The mechanism to use depends upon your goals.
If you wish to provide something convenient or friendly for your users, then your
/etc/profile is reasonable enough if all your users use the same shell. If you want the commands to execute only when logging in via
ssh, place commands into
/etc/ssh/sshrc. (If you don't mind users overriding the commands with their own
If you want to force a user to execute one program, and only one program, then the
ForceCommand option as described by DigitalRoss is a good approach. (I personally would further confine the user with a mandatory access control system such as AppArmor, SELinux, TOMOYO, or SMACK, to ensure the program can not allow a user to escape. I've worked on AppArmor for ten years, so that's the tool I'd pick first, but the others are fine tools written by excellent programmers.)
If you just want one program to execute and not bother the user in any way, then the best approach is to use the
pam_exec(8) module, which cannot be bypassed, works regardless of shell, and provides easy ability to run as the user or as the user account of the program performing the authorization. The manpage gives the following example:
Add the following line to /etc/pam.d/passwd to rebuild the
NIS database after each local password change:
passwd optional pam_exec.so seteuid make -C /var/yp
This will execute the command
make -C /var/yp
with effective user ID.
This could be extended to run on
session actions; probably
session would be best for executing upon log in. Just add a line like:
session optional pam_exec.so log=/var/log/ssh_login_cmd /usr/local/bin/ssh_cmd
/etc/pam.d/sshd control file.