2

I'm using an embedded Linux distribution (Lime2) on a custom ARM board.

On login via SSH, the following is displayed:

root@mybox ~ # ssh localhost
root@localhost's password:

 _     _                  ____
| |   (_)_ __ ___   ___  |___ \
| |   | | '_ ` _ \ / _ \   __) |
| |___| | | | | | |  __/  / __/
|_____|_|_| |_| |_|\___| |_____|


welcome to mybox!
Last login: Wed May  4 19:50:28 2016 from localhost
Load: 1.01, 1.10, 0.86 - Board: 27.3°C - Memory: 929Mb
root@mybox ~ #

I'm wondering where the individual components of this prompt are coming from. This is what I figured out:

  • The password prompt line is coming from /bin/login, obviously
  • I have no idea about the Lime2 banner is coming from
  • The welcome message is what I entered into /etc/motd
  • The 'Last login' line is generated by /bin/login or some PAM service, I suppose
  • The 'Load' line I found hidden in /etc/bash.bashrc.custom

So... apart from /etc/motd, which other files are displayed or executed before spawning the login shell? Where is this Lime2 banner coming from?

  • search banner line from ssh config and post in your question – Rahul May 4 '16 at 18:22
2

You can use strace to show all open syscalls, which will print out all accessed files.

To trace a local login session, run this in a root shell:

strace -f -e open login 2>&1

To trace an ssh login session:

strace -f -e open -p <sshd_pid> 2>&1

For example, first determine the PID of the ssh daemon:

router:~# ps -ef | grep ssh
root      4816     1  0 May04 ?        00:00:00 /usr/sbin/sshd -D
root      6584  5941  0 01:18 ?        00:00:00 sshd: root@pts/0
root      6647  6381  0 01:23 pts/0    00:00:00 grep --color=auto ssh

Then trace using option -p followed by PID of sshd:

strace -f -e open -p 4816 2>&1

Now login using ssh from another terminal.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.