Is it possible, from the server side to retrieve data used in the key authentication after this is completed? For example, from a pam module, to get the public key used, the challenge used (if it was successful).

Using openssh in Debian 9.

  • This would be a serious security hole, if it existed. – harrymc Dec 4 '18 at 15:57
  • Sorry, I explained myself badly. I edited the question. I mean, getting those information from the server side, like in a pam module called after successful key authentication – Federico Taschin Dec 4 '18 at 16:07

You will find interesting the following Stack Exchange article:
Can I find out which ssh key was used to access an account?

The idea there is to get the information from the logs by setting in /etc/ssh/sshd_config the value of LogLevel to VERBOSE.

You might find especially useful the script in the answer by F. Hauri where is script is created that is to be added to /etc/bash.bashrc or user's .bashrc, that after login from SSH will create the following environmental variables:

set | grep ^SSH
SSH_CLIENT=' 43734 22'
SSH_CONNECTION=' 43734 22'

The script itself is reproduced below, but I recommend reading the original answer for more information:

umask 077
ssh_tempdir=$(mktemp -d /tmp/ssh-id-XXXXXXX)
cd $ssh_tempdir || exit 1

    sed -ne "/sshd.\($(($(ps ho ppid $PPID)))\|$PPID\).:.*\(Accepted publickey\|matching .SA key\)/{s/^.* //g;h};\${x;p}" /var/log/sshdusers.log
for ((ssh_i=1;ssh_i<=$(wc -l <$HOME/.ssh/authorized_keys);ssh_i++));do
    export ssh_line="$(sed -ne ${ssh_i}p <$HOME/.ssh/authorized_keys)"
    echo "$ssh_line" >tempKey
    export ssh_lFp=($(ssh-keygen -l -f tempKey))
    if [ "${ssh_lFp[1]}" == "$ssh_crtFp" ] ;then
        export SSH_KEY_USER=${ssh_line##* }

rm -fR $ssh_tempdir
umask $ssh_oUmask
unset ssh_lFp ssh_line ssh_i ssh_crtFp ssh_tempdir ssh_oUmask ssh_oPwd

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.