On Ubuntu, I'd like my OpenSSH server to start a script whenever a user logs in using SSH, ideally passing the host name or IP, as well as the user name. Additionally I'd like it to run a script, whenever a session is terminated (passing the username). These scripts should not run in the user's session, but system wide.

The idea is to give an audio warning on login and logout, e.g. using espeak, and to display the information on an external display.

I've seen that there is a pam-scripts package but I'm not sure if this does what I want, nor how to use it.

Any help is appreciated! -- Markus

(I also posted this question on askubuntu.)


Here's a wrapper script to be called by ForceCommand in sshd_config. This differentiates between a login command and a command invoked via ssh like ssh host "ls -l", since you might want to handle those differently.


if [ -n "$SSH_ORIGINAL_COMMAND" ]; then
    echo "LOGIN: $USER $SSH_CONNECTION" >> /tmp/ssh.log
    echo "LOGOUT: $USER $SSH_CONNECTION" >> /tmp/ssh.log

You can replace the echo commands with whatever you'd like. IP information is in $SSH_CONNECTION, do with it what you will.

If you call this /usr/local/bin/ssh-command.sh, you would add this to your sshd_config:

ForceCommand /usr/local/bin/ssh-command.sh

It is probably a good idea to use Match as well to only trap certain users. Assuming all the users are in the "gobias" group:

Match Group gobias
    ForceCommand /usr/local/bin/ssh-command.sh

Anyway, perhaps it's worth a shot.

| improve this answer | |
  • +1 for the Match conditional block, nice – natxo asenjo Oct 30 '10 at 22:14
  • Very nice, thanks! But do you have an idea of how to run the script as root. I need to perform chown root:root on some user files upon logging in? – Ilia Rostovtsev Sep 23 '13 at 7:17
  • You could probably do something with a nopasswd sudo command to address that. I'm not certain there's an easy way to do it through sshd directly, so sudo would probably be a better way. – Cakemox Sep 23 '13 at 9:35

Just write a script to do whatever you want and then stick it in /etc/profile or possibly/etc/bash.bashrc depending on your needs. Changes to those files will apply to all users. I'm not sure how you'd go about notifying on logout with this approach, though.

Alternatively, another way to do this would be to have a simple daemon monitoring /var/log/secure (or /var/log/auth, depending on which distro you're using)for new (and closing) ssh sessions. That way it would be able to send notifications on both login and logout.

| improve this answer | |

If the file /etc/ssh/sshrc exists, it is run by sh(1) after reading the user's environment but before starting the user's shell or command. See man sshd.

E.g., the following added to /etc/ssh/sshrc will produce the output shown when a user logs in successfully via OpenSSH:

~$ cat /etc/ssh/sshrc
echo "Login by $USER from $SSH_CLIENT on `date`" >> /var/log/ssh_connections.log

Output in /var/log/ssh_connections.log:

Login by Markus from 57853 22 on Fri Oct 29 03:41:31 2010
| improve this answer | |
  • 1
    Be careful -- this would be ignored if the user had their own ~/.ssh/rc file. – Cakemox Oct 29 '10 at 19:14
  • @Cakemox You are correct. Not sure how to get around that :-\ – Xhantar Oct 29 '10 at 19:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.