Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

On Ubuntu, I'd like my OpenSSH server to start a script whenever a user logs in using SSH, ideally passing the host name or IP, as well as the user name. Additionally I'd like it to run a script, whenever a session is terminated (passing the username). These scripts should not run in the user's session, but system wide.

The idea is to give an audio warning on login and logout, e.g. using espeak, and to display the information on an external display.

I've seen that there is a pam-scripts package but I'm not sure if this does what I want, nor how to use it.

Any help is appreciated! -- Markus

(I also posted this question on askubuntu.)

share|improve this question
add comment

3 Answers 3

up vote 8 down vote accepted

Here's a wrapper script to be called by ForceCommand in sshd_config. This differentiates between a login command and a command invoked via ssh like ssh host "ls -l", since you might want to handle those differently.

#!/bin/bash

if [ -n "$SSH_ORIGINAL_COMMAND" ]; then
    eval $SSH_ORIGINAL_COMMAND
else
    echo "LOGIN: $USER $SSH_CONNECTION" >> /tmp/ssh.log
    $SHELL
    echo "LOGOUT: $USER $SSH_CONNECTION" >> /tmp/ssh.log
fi

You can replace the echo commands with whatever you'd like. IP information is in $SSH_CONNECTION, do with it what you will.

If you call this /usr/local/bin/ssh-command.sh, you would add this to your sshd_config:

ForceCommand /usr/local/bin/ssh-command.sh

It is probably a good idea to use Match as well to only trap certain users. Assuming all the users are in the "gobias" group:

Match Group gobias
    ForceCommand /usr/local/bin/ssh-command.sh

Anyway, perhaps it's worth a shot.

share|improve this answer
    
+1 for the Match conditional block, nice –  natxo asenjo Oct 30 '10 at 22:14
    
Nice! Thanks alot! –  Markus Oct 31 '10 at 4:37
    
Very nice, thanks! But do you have an idea of how to run the script as root. I need to perform chown root:root on some user files upon logging in? –  Ilia Rostovtsev Sep 23 '13 at 7:17
    
You could probably do something with a nopasswd sudo command to address that. I'm not certain there's an easy way to do it through sshd directly, so sudo would probably be a better way. –  Cakemox Sep 23 '13 at 9:35
add comment

Just write a script to do whatever you want and then stick it in /etc/profile or possibly/etc/bash.bashrc depending on your needs. Changes to those files will apply to all users. I'm not sure how you'd go about notifying on logout with this approach, though.

Alternatively, another way to do this would be to have a simple daemon monitoring /var/log/secure (or /var/log/auth, depending on which distro you're using)for new (and closing) ssh sessions. That way it would be able to send notifications on both login and logout.

share|improve this answer
add comment

If the file /etc/ssh/sshrc exists, it is run by sh(1) after reading the user's environment but before starting the user's shell or command. See man sshd.

E.g., the following added to /etc/ssh/sshrc will produce the output shown when a user logs in successfully via OpenSSH:

~$ cat /etc/ssh/sshrc
echo "Login by $USER from $SSH_CLIENT on `date`" >> /var/log/ssh_connections.log

Output in /var/log/ssh_connections.log:

Login by Markus from 10.0.0.1 57853 22 on Fri Oct 29 03:41:31 2010
share|improve this answer
1  
Be careful -- this would be ignored if the user had their own ~/.ssh/rc file. –  Cakemox Oct 29 '10 at 19:14
    
@Cakemox You are correct. Not sure how to get around that :-\ –  Xhantar Oct 29 '10 at 19:22
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.