1

I'd like to, as the administrator of an OpenBSD ssh jumphost used by multiple people, run a specific command any time any user connects via SSH, even if just for tunneling.

Is this possible?

I've tried using ForceCommand and /etc/sshrc but these seem only to apply when the user has an interactive session and not otherwise.

Because I'm running OpenBSD, nothing PAM-based will work unfortunately, i.e. This answer on Unix & Linux

The script just runs sendmail using the whoami and $SSH_CONNECTION to inform me of who logged in and from where.

#!/bin/sh

[email protected]

sendmail -F alerts -f $EMAIL root << EOF
Subject: New Login For $1
Message-ID: <$(date +%s)@$(hostname)>
X-Mailer: OpenSMTPD
Content-Type: text/plain

There has been a new login for $1 on $SSH_CONNECTION
EOF
2
  • What is this command's purpose, what does it do, what environment does it require? (And, I assume OpenBSD's sshd does not use PAM?) May 28, 2019 at 19:36
  • Please add the OS specification
    – Daniel K
    May 28, 2019 at 19:39

1 Answer 1

0

You can monitor /var/log/authlog and use awk to send you a message whenever a specific line matches:

tail -f /var/log/authlog | awk '/Accepted pubkey/ { system("mail -s " $0 " [email protected] << EOF\nEOF") }'

You can of course replace /Accepted pubkey/ with some other pattern that fits your case. I chose to send empty emails with the log line as a subject, for easier reading on the MUA, but you might prefer something like

system("mail -s New\\ Login [email protected] << EOF\n" $0 "\nEOF")
3
  • This seems like exactly what I want! Will this work when the log rotates or will it need to be restarted?
    – Tookmund
    Jun 18, 2019 at 17:08
  • Looks like my version of OpenSSH (8.0) uses "Accepted publickey" not "Accepted pubkey"
    – Tookmund
    Jun 18, 2019 at 18:00
  • I hadn't thought of log rotation. I'm guessing it needs restarting, since newsyslog will create a new empty file, with a different inode, and the original inode will be gone.
    – Zé Loff
    Jun 19, 2019 at 10:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .