Portable quick review of the /var/log/authlog file, particularly for when users are logging in with SSH keys

authlog_review.sh

#!/usr/bin/bash
#  requires sshd logging in verbose level
#  recommended usage:
#   ./fp && egrep 'Accepted publickey|Found matching' /var/log/authlog

while read l; do
  #[[ -n $l && ${l###} = $l ]] && echo -n "$l:  " |  cut -f3 -d' ' && echo $l > /tmp/ssh.key.fingerprint.$EUID.$BASHPID && ssh-keygen -l -f /tmp/ssh.key.fingerprint.$EUID.$BASHPID
  if [[ -n $l && ${l###} = $l ]] ; then
    TAG="$( echo -n "$l" |  cut -f3 -d' ' )"
    TMPFILE="/tmp/${EUID}.${BASHPID}__ssh.key.fingerprint.$TAG"
    echo $l > $TMPFILE
    ssh-keygen -l -f $TMPFILE
  fi
done < .ssh/authorized_keys

echo "--------------------------------------------------------------------------------"

egrep "Accepted publickey|Found matching|'su " /var/log/authlog