1

I’m using bash shell and Ubuntu 18.04. I SSH into the server using a fairly standard RSA public-private key set up, where I put my public key in the .ssh/authorized_keys file of the server, entry looking like this

ssh-rsa AAAAB…KKRaniLSv8mHQ== first.last@example.com

Is it possible, after login, to write a script or command that would tell me the email of my logged in account? In the above case, I would want the script to output first.last@example.com.

Edit: I don't have sudo privileges for the logged in user in question.

4
  • My thought would be to do this through PAM. You can do a lot with the existing modules, simply by manipulating the configuration in /etc/pam.d, but I can't guarantee (I simply don't know it well enough) that you won't have to write a new module. Jan 18 at 18:42
  • 3
    The email at the end of the line is actually a free-form field and is not necessarily an accurate address or even an address. Don't count on using it for any production processes.
    – doneal24
    Jan 18 at 18:57
  • Logically invalid. On most of the systems I login to, my userid is not related to any of my email addresses.
    – waltinator
    Jan 18 at 20:37
  • @doneal24: That was mi first though too, but it seems OP has something in place to make sure there's an email there.(Reminds that I've got to train my colleagues, users created by someone else that me might not have an email there.) Jan 19 at 8:43

2 Answers 2

0

My thought would be to

  • have linux auditing enabled, giving you a /var/log/audit/audit.log file
    • you may have to add rules in /etc/audit/audit.rules to capture the event otherwise...
    • tail -f /var/log/audit/audit.log to see the ssh login event captured when it happens.
  • so after login, whenever in the future, look back through audit.log looking for those events, and it will contain the userid of the user, which is mapped in /etc/passwd
    • the raw audit.log will have timestamp format in epoch time, so you'll have to convert that to human mm/dd/yy hh:mm:ss format; various ways to do this if you need timestamps.
  • then take first & last name out of the corresponding username row in /etc/passwd and make first.last@myco.com from it.

And /var/log/secure might work for you as well.

5
  • I was kind of hoping to write some kind of script, whois_loggedin_email.sh, to get the current user without needing sudo privileges. I think the files you mention require sudo, is that right?
    – Dave
    Jan 18 at 18:28
  • yes, /var/log/secure and /var/log/audit/audit.log are readable only by root
    – ron
    Jan 18 at 18:31
  • and i'm not sure after re-reading your question if i understand what you're actually asking.... tell me the email of my logged in account?
    – ron
    Jan 18 at 18:33
  • for anyone currently logged in, you can see that info by doing who or finger which any user can do, if that helps. You might like the output from finger if I think I understand what you are asking.... finger-0.17-52.el7.x86_64 available from base rhel distribution but you have to yum install it.
    – ron
    Jan 18 at 18:41
  • We don't have finger installed, but who only tells the username (at least on our system). To answer your earlier question, "tell me the email of my logged in account? " -- yes that's what I want, specficially the email that appears in that authorized_keys file.
    – Dave
    Jan 18 at 18:45
0

I don't think you can capture the string at the end of the public key entry in authorized_keys however you can make it so that logging in with a specific ssh key triggers a custom script.

A really trivial proof of concept is to add command="..." before the key:

command="echo first.last@example.com ; exec /bin/bash" ssh-rsa AAAAB…KKRaniLSv8mHQ== first.last@example.com

The above isn't very robust for two reasons:

  • It stops the user executing their own command: ssh foo@example.com some-command wouldn't work as expected
  • The user shell might not be /bin/bash.

To fix the above problems create a script to use as a command:

#!/bin/bash
# Echo the email address
echo $1

if [[ -z $SSH_ORIGINAL_COMMAND ]] ; then
    # If the user is trying to execute a regular shell then find which shell
    exec $(getent passwd $(whoami) | awk -F: '{print $NF}')
else:
    # If the user is trying to execute another command then run that command
    exec $SSH_ORIGINAL_COMMAND
fi
  1. Save this somewhere appropriate like /home/username/.print_login_email.sh
  2. Make it executable with chmod: chmod u+x /home/username/.print_login_email.sh
  3. Add it to your authorized_keys entries:
command="/home/username/.print_login_email.sh first.last@example.com" ssh-rsa AAAAB…KKRaniLSv8mHQ== first.last@example.com

Safer alternative

You could even do it without the command="..."-Invocation but with an Environment-Variable which get's checked in ~/.profile or ~/.zshenv

~/.ssh/authorized_keys

environment="SSH_USER=PUBKEYFROMJOEDOE1" ssh-rsa AAAAAB3Ny...
environment="SSH_USER=PUBKEYFROMJOEDOE2" ssh-rsa AAAAAB3Nz...

~/.zshenv | ~/.profile

if [ -n "$SSH_USER" ]; then
  logger -ip auth.notice -t sshd "Accepted publickey for $SSH_USER"
  #This Part if ZSH-Specific
  export HISTFILE="$HOME/.zsh_$SSH_USER_history"
  if [ "$SSH_USER" != "DONTSENDMAILUSER" ]; then
    echo "User $SSH_USER has logged in on Hostname" | NULLMAILER_NAME="HOSTNAME LOGIN" mail -s "Notice from SSH-Login" email@address.tld
  fi
fi

I usually have that Script in /etc/zsh/zshenv - ~crpb

6
  • Couple of problems. First, the user has complete control over ~/.ssh/authorized_keys so you can't enforce any changes. Second, using your example of first.last@example.com will break horribly with my surname, which contains an apostrophe. Email addresses can include apostrophe's although a lot of systems really don't like them. Passing them into shell scripts is a recipe for pain.
    – doneal24
    Jan 26 at 2:51
  • @doneal24 That's much more a problem with the question than a problem with this answer. Any user can modify their authorised keys file (by default) and they are not required to enter a valid email address when they add keys. And special characters can be escaped with \\\ Jan 26 at 10:04
  • @doneal24 However if you wanted to force the matter you could use AuthorizedKeysCommand in /etc/ssh/sshd_conf to add the "command=" to every line of the script. You could also use python instead of bash to avoid tricky problems with special characters. Jan 26 at 10:04
  • @Philip Couling, so I understand your solution, you would have to add this "command" before each entry in the authorized_keys file?
    – Dave
    Jan 26 at 20:13
  • @Dave that's what I'm suggesting. yes. As I mentioned to doneal24, you might like to investigate AuthorizedKeysCommand to dynamically generate the authorized_keys and take some control away from the user. It's unclear from your question if you want or need that. Jan 26 at 22:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.