4

I have a custom shell in /bin/that returns an echo and exists. I have a user that is exclusively linked to that shell only so that when someone tries to ssh into the server using that user via pubkey only, the custom shell will echo something and exit immediately (closes the ssh conenction right after the echo).

The problem is that it's working but it's showing the default Ubuntu MOTD / Banner after the authentication, while i only want to return the echo.

expected

local@sever:~$ ssh honeypot@remote-server
Welcome 1.2.3.4 | you've been logged
Connection to remote-server closed.
local@server:~$

what is happening

local@sever:~$ ssh honeypot@remote-server
Welcome to Ubuntu 16.04.x LTS (GNU/Linux x.x.x-xxx-generic x86_64)

* Documentation:  https://help.ubuntu.com
* Management:     https://landscape.canonical.com
* Support:        https://ubuntu.com/advantage

Get cloud support with Ubuntu Advantage Cloud Guest:
http://www.ubuntu.com/business/services/cloud

6 packages can be updated.
0 updates are security updates.

New release '18.04.1 LTS' available.
Run 'do-release-upgrade' to upgrade to it.


*** System restart required ***
Last login: Thu Oct 2 01:08:16 2017 from 1.2.3.4
Welcome 1.2.3.4 | you've been logged
Connection to remote-server closed.
local@server:~$

Note: i don't want to disable MOTD/Banner for all other users and I've tried the Match User honeypot Banner none in sshd, it didn't work. Also tried the /etc/profile thingy where I check for this user using whoami.

Edit: I found a workaround, posted as an answer but I'm still looking for an appropriate answer.

3
  • Different workaround: you can disable banner in /etc/ssh/sshd_config and put it in /etc/bashrc. This won't display banner for all users but only for these which are using bash (and of course fro these who in .bashrc source /etc/bashrc)
    – mrc02_kr
    Oct 11, 2018 at 9:02
  • 2
    The message looks more like it's coming from /etc/motd, and not from sshd. In that case, touch ~honeypot/.hushlogin will suppress it.
    – D_Bye
    Oct 11, 2018 at 9:11
  • @D_Bye feel free to post it as an accepted answer, along with a small explanation about the .hushlogin please. P.S: i don't have a motd file in /etc/ but it worked.
    – Viktova
    Oct 11, 2018 at 9:36

2 Answers 2

Reset to default
9

There are a few places that login messages may come from. If configured, the ssh banner is displayed first, followed by the contents of /etc/motd (this is a text file that is either created and maintained by the administrator, or it may by generated periodically by a script. I think Ubuntu uses a different approach - man motd might shed some light...).

Finally, the user's shell rc files may display further messages, either directly, or by calling other utilities.

If it's configured, the ssh banner can either be disabled globally by setting Banner none in the config file, or for finer control, you can use something like

Match User honeypot
    Banner none

In either case, restart sshd to pick up the changes.

If you want to suppress /etc/motd for an individual user, create a file in that user's home directory called .hushlogin. If this file exists, the login program will not display the contents of /etc/motd, before it starts a login shell. If the user can login and get a terminal, they are free to remove the file.

0

workaround

local@sever:~$ ssh honeypot@remote-server <*>
Welcome 1.2.3.4 | you've been logged
local@server:~$

<*>: is literally any command, word or number.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .