sshd doesn't log which RSA key was used

[Hank Leininger]

On 2000-12-28, Christian Kurz <shorty at debian.org> wrote:

> On 00-12-28 Markus Friedl wrote:
> > i am not sure about this feature.

> > you could add a
> > {Key k; k.rsa=pk; k.type=KEY_RSA1;
> > verbose("RSA auth accepted with key %s", key_fingerprint(&k);
> > }
> > to auth_rsa().

> Well, at my former employer we had only one account that was used by
> everyone to log into the server. In this situation it would be useful
> to have a line in the auth.log like this to see which user logged and
> which key he used. Now I work at an other company where we have

Yup.  This'd also be quite nice for automated jobs that can, say, log in
as root with a forced command="...", or shared access to an account that
runs a forced command="..." or scp's.

Here are some (lightly tested, whee) small patches to implement this for
RSA and DSA authentications.  I also added key-line-number printing for
keys which are skipped because their options blocks have restrictive
from='s, etc.  (BTW I think that wording is misleading: sshd says
"correct key but not from a permitted host", but as far as I can tell,
the key hasn't actually been tested yet--that check happens *before* the
client is challenged.  The verbage suggests it wasn't always so.)

I'm also including a one-liner for my request the other day, that
changes 'tvp!=NULL kid...' from debug to debug2.

Mebbe these are small enough for someone to look over (and, probably,
fix ;) in time for inclusion in 2.4.0 ?

Thanks,

Hank Leininger <hlein at progressive-comp.com>

###

diff -u auth-options.c.orig auth-options.c
--- auth-options.c.orig	Sat Oct 14 01:23:11 2000
+++ auth-options.c	Thu Dec 28 15:51:38 2000
@@ -193,9 +193,9 @@
 			xfree(patterns);
 			if (mname == -1 || mip == -1 ||
 			    (mname != 1 && mip != 1)) {
-				log("Authentication tried for %.100s with correct key but not from a permitted host (host=%.200s, ip=%.200s).",
+				log("Authentication tried for %.100s with correct key but not from a permitted host (host=%.200s, ip=%.200s, line=%lu).",
 				    pw->pw_name, get_canonical_hostname(),
-				    get_remote_ipaddr());
+				    get_remote_ipaddr(), linenum);
 				packet_send_debug("Your host '%.200s' is not permitted to use this key for login.",
 				get_canonical_hostname());
 				/* deny access */

diff -u auth-rsa.c.orig auth-rsa.c
--- auth-rsa.c.orig	Sun Oct 15 21:14:42 2000
+++ auth-rsa.c	Thu Dec 28 16:50:12 2000
@@ -28,6 +28,8 @@
 
 #include <openssl/rsa.h>
 #include <openssl/md5.h>
+#include <openssl/dsa.h>
+#include "key.h"
 
 
 /* import */
@@ -276,6 +278,11 @@
 		 * otherwise continue searching.
 		 */
 		authenticated = 1;
+		/* Log which RSA key was used */
+		{
+			Key k; k.rsa=pk; k.type=KEY_RSA;
+			verbose("RSA auth successful for key %s", key_fingerprint(&k));
+		}
 		break;
 	}
 
diff -u auth2.c.orig auth2.c
--- auth2.c.orig	Sat Oct 28 06:05:57 2000
+++ auth2.c	Thu Dec 28 16:04:14 2000
@@ -464,8 +464,11 @@
 #endif
 			/* test for correct signature */
 			if (user_dsa_key_allowed(authctxt->pw, key) &&
-			    dsa_verify(key, sig, slen, buffer_ptr(&b), buffer_len(&b)) == 1)
+			    dsa_verify(key, sig, slen, buffer_ptr(&b), buffer_len(&b)) == 1) {
 				authenticated = 1;
+				/* Log which DSA key was used */
+				verbose("DSA auth successful for key %s", key_fingerprint(key));
+			}
 			buffer_clear(&b);
 			xfree(sig);
 		} else {

diff -u serverloop.c.orig serverloop.c
--- serverloop.c.orig	Fri Oct 27 23:19:58 2000
+++ serverloop.c	Wed Dec 27 22:32:23 2000
@@ -256,7 +256,7 @@
 		tvp = &tv;
 	}
 	if (tvp!=NULL)
-		debug("tvp!=NULL kid %d mili %d", child_terminated, max_time_milliseconds);
+		debug2("tvp!=NULL kid %d mili %d", child_terminated, max_time_milliseconds);
 
 	/* Wait for something to happen, or the timeout to expire. */
 	ret = select(max_fd + 1, readset, writeset, NULL, tvp);