The man page for pam_exec
explains that the module provides $PAM_USER
, not $USER
:
the following PAM items are exported as environment variables: PAM_RHOST
, PAM_RUSER
, PAM_SERVICE
, PAM_TTY
, PAM_USER
and PAM_TYPE
[...]
On my Debian based system I added this line just before the entry for pam_motd
# Run a script on login
session optional pam_exec.so /usr/local/etc/pam_exec.sh
I then created the test script, remembering to make it executable:
cat >/usr/local/etc/pam_exec.sh <<'EOF'; chmod a+rx /usr/local/etc/pam_exec.sh
#!/bin/bash
#
test open_session = "$PAM_TYPE" && {
echo
date
echo "PAM_USER=$PAM_USER, USER=$USER."
} >>/tmp/pam_exec.log
exit 0
EOF
Finally, I opened a new login session to my test system, and saw that on session start I received information such as this in my log file /tmp/pam_exec.log
:
Mon Nov 9 23:32:52 GMT 2015
PAM_USER=roaima, USER=.
To implement your requirement you would need to use a script something like this:
#!/bin/sh
rsync -azq -e ssh "$PAM_USER"@remote_server:/home/html/"$PAM_USER"/ /home/html/"$PAM_USER" >/dev/null 2>&1
Notice that all output from rsync
is discarded. This is necessary to ensure that client/server applications using ssh
as a transport do not get hit by unexpected output before they can start their negotiation. If you really want to present it to the user, I would recommend you write it to a user-specific log file such as "$HOME/.pam_exec.log"
and then use a line like this in the user's .profile
to output it after the login process has completed:
if test -t 1 -a -s "$HOME/.pam_exec.log"
then
echo "Prelogin results"
sed 's/^/| /' "$HOME/.pam_exec.log"
fi
It's not immune to a race condition, but IME most users don't login simultaneously multiple times to the same server. If you find this scenario is common there are ways to deal with it.