Home / server / Questions / 149627
Accepted
Banjer
Asked: 2010-06-10 05:19:13 +0800 CST

How to display SSH banner at login, but only for password authentication

  • 772

I have a warning message that is displayed to a user after they enter their username to log in to our Linux servers. I only want to display this message for password authentications, and not when keys are used. It should only show to a user who is logging into a host, and not when they are sshing from one host to another (our hosts all have keys set up so we can ssh from one to another without entering passwords).

Currently, I have a line for Banner in the /etc/ssh/sshd_config file which points to a text file containing the warning message. Banner doesn't appear to have any further config options, so I'm wondering if there is a way to do this with pam or some other mechanism? Thanks.

linux ssh sles pam banner

2 Answers

  1. Best Answer

    Yes, you can use the pam_echo plugin:

    auth required pam_unix.so
auth optional pam_echo.so file=/etc/ssh/password_banner.txt

    This should produce the pam_echo output after password login.

    See http://www.linux-pam.org/Linux-PAM-html/sag-pam_echo.html for docs.

    Edit: You'll also need to make sure you have UsePAM yes in your sshd_config. Replaced password with auth.

    • 7

  2. I only want to display this message for password authentications, and not when keys are used. It should only show to a user who is logging into a host, and not when they are sshing from one host to another (our hosts all have keys set up so we can ssh from one to another without entering passwords).

    Are you talking about user keys ~/.ssh/authorized_keys or host keys /etc/ssh/ssh_known_hosts?

    Currently, I have a line for Banner in the /etc/ssh/sshd_config file which points to a text file containing the warning message.

    Banner is displayed before any authentication happens.

    I'm wondering if there is a way to do this with pam or some other mechanism?

    You can try checking the remote (source) hostname: check with pam_access if the user comes from outside your network:

    session [success=1 default=ignore] pam_access.so accessfile=/etc/pam_access_localnet.conf
session optional pam_echo.so file=/etc/notice

    /etc/pam_access_localnet.conf:

    + : ALL : 192.168.201.0/24
- : ALL : ALL
    • 0