Displaying Visual Client Keys in sshd Log

In this article, we will discuss how to display visual client keys in the sshd log. This is a useful feature for those who want to verify the authenticity of the client connecting to their server. By default, this feature is not enabled, but it is easy to configure. Let's get started!

Prerequisites

Before we begin, it is important to note that this guide assumes that you have already installed and configured the sshd service on your server. If you have not done so, you can follow the official installation guide provided by your operating system. Additionally, you should have access to the server's terminal or command line interface.

Enabling Visual Client Keys

To enable visual client keys in the sshd log, we need to modify the sshd_config file. This file is typically located in the /etc/ssh/ directory. To edit this file, you can use your favorite text editor, such as nano or vim.

Once you have opened the sshd_config file, you need to add the following line:

PrintMotd yes

This line will enable the printing of the message of the day (MOTD) when a user logs in via ssh. The MOTD can be customized to display the visual client key. To do so, you need to add the following line to the sshd_config file:

PrintLastLog yes

This line will enable the printing of the last login message when a user logs in via ssh. The last login message can be customized to display the visual client key. To do so, you need to add the following line to the sshd_config file:

Banner /etc/ssh/banner

This line will specify the path to the banner file. The banner file can be customized to display the visual client key. To create the banner file, you can use your favorite text editor, such as nano or vim. The banner file should contain the following lines:

------------------------------------------------------------------------
Welcome to the example.com SSH server!

The client key fingerprint is:
SHA256:abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ123456
------------------------------------------------------------------------

Replace the fingerprint with the actual fingerprint of the client key. The fingerprint can be obtained by running the following command on the client machine:

ssh-keygen -lf /path/to/client/key.pub

After you have added the necessary lines to the sshd_config file and created the banner file, you need to restart the sshd service for the changes to take effect. You can do so by running the following command:

sudo systemctl restart sshd

Verifying Visual Client Keys

After you have enabled visual client keys in the sshd log, you can verify that it is working properly by connecting to the server via ssh from the client machine. When you do so, you should see the MOTD and the last login message, which should include the visual client key. If you do not see the visual client key, make sure that the sshd_config file is properly configured and that the banner file exists and contains the correct fingerprint.

In this article, we have discussed how to display visual client keys in the sshd log. This is a useful feature for those who want to verify the authenticity of the client connecting to their server. By following the steps in this guide, you can enable the visual client key in the sshd log and verify that it is working properly.

References