I wrote:
So I spent the last 30 minutes or so trying to find a detailed
description of the content of /var/log/secure. Sure, I know the purpose
of the file and most of the messages are self-explanatory. But some
of the message content is not. I was surprised that multiple search
engines were unable to find anything beyond the obvious ("Keep
authentication logs for both successful ..."). Doesn't Fedora's
documentation anywhere describe this file in some detail?
Jonathan Billings wrote:
What gets logged to that file is defined in your /etc/rsyslog.conf. I
believe by default, it���������s any syslog entries with the ���������authpriv���������
facility is sent to /var/log/secure.
For example, given the message,
Accepted publickey for ... from ... port ... ssh2: RSA
SHA256:QSyKp5SJ8gJFcYtbtb9SQ1axtqSg7fEoQBiZf3kPXgU
what is the meaning of the RSA value listed? Is it a "fingerprint"?
How can I compare it to the various keys on my system?
Most likely part of OpenSSH���������s documentation.
Well, apparently not. Searching
openssh.com, I find no answer.
But that did spark some different search
words for my search engines. Eventually, I found
<
https://serverfault.com/questions/888281/what-is-the-sha256-that-comes-on...
g>,
which describes how to compute the proper value. Again, it assumes
I want that value for my own key but it wasn't difficult to modify
the algorithm. Here's what I eventually wrote:
#! /usr/bin/bash
cd ~/.ssh
declare -i c=0
while read type key id; do
hash=$( echo $key \
| base64 -d \
| sha256sum \
| sed 's/ .*//' \
| xxd -r -p | base64 \
| sed 's/=$//' )
printf "%2d %s %s\n" $c "$hash" "$id"
c+=1
done <authorized_keys
--
Dave Close, Compata, Irvine CA "Greed is to the moralists of the
dave(a)compata.com, +1 714 434 7359 left what sex is to the moralists
dhclose(a)alumni.caltech.edu of the right." - Cathy Young