I'd like to, as the administrator of an OpenBSD ssh jumphost used by multiple people, run a specific command any time any user connects via SSH, even if just for tunneling.

Is this possible?

I've tried using ForceCommand and /etc/sshrc but these seem only to apply when the user has an interactive session and not otherwise.

Because I'm running OpenBSD, nothing PAM-based will work unfortunately, i.e. This answer on Unix & Linux

The script just runs sendmail using the whoami and $SSH_CONNECTION to inform me of who logged in and from where.



sendmail -F alerts -f $EMAIL root << EOF
Subject: New Login For $1
Message-ID: <$(date +%s)@$(hostname)>
X-Mailer: OpenSMTPD
Content-Type: text/plain

There has been a new login for $1 on $SSH_CONNECTION
  • What is this command's purpose, what does it do, what environment does it require? (And, I assume OpenBSD's sshd does not use PAM?)
    – user1686
    May 28 '19 at 19:36
  • Please add the OS specification
    – Daniel K
    May 28 '19 at 19:39

You can monitor /var/log/authlog and use awk to send you a message whenever a specific line matches:

tail -f /var/log/authlog | awk '/Accepted pubkey/ { system("mail -s " $0 " admin@example.com << EOF\nEOF") }'

You can of course replace /Accepted pubkey/ with some other pattern that fits your case. I chose to send empty emails with the log line as a subject, for easier reading on the MUA, but you might prefer something like

system("mail -s New\\ Login admin@example.com << EOF\n" $0 "\nEOF")
  • This seems like exactly what I want! Will this work when the log rotates or will it need to be restarted?
    – Tookmund
    Jun 18 '19 at 17:08
  • Looks like my version of OpenSSH (8.0) uses "Accepted publickey" not "Accepted pubkey"
    – Tookmund
    Jun 18 '19 at 18:00
  • I hadn't thought of log rotation. I'm guessing it needs restarting, since newsyslog will create a new empty file, with a different inode, and the original inode will be gone.
    – Zé Loff
    Jun 19 '19 at 10:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.