Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a small SSH server, and I'd like to write a script to run each time somebody logs in via SSH.

Now, how would I go about that?

I'd like the script to run everytime ANYBODY logs in, and I need to have access to at least the username of the person who logged in, and the IP address the person logged in from.

I thought about using /etc/bash.bashrc, but is that a good solution? For instance, is there a way a user could disable its use, and thus disable my script? If yes, what are my other options?


share|improve this question

migrated from Jun 13 '11 at 1:41

This question came from our site for professional and enthusiast programmers.

This will only work if the user uses bash, of course. It will not work if the users can select their own shell. – Paŭlo Ebermann Jun 13 '11 at 1:21
up vote 8 down vote accepted

The mechanism to use depends upon your goals.

If you wish to provide something convenient or friendly for your users, then your /etc/profile is reasonable enough if all your users use the same shell. If you want the commands to execute only when logging in via ssh, place commands into /etc/ssh/sshrc. (If you don't mind users overriding the commands with their own ~/.ssh/rc file.)

If you want to force a user to execute one program, and only one program, then the ForceCommand option as described by DigitalRoss is a good approach. (I personally would further confine the user with a mandatory access control system such as AppArmor, SELinux, TOMOYO, or SMACK, to ensure the program can not allow a user to escape. I've worked on AppArmor for ten years, so that's the tool I'd pick first, but the others are fine tools written by excellent programmers.)

If you just want one program to execute and not bother the user in any way, then the best approach is to use the pam_exec(8) module, which cannot be bypassed, works regardless of shell, and provides easy ability to run as the user or as the user account of the program performing the authorization. The manpage gives the following example:

   Add the following line to /etc/pam.d/passwd to rebuild the
   NIS database after each local password change:

               passwd optional seteuid make -C /var/yp

   This will execute the command

       make -C /var/yp

   with effective user ID.

This could be extended to run on auth, account, password, and session actions; probably session would be best for executing upon log in. Just add a line like:

session optional log=/var/log/ssh_login_cmd /usr/local/bin/ssh_cmd

to your /etc/pam.d/sshd control file.

share|improve this answer
Looks like the pam_exec module is exactly what I'm looking for. Thanks! – houbysoft Jun 13 '11 at 14:43
WATCH OUT, if the command you exec exits with a non zero exit code your login will fail and you could be locked out. One way to solve this is to make sure there is another 'session optional' called with a different module that always succeeds. – gflarity Jun 9 at 1:58

Newish versions of OpenSSH have a server feature called ForceCommand that gives control to a script instead of the operation (scp, ssh, ...) that the user intended. The script is passed the original command, so you could probably chain to it after doing whatever you need to do.

From sshd_config(5):


Forces the execution of the command specified by ForceCommand, ignoring any command supplied by the client and ~/.ssh/rc if present. The command is invoked by using the user's login shell with the -c option. This applies to shell, command, or subsystem execution. It is most useful inside a Match block. The command originally supplied by the client is available in the SSH_ORIGINAL_COMMAND environment vari- able. Specifying a command of ``internal-sftp'' will force the use of an in-process sftp server that requires no support files when used with ChrootDirectory.

I used this once to override scp and provide secure gem upload without giving every user authorized to upload gems interactive access they didn't need or want.

share|improve this answer

One way would be to use syslog-ng as a syslog daemon and configure it to run a script background every time a certain log entry (such as a successful ssh login) matches.

share|improve this answer

Check this out:

I don't believe there is a way to disable this from running. Can anyone else verify this?

share|improve this answer
It (/etc/profile or ~/.profile) depends on the shell of the user, just a bit less than bashrc. If your users are using a bash or similar, this is fine. – Paŭlo Ebermann Jun 13 '11 at 1:32

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.