8

Regarding /etc/ssh/sshd_config having specified within Banner /etc/issue

Since the SSH banner does not get presented until after entering the value for SSH login,

Is it possible to have a different (unique) banner presented based on the username entered for the SSH login?

Or is it possible to use specific banners based on the connecting IP address?

Is either of those somehow possible with the SSH version used in RHEL/CentOS 7.8 ?

1
  • actually what I think I really want is when anyone tries ssh root@myserver I want their ssh banner to be some fearful i know what you are doing, I have your ip address, i can track down who you are...
    – ron
    Jul 17 '20 at 13:57
18

well, if you mean show a different banner either per user or IP address connecting through ssh, you have options for these both as following using Match command;

  1. different banner based on username:

    # put in Match section like
    Match User sshUser
        Banner /path/to/specific_banner
    
  2. different banner based on IP address:

    # put in Match section like
    Match Address 10.20.30.0/24
        Banner /path/to/specific_banner
    

so, it's possible; you will just need to reload the sshd to take changes effect; if your sshd version has no reload command (in worst condition), you will need restart it.

5
  • 1
    Excellent +1 wish I could add more
    – roaima
    Jul 16 '20 at 18:10
  • oooh i like this. I had some problems previously using Match for other things in sshd_config and thought there was problems using multiple Match for different things in sshd_config
    – ron
    Jul 17 '20 at 13:59
  • you will need to restart sshd of course to take changes affect are you sure? OpenSSH's sshd version 7.9, as released by Debian 10 buster, have a reload command, to allow reloading configurations without restarting, it wouldn't surprise me if sshd as released by RHEL/CentOS have a similar feature (i thought they too used OpenSSH, but i don't really know)
    – hanshenrik
    Jul 17 '20 at 15:47
  • @hanshenrik yes, I'm aware of that reload command, that also should work. but didn't test that. Jul 17 '20 at 15:58
  • @hanshenrik yeah, reloading also working, just tested. Jul 18 '20 at 4:35
1

Another possibility would be (at least from my standpoint) defining some function for sshing which would print some banner before actually entering the ssh session. Just get creative if you need it.


Example function:

unalias ssh 2> /dev/null
ssh ()
{
    if ! { [ $# -eq 2 ] && [ -n "$1" ] && [ -n "$2" ]; } then
        # shellcheck disable=SC2016
        printf >&2 '%s\n' 'Expecting $1 = username, $2 = computer'
        return 1
    fi

    case "$1" in
        (user1) banner='This will be great SSH!' ;;
        (user2) banner='Enjoy your SSH session!' ;;
        (*)     banner='Some generic banner ...' ;;
    esac

    printf '%s\n' \
        "Entering SSH session as user $1 onto computer $2 ..." \
        "$banner"

    command ssh "$1"@"$2"
}

Example call:

ssh root 192.168.0.1

Example output:

Entering SSH session as user root onto computer 192.168.0.1 ...
Some generic banner ...


BusyBox v1.30.1 () built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt 19.07.3, r11063-85e04e9f46
 -----------------------------------------------------
4
  • 2
    But that would have to be implemented client-side on every single client, while the question asks about a server-side (sshd_config) banner.
    – TooTea
    Jul 17 '20 at 8:55
  • @TooTea I merely offer an alternative to the OP's requirement. Jul 17 '20 at 9:01
  • thanks for this. But my environment is everyone using putty in win10 and they ssh to my linux server. I want specific people (when the it weenies try ssh root@mysever) or from specific ip's, to get a different banner show up in putty in windows.
    – ron
    Jul 17 '20 at 13:52
  • instead of tcpwrap deny their ip, I want to instead provide them a politically incorrect banner :)
    – ron
    Jul 17 '20 at 13:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.