I have about 30 nearly-identical CentOS 6 servers that I need to be able to push out updated config files automatically using an rsa key to log in as root. Usually this will just be rsync, but sometimes might have to run commands on the servers, so it needs ssh too. Since this will be run as a script to update all 30 servers, I don't want to have a passphrase on the key.

I have that part all working fine. I created the rsa key, added it to authorized_keys for root, so I can ssh or rsync to the servers without needing to type a password.

I have authorized_keys set to only accept the key from a single hostname, which should make this setup relatively secure. However, I'm still not totally comfortable with it, so would like to set it up to send an email to our shared tech mailbox every time this key is used.

There's lots of times that I'll be logging into these servers as myself, and su'ing to give myself root. This is fine, and don't want to spam the tech mailbox every time one of us logs in. I only want to get the emails when the SSH key is used.

Here's what I have so far, on server1[through 30].example.com:

cat /root/.ssh/authorized_keys
from="pusher.example.com",environment="SSHKEY=1" ssh-rsa AAAAB3NzaIwAAAxetcetc== root@pusher

tail -n 3 /root/.bash_profile
if [[ "${SSHKEY}" == "1" ]] ; then
echo 'Either we are getting hacked, or somebody used the SSH key on pusher to push something out to ' `hostname` ' at ' `date` | mail -s "WARNING - ROOT SSH KEY USED ON `hostname`!" techs@example.com

This works perfectly for SSH - If I putty in as myself and run su to get root, I don't get the email, but if I log into pusher, and run:

ssh -i /root/.ssh/server1.pri server1.example.com

I get an email. The problem is pushing files. If I run either of:

scp -i /root/.ssh/server1.pri /tmp/file.txt server1.example.com:/tmp/
rsync -e 'ssh -i /root/.ssh/server1.pri' /tmp/test.txt server1.example.com:/tmp/

I still don't get the email.

Is there a way, rather than relying on bash_profile, to set this up to send an email any time the key is used, for anything? (Or alternatively, only if it's used for scp or rsync, and I'll restrict the key to only run those?)


You can misuse /root/.ssh/rc for your purpose (see man sshd) and include a mailx command there.

| improve this answer | |
  • Perfect! All I had to do was move the code I had put into /root/.bash_profile into /root/.ssh/rc and it works great. Thanks! – JoeTomato Jul 13 '12 at 20:40
  • @JoeTomato Add the xauth-stuff outlined in the man-page if you ever need that for root. – Nils Jul 13 '12 at 20:42
  • You can also use /etc/ssh/sshrc for the same purpose of the ~/.ssh/rc file, which would allow you to perform commands when ANYONE logs in via ssh (rsync,scp,sftp,ssh...) – lornix Jul 14 '12 at 17:36
  • @lomix propably not a good idea - since you will have to provide xauth - that file is meant to replace that mechanism. – Nils Jul 14 '12 at 21:04
  • I've looked into it but just wanted to confirm, the xauth stuff is only if you're doing x11 forwarding? I dont think I need to worry about it as these servers don't have a GUI installed... Or am I wrong about what it is? – JoeTomato Jul 14 '12 at 22:18

From the sshd man page, 'authorized_keys' section:


Specifies that the command is executed whenever this key is used for authentication. The command supplied by the user (if any) is ignored. The command is run on a pty if the client requests a pty; otherwise it is run without a tty. If an 8-bit clean channel is required, one must not request a pty or should specify no-pty. A quote may be included in the command by quoting it with a backslash. This option might be useful to restrict certain public keys to perform just a specific operation. An example might be a key that permits remote backups but nothing else. Note that the client may specify TCP and/or X11 forwarding unless they are explicitly prohibited. The command originally supplied by the client is available in the SSH_ORIGINAL_COMMAND environment variable. Note that this option applies to shell, com‐ mand or subsystem execution. Also note that this command may be superseded by either a sshd_config(5) ForceCommand directive or a command embedded in a certificate.

You could add that option to your key, just as you've added the 'from' and 'environment' options:

cat /root/.ssh/authorized_keys
from="pusher.example.com",environment="SSHKEY=1" ssh-rsa AAAAB3NzaIwAAAxetcetc== root@pusher
| improve this answer | |

~/.bash_profile is used, if bash is invoked as an interactive login shell. ~/.bashrc is used for non-login shells. However, using that file is not a reliable, because attacker could require that the shell initialization files are not read at all.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.