3

i've created ssh key for connecting two host (client 192.168.4.107 and server 192.168.4.106). on client-machine i've run this command and ssh connection works:

ssh-keygen
ssh-copy-id -i /root/.ssh/id_rsa.pub oracle@192.168.4.106

ssh-keygen -lf /root/.ssh/id_rsa.pub -E md5
MD5:9a:3d:f7:c9:38:91:41:c7:8e:ca:a0:75:a2:51:b5:fm
ssh-keygen -lf /root/.ssh/id_rsa.pub -E sha256
2048 SHA256:9V6hDnLdq7heMYT2S54AHamAo9Bi8eQVa5oNa1dyHuo

On the server i'have enable auditing system and when i run the report (aureport -i) i receive a message like this:

type=CRYPTO_KEY_USER msg=audit(19/02/2019 12:35:42.590:1145) : pid=12444 uid=root auid=unset ses=unset subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=SHA256:8a:99:38:f8:db:fd:02:52:76:ce:f8:c5:9a:ef:ef:47:98:23:fb:49:bf:c6:4b:de:e3:76:08:9c:f7:33:01:16 direction=? spid=12444 suid=root  exe=/usr/sbin/sshd hostname=? addr=? terminal=? res=success'

purpose of activity is detect users login with audit system thanks ssh keys, the problem is that the two fingerprint key don't match (tracking ip is doesn't work, i work on cloud and ip is public and always the same for all users).

format of fingerprint key on SHA256 is realy different from Fp inside the audit.log file, in wich format is write fp key ? where i wrong ? thanks!

  • The fingerprints probably do match, but you have them in two different formats. – Kusalananda Feb 20 at 9:07
  • appear that MD5 is very similar to fp inside alert log, but is explain that format is SHA256 and the key don't match @Kusalananda – Francisco Sour Feb 20 at 9:13
  • The SHA256 keys may still be the same, but the format that is used differ. You just have find a way of getting either fingerprint in the other format. I'm not by a computer ATM, so I can't look this up right now. Also, the MD5 fingerprint is irrelevant. – Kusalananda Feb 20 at 9:18
  • are you sure this is not server key ? not user ? – Archemar Feb 20 at 14:30
  • I am not familiar with audit tools, however by looking at /var/log/messages, I manage to retreive my sha256 fingerprint. – Archemar Feb 20 at 14:34
2

I explain my solution for detect activity change of users in a server on cloud. with the requirments below:

  • client have private key with fingerprint in SHA256 x.x.x.x.x and is enable ssh connection.
  • on the server is enable auditing system.
  • is enable watch rules for specify folder, example /home/oracle/

for detect file modified, i follow the following steps, below an example:

ausearch -f
------------
20/02/2019 16:37:00 /home/oracle/.bash_history 2 yes /usr/bin/bash 54321 770

770 is the number of event, thanks it i can find the session number:

ausearch -p | grep 770
----------------------
type=SYSCALL msg=audit(20/02/2019 16:37:00.868:770) : arch=x86_64 syscall=open 
success=yes exit=3 a0=0x10bd080 a1=O_WRONLY|O_APPEND a2=0x180 a3=0x0 items=1 
ppid=8649 pid=8650 auid=oracle uid=oracle gid=oinstall euid=oracle suid=oracle 
fsuid=oracle egid=oinstall sgid=oinstall fsgid=oinstall tty=pts1 ses=58 
comm=bash exe=/usr/bin/bash subj=unconfined_u:unconfined_r:unconfined_t:s0- 
s0:c0.c1023 key=modifica_fil

session number is 58, thanks it i can find pid of login session

ausearch -i | grep  ses=58
---------------------------
type=LOGIN msg=audit(20/02/2019 16:34:37.366:747) : pid=8646 uid=root 
subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 old-auid=unset auid=oracle tty= 
(none) old-ses=4294967295 ses=58 res=yes 

pid of login is 8646, i can look finger print key used from a specified user in var/log/secure

cat secure | grep 8646
----------------------
sshd[8646]: Accepted publickey for oracle from 192.168.4.107 port 58892 ssh2: 
RSA SHA256:x.x.x.x.x

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.