Monday, June 08, 2015

Checking authorized_keys for duplicate SSH key lines

After a while, unless you are using Puppet or some other tool, your ~/.ssh/authorized_key file will end up with half a dozen or dozens of different SSH public key lines.  And depending on how careful you were, some of them may be duplicates or screwed up.

One way to make sense of the madness is to look at the first N bytes of each line in the ~/.ssh/authorized_keys file and look for strangeness.

$ cut --bytes=1-80 ~/.ssh/authorized_keys 
ssh-dss AAAAB3NzaC1kc3MAAACBAP0090dCcnFwtuP9Rmjgf7eHR20JdmHASXS+un4cAKNYpwHIDlA9
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC54VI+7J1DoEEiJml8JusdM4M9UNNIA8gv/JER7rQ7
qDkz/87jwJ0jufKy7XQyiiwHGg7GvqMej8enLCN90wc4xOTrFUO9FaSinWGOJmtdjVH8m7oXZ+OfClOX
h1o14nqandnzYPNyOH7iHZyVcAl082Ua1nmsesrAj7ilNPLZFiQhGhPAbWPz/O9dVBvfW+I5stRgb7FD
014

ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAZB+mI3xeVeYo3B2yJqvQYUpVBrNtMmtd3iAj6O6pMIvRGzm

ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAsrOtkkIXu0ci/8h79/zCFgAoDZgw6yQExBs4o/KjfmB/

Just by looking at the above output, I can see that the second ssh-rsa key line was not placed on a single line as it should have been, but has line breaks.  After a quick edit of the file, now the output looks like:

$ cut --bytes=1-80 ~/.ssh/authorized_keys
ssh-dss AAAAB3NzaC1kc3MAAACBAP0090dCcnFwtuP9Rmjgf7eHR20JdmHASXS+un4cAKNYpwHIDlA9
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC54VI+7J1DoEEiJml8JusdM4M9UNNIA8gv/JER7rQ7

ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAZB+mI3xeVeYo3B2yJqvQYUpVBrNtMmtd3iAj6O6pMIvRGzm

ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAsrOtkkIXu0ci/8h79/zCFgAoDZgw6yQExBs4o/KjfmB/

Now I can run the output of that through sort/uniq to see whether I have any duplicate SSH public key lines:

$ cut --bytes=1-80 ~/.ssh/authorized_keys | sort | uniq -c -d
      5 
      2 ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAZB+mI3xeVeYo3B2yJqvQYUpVBrNtMmtd3iAj6O6pMIvRGzm
      2 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC54VI+7J1DoEEiJml8JusdM4M9UNNIA8gv/JER7rQ7

Looks like I do have a pair of duplicated SSH public key lines.  This is a good thing to know because if was trying to remove a particular SSH key pair, I might remove one line but not see the other.

No comments: