Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'd like to prompt a user for some piece of information before they get to their BASH shell when they're logging in via SSH. Ideally, I'd like to execute a script which prompts them for information, check that the information is correct, and then if it is drop them to a shell. So, think:

ssh user@some-host.com
password: xxxx

do you agree to the terms and conditions of use? enter yes or no:
yes 

OK, here's your shell:
# 

Can anyone provide an example of how to do something like this?

share|improve this question
1  
This should be done in PAM, not via sshd. –  Ignacio Vazquez-Abrams Feb 24 '11 at 17:42
1  
OK, feel free to provide an example via PAM then too. Any particular reason why it should be done via PAM, and not SSHD? –  Keith Palmer Feb 24 '11 at 17:44
    
For just a non-interactive banner, use can use the PAM config mentioned here –  MonkeeSage Aug 23 '11 at 15:21
    
What about this? forum.yubico.com/forum/viewtopic.php?t=860 It can also be done entirely in Perl. And, in case you want, there are PAM modules in perl, allowing it to be done in PAM. –  user135035 Sep 7 '12 at 0:39
add comment

3 Answers

Create new login script(/bin/bash_rest):

#!/bin/bash

echo "do you agree to the terms and conditions of use? enter yes or no:"
read ans

case $ans in
        y|yes|Y|Yes) bash;;
        *) exit
esac

and set as login shell:

chmod +x /bin/bash_rest
usermod -s /bin/bash_rest ooshro

ooshro@ooshro:~$ ssh -p 2022 localhost
Linux ubuntu-1010-server-01 2.6.35-25-generic-pae #44-Ubuntu SMP Fri Jan 21 19:01:46 UTC 2011 i686 GNU/Linux
Ubuntu 10.10

Welcome to Ubuntu!
 * Documentation:  https://help.ubuntu.com/
Last login: Thu Feb 24 17:43:06 2011 from 10.0.2.2
do you agree to the terms and conditions of use? enter yes or no:
yes
ooshro@ubuntu-1010-server-01:~$ exit
Connection to localhost closed.
ooshro@ooshro:~$ ssh -p 2022 localhost
Linux ubuntu-1010-server-01 2.6.35-25-generic-pae #44-Ubuntu SMP Fri Jan 21 19:01:46 UTC 2011 i686 GNU/Linux
Ubuntu 10.10

Welcome to Ubuntu!
 * Documentation:  https://help.ubuntu.com/
Last login: Thu Feb 24 17:43:17 2011 from 10.0.2.2
do you agree to the terms and conditions of use? enter yes or no:
no
Connection to localhost closed.
share|improve this answer
    
This can be overridden as peer can choose to connect and execute no/other shell. –  Hrvoje Špoljar Feb 24 '11 at 17:50
    
ssh host "command" ; command can be any shell... if you want you can go as simple ash "sh" –  Hrvoje Špoljar Feb 24 '11 at 17:54
    
ssh -p 2022 localhost /bin/dash do you agree to the terms and conditions of use? enter yes or no: –  ooshro Feb 24 '11 at 17:58
    
@Hrvoje Špoljar ssh host "command" don't work!..bring a example –  ooshro Mar 3 '11 at 8:25
    
Can anyone actually provide an example of how this is insecure/how a peer can override it? –  Keith Palmer Mar 11 '11 at 13:59
show 1 more comment

I would add some rudimentary logging to that bash script, and instead of making that script the default shell, I would consider /etc/ssh/sshrc or /etc/profile.local or /etc/profile. Testing is necessary, because behavior on different systems may vary. There are some reasons not to create non-standard shells, one of which is the need to add new shell to /etc/shells. Unless absolutely necessary, remain with shells defined in /etc/shells.

share|improve this answer
add comment

Assuming for a moment that you're using opensshd, one possible alternative that does almost what you want, and is a lot simpler to implement, would be to use a login banner. This will not do exactly what you want it to do - it will display a text before the user logs in.

You can alter your policy accordingly - "by logging in you are accepting these terms and conditions".

You can do this using the "Banner" option in /etc/sshd/sshd_config. For example:

# echo "Banner /etc/sshd/sshd-banner" >> /etc/sshd/sshd_config
# echo "By logging on you're accepting the terms and conditions." > /etc/sshd/ssh-banner
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.