Debian Bug report logs - #111598
sshd should log information about which key was used for login

Toggle useless messages

Message #5 received at maintonly@bugs.debian.org (full text, mbox, reply):

From: Sam Vilain <sam@vilain.net>

To: Debian Bug Tracking System <maintonly@bugs.debian.org>

Subject: sshd should log information about which key was used for login

Date: Fri, 07 Sep 2001 16:55:49 +0100

Package: ssh
Version: 1:2.5.2p2-3
Severity: wishlist

It would be nice if ssh was to log the fingerprint of the key used to
log in, or perhaps the comment of the key.

I use purely RSA autentication to log in to servers directly as root
(and set allowrootlogin: no-password), but it would be nice if it
didn't generate the alarming looking "Accepted rsa for ROOT from...".
If the comment for that key was, eg "sam@vilain.net", then the message
could be something like "root login by sam@vilain.net from ..."

Sound sensible?

Cheers,
Sam.

-- System Information
Debian Release: testing/unstable
Architecture: i386
Kernel: Linux hoffman 2.4.9 #1 Tue Sep 4 01:16:00 BST 2001 i686
Locale: LANG=C, LC_CTYPE=C

Versions of packages ssh depends on:
ii  debconf                       0.9.95     Debian configuration management sy
ii  libc6                         2.2.4-1    GNU C Library: Shared libraries an
ii  libpam-modules                0.72-30    Pluggable Authentication Modules f
ii  libpam0g                      0.72-30    Pluggable Authentication Modules l
ii  libssl0.9.6                   0.9.6a-3   SSL shared libraries
ii  libwrap0                      7.6-8.2    Wietse Venema's TCP wrappers libra
ii  zlib1g                        1:1.1.3-15 compression library - runtime

Message #10 received at 111598@bugs.debian.org (full text, mbox, reply):

From: Colin Watson <cjwatson@debian.org>

To: Sam Vilain <sam@vilain.net>

Cc: 111598@bugs.debian.org, Russell Coker <russell@coker.com.au>, 75043-quiet@bugs.debian.org, control@bugs.debian.org

Subject: Re: sshd should log information about which key was used for login

Date: Fri, 3 Jan 2003 18:43:27 +0000

merge 75043 111598
thanks

On Fri, Sep 07, 2001 at 04:55:49PM +0100, Sam Vilain wrote:
> Package: ssh
> Version: 1:2.5.2p2-3
> Severity: wishlist
> 
> It would be nice if ssh was to log the fingerprint of the key used to
> log in, or perhaps the comment of the key.

It would, and as of OpenSSH 3.1 it does log the key fingerprint if you
set 'LogLevel VERBOSE', like so:

  Jan  3 18:38:33 arborlon sshd[15224]: Connection from ::ffff:127.0.0.1 port 46983
  Jan  3 18:38:34 arborlon sshd[15224]: Failed none for cjwatson from ::ffff:127.0.0.1 port 46983 ssh2
  Jan  3 18:38:34 arborlon sshd[15224]: Found matching DSA key: 18:07:5f:c7:85:37:e5:bd:45:e5:0f:80:5e:7b:13:96
  Jan  3 18:38:34 arborlon sshd[15224]: Found matching DSA key: 18:07:5f:c7:85:37:e5:bd:45:e5:0f:80:5e:7b:13:96
  Jan  3 18:38:34 arborlon sshd[15224]: Accepted publickey for cjwatson from ::ffff:127.0.0.1 port 46983 ssh2

Unfortunately this only works for protocol 2, not protocol 1, when using
privilege separation. After staring at the code for a while, I've
figured out why, and reported it to openssh-unix-dev; I'll keep you
informed of progress on this.

This also appears to be bug #75043, so cc'ed there.

-- 
Colin Watson                                  [cjwatson@flatline.org.uk]

Send a report that this bug log contains spam.