2

Say, I was reviewing my log files and noticed that someone with certain public key tried to connect to my server and got access denied (because his public key is not in my authorized_keys file).

May I somehow gather more information about user/host with this associated public keys? For example, this key may be attached to Github profile and I can filter Github users by public keys and find the one that used to attempt to login into my server?

Thanks!

3

Yes, you can, if the user sends a public key. You can use a tweaked SSH server to grab the public key, and check it against whatever database or API you like. Problem is, you probably be able to use this as a real SSH server, so you'll probably want to move your real service to a different port.

Even if the key isn't available through some API to identify the user, the comment after the key may contain clues (e.g. skiddie@l337machin3). Edit: actually, I doubt that this field is sent to the server at all, but I'd have to check. In that case, this can be ignored.

Also, unless the attacker is unskilled, I doubt they would be using their personal keys for attacking random hosts.

| improve this answer | |
  • Dat 1337... That's interesting, thanks for sharing! Do you know any other widely used services which I can enumerate for public key? – Nikita Shchypyplov May 23 at 16:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.