how to use different SSH banner for various SSH connections?

Question

Regarding /etc/ssh/sshd_config having specified within Banner /etc/issue

Since the SSH banner does not get presented until after entering the value for SSH login,

Is it possible to have a different (unique) banner presented based on the username entered for the SSH login?

Or is it possible to use specific banners based on the connecting IP address?

Is either of those somehow possible with the SSH version used in RHEL/CentOS 7.8 ?

Answer 1

well, if you mean show a different banner either per user or IP address connecting through ssh, you have options for these both as following using Match command;

1. different banner based on username:

   # put in Match section like
   Match User sshUser
       Banner /path/to/specific_banner
   

2. different banner based on IP address:

   # put in Match section like
   Match Address 10.20.30.0/24
       Banner /path/to/specific_banner
   

so, it's possible; you will just need to reload the sshd to take changes effect; if your sshd version has no reload command (in worst condition), you will need restart it.

Answer 2

Another possibility would be (at least from my standpoint) defining some function for sshing which would print some banner before actually entering the ssh session. Just get creative if you need it.

---

Example function:

unalias ssh 2> /dev/null
ssh ()
{
    if ! { [ $# -eq 2 ] && [ -n "$1" ] && [ -n "$2" ]; } then
        # shellcheck disable=SC2016
        printf >&2 '%s\n' 'Expecting $1 = username, $2 = computer'
        return 1
    fi

    case "$1" in
        (user1) banner='This will be great SSH!' ;;
        (user2) banner='Enjoy your SSH session!' ;;
        (*)     banner='Some generic banner ...' ;;
    esac

    printf '%s\n' \
        "Entering SSH session as user $1 onto computer $2 ..." \
        "$banner"

    command ssh "$1"@"$2"
}

Example call:

ssh root 192.168.0.1

Example output:

Entering SSH session as user root onto computer 192.168.0.1 ...
Some generic banner ...


BusyBox v1.30.1 () built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt 19.07.3, r11063-85e04e9f46
 -----------------------------------------------------