 1 (the latest) ssh key of a given sysadmin laptop.
The ssh keys are stored in the file authorized_keys
that takes the form:
key1 user@device1-hostname
key2 user@device2-hostname
key3 user@device3-hostname
Each server has a script (call it update_keys.sh
) that upon execution via ssh, will remove all keys associated with the machine that is currently connected to it. I (attempt to) do this by removing all lines that contain the hostname of a given client.
sed -i "/$client_hostname/d" authorized_keys
On the server, I grab the hostname of the client by doing a reverse dns lookup on the ip address from the environment variable $SSH_CONNECTION
(which is set at the beginning of the ssh session).
client_ip=$(echo $SSH_CONNECTION | awk '{print $1}')
client_hostname=$(nslookup $client_ip \
| tail -2 \
| head -1 \
| awk '{print $4}')
This returns a hostname in the format:
device-hostname.router-hostname.
For a lack of a better term, it gives me a "fully qualified hostname".
However, the hostnames in the authorized_keys
omits the hostname of the router (subnet) that these devices are connected to. They simply appear as:
device-hostname
So, when I perform the following delete command, nothing matches.
sed -i "/$client_hostname/d" authorized_keys
Is there a way to either force the ssh daemon to record "fully qualified" hostnames. Or is there a tool for dns lookup that will only give me the name of the device, minus the hostnames of the routers its connected to?
I'd rather one of the above two approaches than disabling reverse dns in the ssh daemon (on the servers) because that would require that my sysadmin laptops have static ips.
cut -d . -f1
after yourawk
will do that.authorized_keys
the full name isn't there only because I am on the same network. But, once i take the sysadmin machines off the same network as the clusters, i'd get fully qualified namessuch as hostname.example.com. So I wan't ssh daemon to always used fully qualified if possible toauthorized_keys