Possible to get sshd (openssh) to log the public key of failed key based login attempts?

Question

As I understand sshd (openssh in my case) typically does/may log the fingerprint/hash of the public key of incoming connections which are attempting to authenticate via key.

What I'm looking for is the full public key of incoming connections, specifically failed logins. Is that possible?

If so, how?

Answer 1

You can set the log level to VERBOSE or higher (DEBUG3) in the sshd_config file.

e.g.: LogLevel DEBUG3

This will log hashes (for my Cent-OS setup) of the offered keys to /var/log/secure

Answer 2

Apparently this is not a current feature of openssh.

For my own sake, I wrote the feature, and it can be found here:

https://github.com/catskul/openssh-portable/tree/print-public-key

diff --git a/auth2-pubkey.c b/auth2-pubkey.c
index 2fb5950..82cce57 100644
--- a/auth2-pubkey.c
+++ b/auth2-pubkey.c
@@ -122,6 +122,17 @@ userauth_pubkey(struct ssh *ssh)
                    "(received %d, expected %d)", __func__, key->type, pktype);
                goto done;
        }
+       if (log_level_get() >= SYSLOG_LEVEL_DEBUG1) {
+               if ((b = sshbuf_new()) == NULL)
+                       fatal("%s: sshbuf_new failed", __func__);
+               if ((r = sshkey_format_text(key, b)) != 0)
+                       fatal("%s: sshkey_format_text failed: %s", __func__,
+                               ssh_err(r));
+               debug("%s: public key of %s: %s", __func__, authctxt->user,
+                       sshbuf_ptr(b));
+               sshbuf_free(b);
+               b = NULL;
+       }
        if (sshkey_type_plain(key->type) == KEY_RSA &&
            (ssh->compat & SSH_BUG_RSASIGMD5) != 0) {
                logit("Refusing RSA key because client uses unsafe "