I'm aware you can run your own scripts for the MOTD in /etc/update-motd.d and/or /etc/motd, but that's for displaying after a user has logged in.

The SSHD config file (/etc/ssh/sshd_config) allows you to set an option Banner, where it displays text before you successfully login. For example:

$ ssh user@host
This is a Banner message, that is displayed before login!

user@host's password:

As far as I know, the Banner option can only be a text file, I don't think it's possible for it to be a shell script or a .py file that is then run and displayed, or am I wrong?

Is there some way I can make the Banner option execute a script and display the output before login, like I descirbed above?

Just to clarify: Like with the MOTD, this Banner script would be run on the server's end, not the client's.

I was directed to this question, but:

This doesn't happen before the password prompt shows up, but auth modules are the first ones run after the password is entered.

So it's not exactly what I'm looking for, I want the output of the script to be displayed before the password prompt. The original question is similar to what I want, however.

My Linux server works with YouTube videos a lot, downloading and collecting data about them with the help of youtube-dl.

I want to route this program (youtube-dl) through an OpenVPN connection. Seems simple enough, except I need only youtube-dl to use the VPN connection, as I also run a web server among other things which cannot use the VPN connection.

How can I configure my server to only use the OpenVPN connection for youtube-dl?

Without a separate VM.

I don't have a static ip, so it changes sometimes, meaning I have to change things like port forwarding rules for my web server and SSH, etc. However this time, despite everything, it's not accessible from the internet. (I've changed my website's DNS records, changed all the port forwarding rules. Nothing else needed to be changed).

Here's the port forward rules - they just don't appear to be working.

I even put the server in my router's DMZ - still nothing.

All my programs seem to be working, I can access everything locally, just not on the internet. I double-checked my UFW rules, and they're all fine.

I have no additional firewalls.

My webserver uses Cloudflare's reverse proxy, but it's neither accessible through that, or when I directly connect to the server.

Do you think it's a problem with my ISP? This has only been happening for the last couple of hours.

I want traffic on my web server to be served securely. I'm running Ubuntu server 20.04 with Abyss Web Server, which has native support for using Let's Encrypt certificates.

I followed all the instructions found on their website exactly, but when trying to access it afterwards, it just gives a 403 error. When switching back to http, there are no problems - I can access the site perfectly fine. And the only thing I'm changing when switching from https to http is the dropdown box that says protocol (see the image below) then restarting the server.

443 is obviously open on my computer and router (otherwise I'd just be getting a timeout response)

No issues were encountered when generating the LE certificate. And the console is showing that everything is fine, when it's not.

All my web traffic goes through Cloudflare before reaching me - could that be what's causing the issue? If so, I'll just stick to http with Cloudflare, because of the extra security they provide, but this sounds like something that is wrong with my pc - something is not allowing https requests to actually access the website.

Cloudflare provides some encryption by themselves, however this is just between the user agent and the Cloudflare servers - there is none between Cloudflare and the origin server. I want end-to-end encryption.

So when you visit my site, it will say https, but this is only between the user and Cloudflare - the traffic between my server and Cloudflare is still plain old http on port 80.

Could it be some rule on my computer that I'm unaware of? It's a serverside issue I think, not anything to do with cloudflare. The documents path htdocs/ has never changed and is not in a position that requires elevated permissions to access on my computer. Like I said before - when I switch back to http on port 80, everything works fine. I don't change anything else.

For the time being, I have just switched my site back to http so it is accessible, until (hopefully) this issue can be solved.

Update:

Bypassing Cloudflare's proxying brought the same result - a 403 forbidden.

To provide some extra information which may help, here are my DNS records (with sensitive info crossed out):

My Let's Encrypt certificate has also now been fully verified, so it must be something like a permission or hostname issue.

I was going by this tutorial, looking at the sections for split tunneling with OpenVPN or Windows Powershell (IKEv2).

I'm relatively new to this sort of stuff, so I would really appreciate some help.

To do it, this website says to choose a subnet. I kind of understand what they are, but what I would like to do instead, is just route traffic on one or two ports (e.g. port 80 and/or port 21).

Preferably, I'd like to be able to do it by editing my OpenVPN config file (as the tutorial I linked above says, but instead with ports), but if that can't be done, I'll be happy if it can be done in Powershell with an IKEv2 connection instead.

I've seen some pretty good tutorials for Ubuntu that allow you to do this, but you can't apply them to Windows (because they use iptables, etc).

If possible, I'd like to do it on Windows, rather than switching to Linux.

Can anyone help me understand how to do this? Thanks.

Edit:

Would it be easier to route applications instead? (e.g. Route an app like Zoom around the VPN, but tunnel a game through VPN?) This is just an example, but is that more straightforward to do on Windows?

This Powershell command triggers the VPN connection when a specific app is opened:

Add-VpnConnectionTriggerApplication -Name "<VPNConnection>" –ApplicationID "<AppPath>"

So I assume what I want to do would look somewhat similar to this, except it only applies to that one app. (and it doesn't have to only be triggered when that app opens, it can stay on always).

It looks like I'm going to have to use this Powershell command. It's not exactly what I wanted but it doesn't seem I have any other choice. It's ridiculous that Windows doesn't have something that can do this.