How to get the email of the logged in user when login occurs through SSH keys?

Question

I’m using bash shell and Ubuntu 18.04. I SSH into the server using a fairly standard RSA public-private key set up, where I put my public key in the .ssh/authorized_keys file of the server, entry looking like this

ssh-rsa AAAAB…KKRaniLSv8mHQ== [email protected]

Is it possible, after login, to write a script or command that would tell me the email of my logged in account? In the above case, I would want the script to output [email protected].

Edit: I don't have sudo privileges for the logged in user in question.

Answer 1

My thought would be to

• have linux auditing enabled, giving you a /var/log/audit/audit.log file
  • you may have to add rules in /etc/audit/audit.rules to capture the event otherwise...
  • tail -f /var/log/audit/audit.log to see the ssh login event captured when it happens.
• so after login, whenever in the future, look back through audit.log looking for those events, and it will contain the userid of the user, which is mapped in /etc/passwd
  • the raw audit.log will have timestamp format in epoch time, so you'll have to convert that to human mm/dd/yy hh:mm:ss format; various ways to do this if you need timestamps.
• then take first & last name out of the corresponding username row in /etc/passwd and make [email protected] from it.

And /var/log/secure might work for you as well.

Answer 2

I don't think you can capture the string at the end of the public key entry in authorized_keys however you can make it so that logging in with a specific ssh key triggers a custom script.

A really trivial proof of concept is to add command="..." before the key:

command="echo [email protected] ; exec /bin/bash" ssh-rsa AAAAB…KKRaniLSv8mHQ== [email protected]

---

The above isn't very robust for two reasons:

• It stops the user executing their own command: ssh [email protected] some-command wouldn't work as expected
• The user shell might not be /bin/bash.

---

To fix the above problems create a script to use as a command:

#!/bin/bash
# Echo the email address
echo $1

if [[ -z $SSH_ORIGINAL_COMMAND ]] ; then
    # If the user is trying to execute a regular shell then find which shell
    exec $(getent passwd $(whoami) | awk -F: '{print $NF}')
else:
    # If the user is trying to execute another command then run that command
    exec $SSH_ORIGINAL_COMMAND
fi

1. Save this somewhere appropriate like /home/username/.print_login_email.sh
2. Make it executable with chmod: chmod u+x /home/username/.print_login_email.sh
3. Add it to your authorized_keys entries:

command="/home/username/.print_login_email.sh [email protected]" ssh-rsa AAAAB…KKRaniLSv8mHQ== [email protected]

Safer alternative

You could even do it without the command="..."-Invocation but with an Environment-Variable which get's checked in ~/.profile or ~/.zshenv

~/.ssh/authorized_keys

environment="SSH_USER=PUBKEYFROMJOEDOE1" ssh-rsa AAAAAB3Ny...
environment="SSH_USER=PUBKEYFROMJOEDOE2" ssh-rsa AAAAAB3Nz...

~/.zshenv | ~/.profile

if [ -n "$SSH_USER" ]; then
  logger -ip auth.notice -t sshd "Accepted publickey for $SSH_USER"
  #This Part if ZSH-Specific
  export HISTFILE="$HOME/.zsh_$SSH_USER_history"
  if [ "$SSH_USER" != "DONTSENDMAILUSER" ]; then
    echo "User $SSH_USER has logged in on Hostname" | NULLMAILER_NAME="HOSTNAME LOGIN" mail -s "Notice from SSH-Login" [email protected]
  fi
fi

I usually have that Script in /etc/zsh/zshenv - ~crpb