2

On Ubuntu, I'd like my OpenSSH server to start a script whenever a user logs in using SSH, ideally passing the host name or IP, as well as the user name. Additionally I'd like it to run a script, whenever a session is terminated (passing the username). These scripts should not run in the user's session, but system wide.

The idea is to give an audio warning on login and logout, e.g. using espeak, and to display the information on an external display.

I've seen that there is a pam-scripts package but I'm not sure if this does what I want, nor how to use it.

Any help is appreciated! -- Markus

(I also posted this question on askubuntu.)

3 Answers 3

8

Here's a wrapper script to be called by ForceCommand in sshd_config. This differentiates between a login command and a command invoked via ssh like ssh host "ls -l", since you might want to handle those differently.

#!/bin/bash

if [ -n "$SSH_ORIGINAL_COMMAND" ]; then
    eval $SSH_ORIGINAL_COMMAND
else
    echo "LOGIN: $USER $SSH_CONNECTION" >> /tmp/ssh.log
    $SHELL
    echo "LOGOUT: $USER $SSH_CONNECTION" >> /tmp/ssh.log
fi

You can replace the echo commands with whatever you'd like. IP information is in $SSH_CONNECTION, do with it what you will.

If you call this /usr/local/bin/ssh-command.sh, you would add this to your sshd_config:

ForceCommand /usr/local/bin/ssh-command.sh

It is probably a good idea to use Match as well to only trap certain users. Assuming all the users are in the "gobias" group:

Match Group gobias
    ForceCommand /usr/local/bin/ssh-command.sh

Anyway, perhaps it's worth a shot.

3
  • +1 for the Match conditional block, nice Oct 30, 2010 at 22:14
  • Very nice, thanks! But do you have an idea of how to run the script as root. I need to perform chown root:root on some user files upon logging in?
    – Ilia Ross
    Sep 23, 2013 at 7:17
  • You could probably do something with a nopasswd sudo command to address that. I'm not certain there's an easy way to do it through sshd directly, so sudo would probably be a better way.
    – Cakemox
    Sep 23, 2013 at 9:35
3

Just write a script to do whatever you want and then stick it in /etc/profile or possibly/etc/bash.bashrc depending on your needs. Changes to those files will apply to all users. I'm not sure how you'd go about notifying on logout with this approach, though.

Alternatively, another way to do this would be to have a simple daemon monitoring /var/log/secure (or /var/log/auth, depending on which distro you're using)for new (and closing) ssh sessions. That way it would be able to send notifications on both login and logout.

1

If the file /etc/ssh/sshrc exists, it is run by sh(1) after reading the user's environment but before starting the user's shell or command. See man sshd.

E.g., the following added to /etc/ssh/sshrc will produce the output shown when a user logs in successfully via OpenSSH:

~$ cat /etc/ssh/sshrc
echo "Login by $USER from $SSH_CLIENT on `date`" >> /var/log/ssh_connections.log

Output in /var/log/ssh_connections.log:

Login by Markus from 10.0.0.1 57853 22 on Fri Oct 29 03:41:31 2010
2
  • 1
    Be careful -- this would be ignored if the user had their own ~/.ssh/rc file.
    – Cakemox
    Oct 29, 2010 at 19:14
  • @Cakemox You are correct. Not sure how to get around that :-\
    – Xhantar
    Oct 29, 2010 at 19:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .