It's for convenience, from the ssh-keygen
man page on Debian:
For RSA1 keys, there is also a comment field in the key file that is
only for convenience to the user to
help identify
the key. The comment can tell what the key is for, or whatever is
useful. The comment is initialized to
“user@host”
when the key is created, but can be changed using the -c option.
I think the nearest you're going to get for determining which key was used to log in is with ssh-add
, with -L, from the man page:
-L Lists public key parameters of all identities currently represented by the agent.
You can increase the logging level of the ssh daemon to DEBUG1:
LogLevel DEBUG1
And the log will show the RSA fingerprint of the SSH key used to log in:
Aug 13 08:52:56 ubuntu_test sshd[17115]: debug1: matching key found: file /home/username/.ssh/authorized_keys, line 1
Aug 13 08:52:56 ubuntu_test sshd[17115]: Found matching RSA key: xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx
You can get the fingerprint of a key with ssh-keygen
:
-l Show fingerprint of specified public key file. Private RSA1 keys are also supported. For RSA
and DSA keys ssh-keygen tries to find the matching public key file and prints its fingerprint.
If combined with -v, an ASCII art representation of the key is supplied with the fingerprint.
From an authorized keys file, you would have to split up each line into a new file to read with ssh-keygen -l
. Here's an example Ruby script that will do this:
#!/usr/bin/env ruby
File.open("/home/username/.ssh/authorized_keys").each do |l|
file_name = l.split(" ")[2]
key_file = File.new("#{file_name}.pub_key", "w")
key_file.puts l
key_file.close
puts %x{ssh-keygen -l -f #{file_name}.pub_key}
end