7

Our team decided to add a welcome banner to all our hosts. A team member, instead of adding the message in /etc/motd added the message with echo in ~/.cshrc.

This is breaking scp between the hosts. Can someone explain how this is breaking scp? Is cshrc loaded even when you do scp ? And how will some echo messages in it break it?

I am not aware of the internal workings of scp.

The message we added in ~/.cshrc :

echo "##############################################################################"
echo "                              Alert! Aler! Alert! Alert! Alert! Alert!"
echo "This is a restricted box, any actions performed here will be reported to xxx@yyy.com"
echo "##############################################################################"
  • 4
    Related: suppress startup messages on stdout . The .cshrc file is always read, even in non-interactive shells like the ones started by scp. Anything that may produce output, such as echo or stty, needs be be inside an if ($?prompt ) statement. There are other, safer ways to display banner messages (such as the Banner directive in the ssh server config), but an admin needs to set this up. – Mark Plotnick Mar 31 '17 at 9:41
  • Which machine(s) have the echo commands in their .cshrc: the local machine running scp , and/or the remote server? Please describe "breaking": what exact scp command is run, and what output/error message is produced? – JigglyNaga Mar 31 '17 at 9:44
  • @JigglyNaga here is the output [aime@abc ~]$ scp 20160830210005defaults.conf aime@xyz:/scratch/aime aime@xyz's password: ######################################################################################################## – tarunkt Mar 31 '17 at 10:04
  • 4
    Your colleague made a typo in the banner, too. Might I suggest greater attention to detail in your organisation? And some peer review? – Lightness Races in Orbit Mar 31 '17 at 16:58
19

Commands running on top of the ssh transport do not expect large amounts of output before they can start their server. This will affect a number of utilities.

The solution is to have your administration team print the message only if stdout is connected to a terminal.

if ( $?prompt ) then
    echo "Secure machine message..."
    echo "More warnings"
    echo "Etc."
endif

Better still, you wouldn't put this in .cshrc at all, but instead the message content itself would go in /etc/issue.net, which is displayed before login. This may need enabling in /etc/ssh/sshd_config though, with a line like this:

Banner /etc/issue.net
  • What are "large amounts of data"? – Max Ried Apr 1 '17 at 7:41
  • @MaxRied I'd suggest that at best it's anything much larger than a prompt. For some commands it may be anything at all. I don't know exactly - I've never measured it. – roaima Apr 1 '17 at 13:14
7

You cannot print anything in non-interactive session. That breaks any clients that use a strict protocol, such as SFTP or SCP.


Use /etc/motd (which is used for interactive sessions only).

Or use sshd_config directive Banner.

Or test for interactive session before printing anything (e.g. by testing an existence of TERM or prompt variables).


For background, see my answer to Server Fault question SSH MOTD per user.

1

I believe that you have to place the lines ABOVE anything in the .cshrc file, because otherwise, it will not allow you to do sftp or ftp or whatever, because it is an interactive shell:

These errors are usually caused by commands in a shell run-control file (.cshrc, .profile, .bashrc, etc.) that produce output to the terminal. This output interferes with the communication between the SSH daemon and the sftp-server subsystem. Examples of such commands might be date or echo. If you use the mail command to check for mail, it can cause the error, too.To solve this problem, you should place any commands that will produce output in a conditional statement that is only executed if the shell is interactive. (ALL FIXES NEED TO BE at the TOP of the control files for the shell in question.

Brian Baker

0

It's in ~/.cshrc. I believe that makes fixing this easy. Change the code in ~/.cshrc to read

echo 1>&2 "##############################################################################"
echo 1>&2  "                              Alert! Aler! Alert! Alert! Alert! Alert!"
echo 1>&2  "This is a restricted box, any actions performed here will be reported to xxx@yyy.com"
echo 1>&2  "##############################################################################"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.