5

Upon any ssh login/connection (anybody logging in through ssh), is there a way to have a script executed? Using OpenSSH server.

The script should not be modifiable by any of the users, -- of course --, so this should be a system-wide script.

Thanks!

4 Answers 4

1

If you're looking to do it non-intrusively to the user's experience, take a look at a syslog substitute (e.g. syslog-ng). You can trigger the command on the log messages sent to syslog by the SSH server when someone logs in.

This approach is a little rube-goldbergian, and depends on syslog working correctly. YMMV, IMHO, SLATFATF

2
  • This seems the only solution that does not depend on the user's shell, can you tell me more about how to achieve this?
    – Weboide
    Jun 22, 2010 at 11:14
  • campin.net/newlogcheck.html#syslog-ng <-- This person is doing something almost the same with his/her "Email certain logs" configuration. Matching log entries on a string, and executing a program in response. The sample program is to email, but yours can do whatever you want. Jun 23, 2010 at 2:29
4

You already have a script that's being executed every time someone logs in: /etc/profile

You can modify that script to perform whatever task it is that you have in mind, or have it call your script directly. On Debian derivatives, you can just drop your custom script (ending in .sh) in /etc/profile.d and it will be called automatically.

NOTE: Everything I just said only applies to Bourne shell derivatives, like the default /bin/sh, ash, bash, ksh, etc. Most users stick with bash, so the above directions are likely all you need. Other families of shells use other startup scripts. Tcsh, for example, will execute /etc/csh.cshrc on login.

2
  • upboat for use of have in italics :)
    – user15590
    Jun 22, 2010 at 8:36
  • +1 for re-use of /etc/profile -- standard on almost every environment I use :) Jan 14, 2014 at 8:51
2

See ForceCommand in sshd_config(5):

Forces the execution of the command specified by ForceCommand,
ignoring any command supplied by the client and ~/.ssh/rc if
present.  The command is invoked by using the user's login shell
with the -c option.  This applies to shell, command, or subsystem
execution.  It is most useful inside a Match block.  The command
originally supplied by the client is available in the
SSH_ORIGINAL_COMMAND environment variable.  Specifying a command
of ``internal-sftp'' will force the use of an in-process sftp
server that requires no support files when used with
ChrootDirectory.
0

You could change a user's shell such that a custom script was executed upon login. It could be the default shell for any user that needs it (I'd recommend keeping an admin account with bash to fix problems).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .