Determine w/c ssh public key was used to login
-
Generate fingerprint per key
while read l; do [[ -n $l && ${l###} = $l ]] && ssh-keygen -l -f /dev/stdin <<<$l; done < .ssh/authorized_keys -
Match fingerprint on /var/log/secure
AUTHORIZED_FP=`while read l; do [[ -n $l && ${l###} = $l ]] && ssh-keygen -l -f /dev/stdin <<<$l; done < /home/centos/.ssh/authorized_keys 2>/dev/null | grep RSA` sudo cat /var/log/secure |grep "Accepted publickey" | while read line; do AUDIT_MESSAGE=`echo $line | awk -F" " '{print $1 " " $2 " " $3 " from " $11 " FP: " $16}'` AUDIT_FP=`echo $AUDIT_MESSAGE | awk -F" " '{print $7}'` #echo "$AUDIT_FP" MATCHED=`printf "$AUTHORIZED_FP" | grep -n $AUDIT_FP` if [[ "$?" == "0" ]]; then KEY_LINE=`echo $MATCHED | awk -F":" '{print $1}'` KEY_USER=`echo $MATCHED | awk -F" " '{print $3}'` #echo $KEY_USER` echo "$AUDIT_MESSAGE User: $KEY_LINE $KEY_USER" fi done
No comment
Say something
Thank you
Your post has been submitted and will be published once it has been approved.
OK
OOPS!
Your post has not been submitted. Please return to the page and try again. Thank You!
If this error persists, please open an issue by clicking here.
OK