I don't think you can capture the string at the end of the public key entry in authorized_keys
however you can make it so that logging in with a specific ssh key triggers a custom script.
A really trivial proof of concept is to add command="..."
before the key:
command="echo [email protected] ; exec /bin/bash" ssh-rsa AAAAB…KKRaniLSv8mHQ== [email protected]
The above isn't very robust for two reasons:
- It stops the user executing their own command:
ssh [email protected] some-command
wouldn't work as expected
- The user shell might not be
/bin/bash
.
To fix the above problems create a script to use as a command:
#!/bin/bash
# Echo the email address
echo $1
if [[ -z $SSH_ORIGINAL_COMMAND ]] ; then
# If the user is trying to execute a regular shell then find which shell
exec $(getent passwd $(whoami) | awk -F: '{print $NF}')
else:
# If the user is trying to execute another command then run that command
exec $SSH_ORIGINAL_COMMAND
fi
- Save this somewhere appropriate like
/home/username/.print_login_email.sh
- Make it executable with chmod:
chmod u+x /home/username/.print_login_email.sh
- Add it to your
authorized_keys
entries:
command="/home/username/.print_login_email.sh [email protected]" ssh-rsa AAAAB…KKRaniLSv8mHQ== [email protected]
Safer alternative
You could even do it without the command="..."-Invocation but with an Environment-Variable which get's checked in ~/.profile or ~/.zshenv
~/.ssh/authorized_keys
environment="SSH_USER=PUBKEYFROMJOEDOE1" ssh-rsa AAAAAB3Ny...
environment="SSH_USER=PUBKEYFROMJOEDOE2" ssh-rsa AAAAAB3Nz...
~/.zshenv
| ~/.profile
if [ -n "$SSH_USER" ]; then
logger -ip auth.notice -t sshd "Accepted publickey for $SSH_USER"
#This Part if ZSH-Specific
export HISTFILE="$HOME/.zsh_$SSH_USER_history"
if [ "$SSH_USER" != "DONTSENDMAILUSER" ]; then
echo "User $SSH_USER has logged in on Hostname" | NULLMAILER_NAME="HOSTNAME LOGIN" mail -s "Notice from SSH-Login" [email protected]
fi
fi
I usually have that Script in /etc/zsh/zshenv - ~crpb
/etc/pam.d
, but I can't guarantee (I simply don't know it well enough) that you won't have to write a new module.userid
is not related to any of my email addresses.