Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Auditing some servers, I need a list of the comments on all the authorised keys in the authorized_keys file.

How can I cut this file to display a list of comments, eg user@host?

Anything can appear before the Key, including spaces

The Key Comment appears directly after the key

The Key Comment is the last item in the line

The Key Comment can contain spaces

The Key is the longest field on each line

It is desired that the key comment only is extracted from each line.

share|improve this question
up vote 1 down vote accepted

Updated to include /^==/ lines:

perl -nE 'if (/^==/) { print }
          elsif (!/^#/ and ($c) = /\b\w+\s+AAAA\S+(.*)$/)
            { $c =~ s/^\s+//; say $c || "<no comment>" }'

GNU sed (using POSIX Extended regexen):

sed -nr '/^==/{p; d}; /^#/d;
         /.*\<\w+\s+AAAA\S+/{s///; s/^\s+//; s/^$/<no comment>/; p}'

This will skip disabled (commented out) keys, and [mostly] correctly handle lines containing per-key options (e.g. from="" ssh-rsa AAAAB3NzaC1yc2EA my comment).

Note that comments are practically meaningless – comparing the key fingerprints might be better in some cases.

share|improve this answer
I don't always have Perl available, unfortunately. – Rory Jun 19 '12 at 13:38
@Blazemore: Do you have sed?` The regex grawity gave is a good starting point. Taking into account that sed doesn't offer PCRE, and taking a few shortcuts, I came up with sed -e s/^#.*// -e s/.*AAAA[^\ ]+// -e s/^\ +// ~/.ssh/authorized_keys. – DevSolar Jun 19 '12 at 14:14
Doesn't work on my system, just prints every line in full – Rory Jun 19 '12 at 15:04
@Blazemore: If your display breaks at the same place as mine, note that there is a space after AAAA[^\. You might want to study regular expressions, they are mightily helpful. – DevSolar Jun 19 '12 at 15:26
@Blazemore: Are you doing the audit remotely (connected from another machine)? You could do ssh targethost cat .ssh/authorized_keys | perl ... – grawity Jun 19 '12 at 17:37

How can I cut...


cut -d' ' -f3- .ssh/authorized_keys

share|improve this answer
This relies on keys being in a very specific format. If the comment part isn't the exact correct field, it fails. – Rory Jun 19 '12 at 13:39
@Blazemore: I admit I was ignorant of the specialities that grawity hinted at. Ignore my answer if it does not float your boat, this works only for "off the mill" authorized_keys. – DevSolar Jun 19 '12 at 14:00
@DevSolar you could self-delete the answer. Though it is a good general purpose answer that would work well for most people needing a similar answer. And simplicity makes it easier to understand. – killermist Jun 22 '12 at 3:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .