Hacker News Reader

Comment by yjftsjthsd-h | Hacker News Reader

> ssh(1): add a "ssh -Z user@host" mode that prints the keys that will be tried for public key authentication in the order that they will be used.

Oh, that's a nice new feature:)

View on HN

I don't think there has been a single month in the last 5 years that I haven't had to figure out which public-key was used to authenticate me to a host via `ssh -vv` - often to let someone else who is failing to connect know which key to use.

The `-Z` is less useful - as I almost always know exactly which and what order the public keys are - as most of our sshd instances fail after 5 attempts - so making sure either (A) the correct ones or used or (clumsily, B) - just putting the correct one in the first five to try.

Would be a nice feature to echo which key successfully worked.

Yup, or the alternative: is authentication failing because I have too many public keys and it just stopped trying after N keys?

I do not want to confess how often I just drop in and change the order of my approximately dozen or so keys at the end of the ssh config file just to get the ones I want up to the top of the list.

This is why I keep a ~/.ssh/config file. I store all the hosts and various connection parameters (uernames, alternate ports, keys, etc.) in that file.

Would that work for you?

So, I have this which I use about once a day:

  vis ()
  {
      vim ~/.ssh/config
  }

But - we have around 250k hosts in about 42 datacenters, some of them going back 8+ years, built by different teams - not everything has been standardized - and :

  $ wc -l ~/.ssh/config
  268 /home/shephard/.ssh/config

has lots and lots of weird IP mappings to ssh-keys that is just gross, and not something I would want to expose others to (mostly because it changes a lot behind the scenes)

So - from time to time, someone will say, "hey - the key that should be working in this datacenter/cluster isn't working, how do you get connected" - at which point I so a ssh -vvv and eyeball which one was accepted.

Being able to ask ssh just to print it out - would be awesome.

Yeah, I've occasionally had to divine from verbose debug output that the remote host didn't like more than three or so public key attempts before requiring another auth type.

Reply on news.ycombinator.com