Home / server / Questions / 239861
In Process
Keith Palmer Jr.
Asked: 2011-02-25 09:32:47 +0800 CST

SSH ForceCommand example - require a user to enter a token before getting shell access?

  • 772

I'd like to prompt a user for some piece of information before they get to their BASH shell when they're logging in via SSH. Ideally, I'd like to execute a script which prompts them for information, check that the information is correct, and then if it is drop them to a shell. So, think:

ssh [email protected]
password: xxxx

do you agree to the terms and conditions of use? enter yes or no:
yes 

OK, here's your shell:
#

Can anyone provide an example of how to do something like this?

ssh

3 Answers

  1. Create new login script(/bin/bash_rest):

    #!/bin/bash

echo "do you agree to the terms and conditions of use? enter yes or no:"
read ans

case $ans in
        y|yes|Y|Yes) bash;;
        *) exit
esac

    and set as login shell:

    chmod +x /bin/bash_rest
usermod -s /bin/bash_rest ooshro

ooshro@ooshro:~$ ssh -p 2022 localhost
Linux ubuntu-1010-server-01 2.6.35-25-generic-pae #44-Ubuntu SMP Fri Jan 21 19:01:46 UTC 2011 i686 GNU/Linux
Ubuntu 10.10

Welcome to Ubuntu!
 * Documentation:  https://help.ubuntu.com/
Last login: Thu Feb 24 17:43:06 2011 from 10.0.2.2
do you agree to the terms and conditions of use? enter yes or no:
yes
ooshro@ubuntu-1010-server-01:~$ exit
Connection to localhost closed.
ooshro@ooshro:~$ ssh -p 2022 localhost
Linux ubuntu-1010-server-01 2.6.35-25-generic-pae #44-Ubuntu SMP Fri Jan 21 19:01:46 UTC 2011 i686 GNU/Linux
Ubuntu 10.10

Welcome to Ubuntu!
 * Documentation:  https://help.ubuntu.com/
Last login: Thu Feb 24 17:43:17 2011 from 10.0.2.2
do you agree to the terms and conditions of use? enter yes or no:
no
Connection to localhost closed.
    • 1

  2. Assuming for a moment that you're using opensshd, one possible alternative that does almost what you want, and is a lot simpler to implement, would be to use a login banner. This will not do exactly what you want it to do - it will display a text before the user logs in.

    You can alter your policy accordingly - "by logging in you are accepting these terms and conditions".

    You can do this using the "Banner" option in /etc/sshd/sshd_config. For example:

    # echo "Banner /etc/sshd/sshd-banner" >> /etc/sshd/sshd_config
# echo "By logging on you're accepting the terms and conditions." > /etc/sshd/ssh-banner
    • 1

  3. I would add some rudimentary logging to that bash script, and instead of making that script the default shell, I would consider /etc/ssh/sshrc or /etc/profile.local or /etc/profile. Testing is necessary, because behavior on different systems may vary. There are some reasons not to create non-standard shells, one of which is the need to add new shell to /etc/shells. Unless absolutely necessary, remain with shells defined in /etc/shells.

    • 0