1

As I understand sshd (openssh in my case) typically does/may log the fingerprint/hash of the public key of incoming connections which are attempting to authenticate via key.

What I'm looking for is the full public key of incoming connections, specifically failed logins. Is that possible?

If so, how?

Improve this question
4
  • You would have the public key if the user/public key was known. If they are not, you would not. That's the case I'm interested in.
    – Catskul
    Dec 4, 2018 at 21:31
  • This is incorrect. I can definitively say that the ssh server does receive the public key of clients making incoming connections even in the case of unknown keys. I know because I managed to edit the openssh source code to print it out.
    – Catskul
    Dec 4, 2018 at 21:46
  • In my case the user is authenticating via keys. I'll clarify my question to include that detail.
    – Catskul
    Dec 4, 2018 at 21:54
  • Let us continue this discussion in chat.
    – Peschke
    Dec 4, 2018 at 22:39

2 Answers 2

Reset to default
3

Apparently this is not a current feature of openssh.

For my own sake, I wrote the feature, and it can be found here:

https://github.com/catskul/openssh-portable/tree/print-public-key

diff --git a/auth2-pubkey.c b/auth2-pubkey.c
index 2fb5950..82cce57 100644
--- a/auth2-pubkey.c
+++ b/auth2-pubkey.c
@@ -122,6 +122,17 @@ userauth_pubkey(struct ssh *ssh)
                    "(received %d, expected %d)", __func__, key->type, pktype);
                goto done;
        }
+       if (log_level_get() >= SYSLOG_LEVEL_DEBUG1) {
+               if ((b = sshbuf_new()) == NULL)
+                       fatal("%s: sshbuf_new failed", __func__);
+               if ((r = sshkey_format_text(key, b)) != 0)
+                       fatal("%s: sshkey_format_text failed: %s", __func__,
+                               ssh_err(r));
+               debug("%s: public key of %s: %s", __func__, authctxt->user,
+                       sshbuf_ptr(b));
+               sshbuf_free(b);
+               b = NULL;
+       }
        if (sshkey_type_plain(key->type) == KEY_RSA &&
            (ssh->compat & SSH_BUG_RSASIGMD5) != 0) {
                logit("Refusing RSA key because client uses unsafe "
Improve this answer
1

OpenSSH 8.9 (and probably others lower and higher) will display the public key when run with LogLevel DEBUG2 in /etc/ssh/sshd_config.

But: OpenSSH limits the length of its log lines to 500 characters silently, so you need to patch it in most cases to get the full key.

The patch I used with my installation on Ubuntu is below:

diff --git a/log.c b/log.c
index bdc4b6515..09474e23a 100644
--- a/log.c
+++ b/log.c
@@ -325,7 +325,7 @@ log_redirect_stderr_to(const char *logfile)
    log_stderr_fd = fd;
 }
 
-#define MSGBUFSIZ 1024
+#define MSGBUFSIZ 8192
 
 void
 set_log_handler(log_handler_fn *handler, void *ctx)
@@ -417,7 +417,7 @@ do_log(LogLevel level, int force, const char *suffix, const char *fmt,
        closelog_r(&sdata);
 #else
        openlog(progname, LOG_PID, log_facility);
-       syslog(pri, "%.500s", fmtbuf);
+       syslog(pri, "%.8192s", fmtbuf);
        closelog();
 #endif
    }
--

The giveaway if you're seeing the full lines is whether the log line - which starts with debug2: userauth_pubkey: valid user someusername querying public key (where someusername is the authenticating user) ends with the string [preauth]. ECC-DSA keys are probably short enough to fit, but RSA keys definitely aren't.

Improve this answer
1
  • 1
    Funny enough this came full circle. That feature came out of my original question! I submitted that original implementation someone else re-wrote it to fit better and merged it in: bugzilla.mindrot.org/show_bug.cgi?id=2939#c1 : )
    – Catskul
    Aug 4, 2022 at 1:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .