Home / server / Questions / 153445
Accepted
Weboide
Asked: 2010-06-22 18:21:20 +0800 CST

How to execute a system-wide script upon any ssh login (with OpenSSH)?

  • 772

Upon any ssh login/connection (anybody logging in through ssh), is there a way to have a script executed? Using OpenSSH server.

The script should not be modifiable by any of the users, -- of course --, so this should be a system-wide script.

Thanks!

scripting login ssh execution

4 Answers

  1. You already have a script that's being executed every time someone logs in: /etc/profile

    You can modify that script to perform whatever task it is that you have in mind, or have it call your script directly. On Debian derivatives, you can just drop your custom script (ending in .sh) in /etc/profile.d and it will be called automatically.

    NOTE: Everything I just said only applies to Bourne shell derivatives, like the default /bin/sh, ash, bash, ksh, etc. Most users stick with bash, so the above directions are likely all you need. Other families of shells use other startup scripts. Tcsh, for example, will execute /etc/csh.cshrc on login.

    • 4

  2. See ForceCommand in sshd_config(5):

    Forces the execution of the command specified by ForceCommand,
ignoring any command supplied by the client and ~/.ssh/rc if
present.  The command is invoked by using the user's login shell
with the -c option.  This applies to shell, command, or subsystem
execution.  It is most useful inside a Match block.  The command
originally supplied by the client is available in the
SSH_ORIGINAL_COMMAND environment variable.  Specifying a command
of ``internal-sftp'' will force the use of an in-process sftp
server that requires no support files when used with
ChrootDirectory.
    • 2
  3. Best Answer

    If you're looking to do it non-intrusively to the user's experience, take a look at a syslog substitute (e.g. syslog-ng). You can trigger the command on the log messages sent to syslog by the SSH server when someone logs in.

    This approach is a little rube-goldbergian, and depends on syslog working correctly. YMMV, IMHO, SLATFATF

    • 1

  4. You could change a user's shell such that a custom script was executed upon login. It could be the default shell for any user that needs it (I'd recommend keeping an admin account with bash to fix problems).

    • 0