SSH client connection without banner (on client)

Question

I am developing a simple script, which connects to certain computers and executes, through an ssh session, certain commands:

sshpass -p 'password' ssh $target_ip << EOF
    echo \$PATH
    # example
    echo \$HOSTNAME
    [...]
EOF

The operation is correct, but it bothers me that on each connection it shows the ssh server banner and interferes with the rest of the script's stdout:

Welcome to Ubuntu 20.04.2 LTS (GNU/Linux 5.4.0-81-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

  System information as of Wed Nov 23 11:58:14 CET 2022

  System load:  0.44               Processes:             131
  Usage of /:   9.2% of 108.79GB   Users logged in:       0
  Memory usage: 26%                IPv4 address for br0:  172.16.20.11
  Swap usage:   0%                 IPv4 address for br0:  10.130.1.1
  Temperature:  36.0 C             IPv4 address for tun0: 10.130.0.27

 * Strictly confined Kubernetes makes edge and IoT secure. Learn how MicroK8s
   just raised the bar for easy, resilient and secure K8s cluster deployment.

   https://ubuntu.com/engage/secure-kubernetes-at-the-edge

241 updates can be installed immediately.
134 of these updates are security updates.
To see these additional updates run: apt list --upgradable


The list of available updates is more than a week old.
To check for new updates run: sudo apt update
New release '22.04.1 LTS' available.
Run 'do-release-upgrade' to upgrade to it.

Therefore, I do not want that banner to be displayed and only the outputs of the commands I execute inside the EOF.

Just in case it was relevant, the version of SSH I'm using is OpenSSH_9.1p1, OpenSSL 3.0.7 1 Nov 2022. In the case of the server, it is OpenSSH_8.2p1 Ubuntu-4ubuntu0.3, OpenSSL 1.1.1f 31 Mar 2020.

I don't want to remove the banner from the server, which could be done in the sshd configurations. What I want is for the client, in the script, to disable banner printing.

However, the ssh line options that have worked for others (i've been here and here) have not worked for me:

ssh -o LogLevel=error $ip

Also:

ssh -q $ip

How can I disable this at the client level? is there no ssh option or parameter that will allow me to do this? and in case of no, how can I redirect this stdout to /dev/null without touching the outputs of the commands I execute inside the EOF?

Answer 1

A banner before SSH authentication comes from the Banner option in sshd_config of the SSH server. Without changing the configuration of the server you cannot make the server not send it to you. Your client should print it to stderr, so 2>/dev/null will suppress it locally, but it will also suppress other messages ssh (and sshpass in your case) prints to stderr.

A banner after SSH authentication most likely comes from some startup script of the remote shell.^* If ssh "$target_ip" date shows you such banner then you should review startup scripts on the server, find the code responsible for printing the banner and fix it. If the culprit is in some global script (in /etc), creating a corresponding private script (in your $HOME) may allow you to change the behavior. Refer to the documentation of the shell being your login shell on the server.

If ssh "$target_ip" date does not show you the banner, this means the current relevant script suppresses the banner for a non-interactive shell. You can use this fact to silence the banner without changing anything on the server.

Your sshpass -p 'password' ssh $target_ip << EOF does not pass any initial command to the remote side, so the SSH server starts an interactive shell for you that reads its stdin and only then the here-document is consumed.

To start a non-interactive shell, pass a command. It should be the shell you want to use and you should make sure it doesn't start interactively. It's probably better not to rely on the remote value of $SHELL or anything, because you locally know what shell your here-document is for. The original remote shell is no longer needed, so exec is a good idea.

In the below example the requested shell is bash. It will not start interactively because its standard input is not a tty (for comparison: the remote shell that caused the issue started interactively regardless of tty because the SSH server explicitly requested this).

sshpass -p 'password' ssh "$target_ip" 'exec bash' << EOF
    echo \$PATH
    # example
    echo \$HOSTNAME
    [...]
EOF

---

* In general one's formal default shell on a server may be anything, e.g. a wrapper over bash that prints something unconditionally, independently of startup scripts, and then runs bash. It's an exotic scenario, yet possible. Most likely it's not the case.