I have a local script that needs to execute locally as a pre-requisite to making an ssh connection.

The script is already working, but currently users need to run the script, then make an ssh connection - two steps. I would like that to happen in one step.

Example script run, from the users perspective:

$ /scripts/generate-mfa-auth.sh
MFA Code: 12345
Configuring authorized_keys...
Success. You can now connect over ssh.

$ ssh [email protected]

Goal / Problem:

I want this script to allow user input when triggered from ssh config.

For example, this below ssh config executes the script properly, but it does not allow the user to interact and the user is never shown any stdout of the script:

Match host bastion* exec "/scripts/generate-mfa-auth.sh"

Host bastion1.local.example.com
 IdentityFile ~/.ssh/my-bastion-ssh-key

Host *local.example.com !bastion1.local.example.com
 IdentityFile ~/.ssh/my-target-ssh-key
 ProxyCommand ssh [email protected] -W %h:%p


Is there any way to have this script work interactively when called from ssh config?

  • It sounds like you want an interactive script to provide MFA. Your best option for a custom script will probably be something involving pam_exec. I would encourage you to look at existing solutions like pam_oath.so/oathtool, and google-authenticator. Dec 14, 2022 at 23:39
  • Thanks, yea MFA is already working and the script is already working. Currently users need to run the script, then make an ssh connection.... I would like that to happen in one step.
    – Rino Bino
    Dec 14, 2022 at 23:49
  • I didn't realize the script ran locally so my first comment is not relevant. I added an answer that uses a fairly common pattern to change a command's behavior. Dec 16, 2022 at 3:13

1 Answer 1


I'm not aware of a way to do this with ssh configuration, but a fairly common solution is creating a script that is installed earlier in the PATH. For example

install -m 0755 -o root -g root /dev/null /usr/local/bin/ssh
cat <<EOF > /usr/local/bin/ssh
#!/usr/bin/env bash

read -p "mfa prompt: " my_input
echo $my_input
/usr/bin/ssh "$@"

Other common suggestions involve creating an alias or a function to do the same thing.


  • This is the correct answer. There is no way to do this directly with ssh config exec
    – Rino Bino
    Jan 9, 2023 at 17:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .