0

I am trying to get my Amazon Linux 2023 server to update the MOTD on login, not on a timer or by fiddling with the profile. I want a clean experience for users whether they re-exec their shell, or sudo.

Improve this question

2 Answers 2

Reset to default
3

This is usually only an issue on machines where people log on primarily remotely. So, the right place to do this is not PAM, but the login shell – exactly the profile you don't want to "fiddle" with. Fiddling with PAM is the hackish approach here – /etc/profile is exactly what you need - a thing that is only executed for login shells (not when someone logs in and doesn't open an interactive shell). And: PAM is for checking the authenticity of a user. Not for doing administrative things there. Bit of separation of concerns, please!

Regarding clean experience: I'm a user myself. The first thing I do is disable motd printing if at all possible. It messes with my workflow, nothing written there has ever been so relevant to me that it wouldn't have been better to print it when I asked for it (why would I care when the last time was I logged in, and from which IP address? If I cared, I would look into the last logins, or read my shell's history, and the IP addresses I'm using to log in are mostly dynamic and thus completely void of any information).

To top it off, motd printing often messes with automated tools like git fetch-pack, emacs' TRAMP mode, or remote debugging.

Improve this answer
1
  • Hey good points. The mess of what gets sourced when for different shells is annoying. I'll reference that and try for /etc/profile. I didn't want it to show up every time someone changed users however if they were already logged in (the bad practice sudo su) for example. Thanks for your answer, Cunningham's Law works!
    – four43
    Commented Jul 18 at 13:11
0

We can use PAM to execute a custom script on login:

  1. Ensure update-motd is installed via your package manager.

  2. Edit the PAM config for SSH

/etc/pam.d/sshd:

...
session    required     pam_selinux.so open env_params
session    required     pam_namespace.so
session    optional     pam_keyinit.so force revoke
session    optional     pam_exec.so   /usr/sbin/update-motd
session    optional     pam_motd.so
...

Just ensure the line session optional pam_exec.so /usr/sbin/update-motd is aboce the pam_motd.so line.

  1. Restart sshd.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .