1

I'd like to, as the administrator of an OpenBSD ssh jumphost used by multiple people, run a specific command any time any user connects via SSH, even if just for tunneling.

Is this possible?

I've tried using ForceCommand and /etc/sshrc but these seem only to apply when the user has an interactive session and not otherwise.

Because I'm running OpenBSD, nothing PAM-based will work unfortunately, i.e. This answer on Unix & Linux

The script just runs sendmail using the whoami and $SSH_CONNECTION to inform me of who logged in and from where.

#!/bin/sh

EMAIL=alerts@example.com

sendmail -F alerts -f $EMAIL root << EOF
Subject: New Login For $1
Message-ID: <$(date +%s)@$(hostname)>
X-Mailer: OpenSMTPD
Content-Type: text/plain

There has been a new login for $1 on $SSH_CONNECTION
EOF

migrated from superuser.com Jun 5 at 19:32

This question came from our site for computer enthusiasts and power users.

  • What is this command's purpose, what does it do, what environment does it require? (And, I assume OpenBSD's sshd does not use PAM?) – grawity May 28 at 19:36
  • Please add the OS specification – Daniel K May 28 at 19:39
0

You can monitor /var/log/authlog and use awk to send you a message whenever a specific line matches:

tail -f /var/log/authlog | awk '/Accepted pubkey/ { system("mail -s " $0 " admin@example.com << EOF\nEOF") }'

You can of course replace /Accepted pubkey/ with some other pattern that fits your case. I chose to send empty emails with the log line as a subject, for easier reading on the MUA, but you might prefer something like

system("mail -s New\\ Login admin@example.com << EOF\n" $0 "\nEOF")
  • This seems like exactly what I want! Will this work when the log rotates or will it need to be restarted? – Tookmund Jun 18 at 17:08
  • Looks like my version of OpenSSH (8.0) uses "Accepted publickey" not "Accepted pubkey" – Tookmund Jun 18 at 18:00
  • I hadn't thought of log rotation. I'm guessing it needs restarting, since newsyslog will create a new empty file, with a different inode, and the original inode will be gone. – Zé Loff Jun 19 at 10:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.