1

As I understand sshd (openssh in my case) typically does/may log the fingerprint/hash of the public key of incoming connections which are attempting to authenticate via key.

What I'm looking for is the full public key of incoming connections, specifically failed logins. Is that possible?

If so, how?

0

You can set the log level to VERBOSE or higher (DEBUG3) in the sshd_config file.

e.g.: LogLevel DEBUG3

This will log hashes (for my Cent-OS setup) of the offered keys to /var/log/secure

  • 1
    OP wants the full public key, not a hash of it. – AndrolGenhald Dec 4 '18 at 20:22
0

Apparently this is not a current feature of openssh.

For my own sake, I wrote the feature, and it can be found here:

https://github.com/catskul/openssh-portable/tree/print-public-key

diff --git a/auth2-pubkey.c b/auth2-pubkey.c
index 2fb5950..82cce57 100644
--- a/auth2-pubkey.c
+++ b/auth2-pubkey.c
@@ -122,6 +122,17 @@ userauth_pubkey(struct ssh *ssh)
                    "(received %d, expected %d)", __func__, key->type, pktype);
                goto done;
        }
+       if (log_level_get() >= SYSLOG_LEVEL_DEBUG1) {
+               if ((b = sshbuf_new()) == NULL)
+                       fatal("%s: sshbuf_new failed", __func__);
+               if ((r = sshkey_format_text(key, b)) != 0)
+                       fatal("%s: sshkey_format_text failed: %s", __func__,
+                               ssh_err(r));
+               debug("%s: public key of %s: %s", __func__, authctxt->user,
+                       sshbuf_ptr(b));
+               sshbuf_free(b);
+               b = NULL;
+       }
        if (sshkey_type_plain(key->type) == KEY_RSA &&
            (ssh->compat & SSH_BUG_RSASIGMD5) != 0) {
                logit("Refusing RSA key because client uses unsafe "

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.