SSH FingerprintLogging: Difference between revisions
From Lolly's Wiki
Jump to navigationJump to search
m (Text replacement - "</source" to "</syntaxhighlight") |
m (Text replacement - "<source" to "<syntaxhighlight") |
||
| Line 6: | Line 6: | ||
==The AuthorizedKeysCommand== | ==The AuthorizedKeysCommand== | ||
* /opt/sbin/fingerprintlog: | * /opt/sbin/fingerprintlog: | ||
< | <syntaxhighlight lang=bash> | ||
#!/bin/bash | #!/bin/bash | ||
| Line 29: | Line 29: | ||
</syntaxhighlight> | </syntaxhighlight> | ||
< | <syntaxhighlight lang=bash> | ||
# chmod 0750 /opt/sbin/fingerprintlog | # chmod 0750 /opt/sbin/fingerprintlog | ||
# chown root:daemon /opt/sbin/fingerprintlog | # chown root:daemon /opt/sbin/fingerprintlog | ||
| Line 36: | Line 36: | ||
==Create the logfile== | ==Create the logfile== | ||
* /var/log/fingerprint.log | * /var/log/fingerprint.log | ||
< | <syntaxhighlight lang=bash> | ||
# touch /var/log/fingerprint.log | # touch /var/log/fingerprint.log | ||
# chown daemon:ssh-user /var/log/fingerprint.log | # chown daemon:ssh-user /var/log/fingerprint.log | ||
| Line 43: | Line 43: | ||
==Setup logrotation== | ==Setup logrotation== | ||
* /etc/logrotate.d/fingerprintlog | * /etc/logrotate.d/fingerprintlog | ||
< | <syntaxhighlight lang=bash> | ||
/var/log/fingerprint.log | /var/log/fingerprint.log | ||
{ | { | ||
| Line 56: | Line 56: | ||
==Add fingerprint logging to sshd== | ==Add fingerprint logging to sshd== | ||
* /etc/ssh/sshd_config | * /etc/ssh/sshd_config | ||
< | <syntaxhighlight lang=bash> | ||
... | ... | ||
DenyUsers daemon | DenyUsers daemon | ||
| Line 64: | Line 64: | ||
</syntaxhighlight> | </syntaxhighlight> | ||
Restart sshd | Restart sshd | ||
< | <syntaxhighlight lang=bash> | ||
# systemctl restart ssh.service | # systemctl restart ssh.service | ||
</syntaxhighlight> | </syntaxhighlight> | ||
==Add magic to your .bashrc== | ==Add magic to your .bashrc== | ||
< | <syntaxhighlight lang=bash> | ||
# apt install gawk | # apt install gawk | ||
</syntaxhighlight> | </syntaxhighlight> | ||
* ~/.bashrc | * ~/.bashrc | ||
< | <syntaxhighlight lang=bash> | ||
... | ... | ||
# Match parent PID or grand parent PID against fingerprint.log | # Match parent PID or grand parent PID against fingerprint.log | ||
Revision as of 18:01, 25 November 2021
SSH Fingerprintlogging
Why logging fingerprints?
It is just for the possibility of setting the Bash HISTFILE per logged in user.
The AuthorizedKeysCommand
- /opt/sbin/fingerprintlog:
#!/bin/bash
# /opt/sbin/fingerprintlog <logfile> %u %k %t %f
# Arguments to AuthorizedKeysCommand may be provided using the following tokens, which will be expanded at runtime:
# %% is replaced by a literal '%',
# %u is replaced by the username being authenticated,
# %h is replaced by the home directory of the user being authenticated,
# %t is replaced with the key type offered for authentication,
# %f is replaced with the fingerprint of the key, and
# %k is replaced with the key being offered for authentication.
# If no arguments are specified then the username of the target user will be supplied.
[ "_${LOGNAME}_" != "_daemon_" ] && exit 1
LOGFILE=$1
USER=$2
KEY=$3
KEYTYPE=$4
FINGERPRINT=$5
printf "%s ssh-login T=%s U=%s PPID=%s FP=%s K=%s\n" "$(/bin/date -Iseconds)" "${KEYTYPE}" "${USER}" "${PPID}" "${FINGERPRINT}" "${KEY}" >> ${LOGFILE}
# chmod 0750 /opt/sbin/fingerprintlog
# chown root:daemon /opt/sbin/fingerprintlog
Create the logfile
- /var/log/fingerprint.log
# touch /var/log/fingerprint.log
# chown daemon:ssh-user /var/log/fingerprint.log
# chmod 0640 /var/log/fingerprint.log
Setup logrotation
- /etc/logrotate.d/fingerprintlog
/var/log/fingerprint.log
{
su daemon syslog
create 0640 daemon ssh-user
rotate 8
weekly
missingok
notifempty
}
Add fingerprint logging to sshd
- /etc/ssh/sshd_config
...
DenyUsers daemon
AuthorizedKeysCommand /opt/sbin/fingerprintlog /var/log/fingerprint.log %u %k %t %f
AuthorizedKeysCommandUser daemon
...
Restart sshd
# systemctl restart ssh.service
Add magic to your .bashrc
# apt install gawk
- ~/.bashrc
...
# Match parent PID or grand parent PID against fingerprint.log
[ -f /var/log/fingerprint.log ] && FINGERPRINT=$(/usr/bin/gawk -v ppid="(${PPID}|$(awk '{print $4;}' /proc/${PPID}/stat))" -v user=${LOGNAME} '$5 ~ "^PPID="ppid"$" {gsub(/^FP=/,"",$6); gsub(/\//,"_",$6); print $6;exit;}' /var/log/fingerprint.log)
# Set the history file
export HISTFILE=~/.bash_history_${FINGERPRINT:-${SUDO_USER:-default}}
...
