I don't think there has been a single month in the last 5 years that I haven't had to figure out which public-key was used to authenticate me to a host via `ssh -vv` - often to let someone else who is failing to connect know which key to use.
The `-Z` is less useful - as I almost always know exactly which and what order the public keys are - as most of our sshd instances fail after 5 attempts - so making sure either (A) the correct ones or used or (clumsily, B) - just putting the correct one in the first five to try.
Would be a nice feature to echo which key successfully worked.
But - we have around 250k hosts in about 42 datacenters, some of them going back 8+ years, built by different teams - not everything has been standardized - and :
has lots and lots of weird IP mappings to ssh-keys that is just gross, and not something I would want to expose others to (mostly because it changes a lot behind the scenes)
So - from time to time, someone will say, "hey - the key that should be working in this datacenter/cluster isn't working, how do you get connected" - at which point I so a ssh -vvv and eyeball which one was accepted.
Being able to ask ssh just to print it out - would be awesome.
I do not want to confess how often I just drop in and change the order of my approximately dozen or so keys at the end of the ssh config file just to get the ones I want up to the top of the list.
Comments
I don't think there has been a single month in the last 5 years that I haven't had to figure out which public-key was used to authenticate me to a host via `ssh -vv` - often to let someone else who is failing to connect know which key to use.
The `-Z` is less useful - as I almost always know exactly which and what order the public keys are - as most of our sshd instances fail after 5 attempts - so making sure either (A) the correct ones or used or (clumsily, B) - just putting the correct one in the first five to try.
Would be a nice feature to echo which key successfully worked.
This is why I keep a ~/.ssh/config file. I store all the hosts and various connection parameters (uernames, alternate ports, keys, etc.) in that file.
Would that work for you?
So, I have this which I use about once a day:
But - we have around 250k hosts in about 42 datacenters, some of them going back 8+ years, built by different teams - not everything has been standardized - and : has lots and lots of weird IP mappings to ssh-keys that is just gross, and not something I would want to expose others to (mostly because it changes a lot behind the scenes)So - from time to time, someone will say, "hey - the key that should be working in this datacenter/cluster isn't working, how do you get connected" - at which point I so a ssh -vvv and eyeball which one was accepted.
Being able to ask ssh just to print it out - would be awesome.
Yup, or the alternative: is authentication failing because I have too many public keys and it just stopped trying after N keys?
I do not want to confess how often I just drop in and change the order of my approximately dozen or so keys at the end of the ssh config file just to get the ones I want up to the top of the list.