16

I want to display banner (welcome message) for SSH users with a specific welcome message for each user.

35

You did not specify, what SSH server are you using. I'm assuming OpenSSH.

Note that the SSH banner and the MOTD are two different things.

While almost indistinguishable in an SSH terminal, they have a different behavior, for example, in an SFTP client.


The MOTD is just a text printed on an interactive terminal. So, it won't (and cannot) be sent to SFTP clients, for example (more about that later).

The MOTD is hard-coded to the /etc/motd in OpenSSH. You can turn it on/off globally only, using the PrintMotd directive.

On some Linux systems, however, the PrintMotd is always off and the MOTD is printed by the PAM stack instead (using the pam_motd module). In this case you can turn it off via the /etc/pam.d/sshd or specify a custom motd= path as a module parameter.


The SSH banner is a special SSH 2.0 feature, sent in a specific SSH packet (SSH2_MSG_USERAUTH_BANNER).

As such, even non-terminal clients, like SFTP clients, can process it and display to user. See how the banner displays in WinSCP SFTP/SCP client for example.

The SSH banner is configurable per user (or group or other criteria) in the sshd_config using the Banner and the Match directives:

Match User username1
    Banner /etc/banner_user1

Match User username2
    Banner /etc/banner_user2

See also Disable ssh banner for specific users or ips.


Of course, you can also use a custom implementation for the message/banner. Simply print a message selected using your custom logic from a global profile script.

As with the MOTD, this won't work for non-interactive sessions (the SFTP and alike).

More importantly, not only it won't work, you need to make sure that you print the message for an interactive terminal only. What OpenSSH does automatically for the /etc/motd. Either use a global profile script that executes for an interactive terminal only, or print the message conditionally based on value of the TERM environment variable.

If you print the message for non-interactive session, you break any client that uses a strict protocol, such as the SFTP or the SCP, as the client will try to interpret your text message as a protocol message, failing badly.

See for example description of such issue in documentation of WinSCP SFTP/SCP client.

(I'm the author of WinSCP)

  • Hi all thanks for reply, I got the solution please correct me if i am wrong. I append this lines into /etc/profile file. PGROUP=groups|awk '{print $1}' cat /etc/motd.${PGROUP} before adding this line i create banner file for each user under /etc directory. and file like motd.root and motd.alex and this work for me. – user260277 Dec 18 '14 at 9:04
  • That should do too. Except as per my answer, this works in an interactive terminal only. It won't work for SFTP and similar. – Martin Prikryl Dec 18 '14 at 9:20
  • interactive terminal means ? – user260277 Dec 18 '14 at 9:23
  • It's a terminal that a human interacts with (as opposite to SFTP session, SCP session or non-interactive terminal used for remote execution of some batch task) – Martin Prikryl Dec 18 '14 at 10:07
  • I have included some tricky details about custom implementation of the banner. – Martin Prikryl Dec 18 '14 at 13:02
9

You can use "$HOME/.ssh/rc" file too for archive what you want to do

echo "echo Hello World" > /home/pluto/.ssh/rc
ssh pluto@localhost
Last login: Thu Dec 18 08:46:16 2014 from localhost.localdomain
Hello World

So, you can have one ssh rc for every user.

  • hi, I try this but it gives error message .ssh/rc: 1: .ssh/rc: welcom: not found. – user260277 Dec 18 '14 at 9:17
  • was my fault, i did a typo, you need echo like in normal bash script – c4f4t0r Dec 18 '14 at 9:26
  • "Wolrd" is also a typo :) – simon Dec 18 '14 at 16:15
  • I get "stty: standard input: Inappropriate ioctl for device". – Dennis Williamson Dec 18 '14 at 19:00
  • what do you have in .ssh/rc? – c4f4t0r Dec 18 '14 at 21:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.