TransWikia.com

how to use different SSH banner for various SSH connections?

Unix & Linux Asked on October 31, 2021

Regarding /etc/ssh/sshd_config having specified within Banner /etc/issue

Since the SSH banner does not get presented until after entering the value for SSH login,

Is it possible to have a different (unique) banner presented based on the username entered for the SSH login?

Or is it possible to use specific banners based on the connecting IP address?

Is either of those somehow possible with the SSH version used in RHEL/CentOS 7.8 ?

2 Answers

well, if you mean show a different banner either per user or IP address connecting through ssh, you have options for these both as following using Match command;

  1. different banner based on username:

    # put in Match section like
    Match User sshUser
        Banner /path/to/specific_banner
    
  2. different banner based on IP address:

    # put in Match section like
    Match Address 10.20.30.0/24
        Banner /path/to/specific_banner
    

so, it's possible; you will just need to reload the sshd to take changes effect; if your sshd version has no reload command (in worst condition), you will need restart it.

Answered by αғsнιη on October 31, 2021

Another possibility would be (at least from my standpoint) defining some function for sshing which would print some banner before actually entering the ssh session. Just get creative if you need it.


Example function:

unalias ssh 2> /dev/null
ssh ()
{
    if ! { [ $# -eq 2 ] && [ -n "$1" ] && [ -n "$2" ]; } then
        # shellcheck disable=SC2016
        printf >&2 '%sn' 'Expecting $1 = username, $2 = computer'
        return 1
    fi

    case "$1" in
        (user1) banner='This will be great SSH!' ;;
        (user2) banner='Enjoy your SSH session!' ;;
        (*)     banner='Some generic banner ...' ;;
    esac

    printf '%sn' 
        "Entering SSH session as user $1 onto computer $2 ..." 
        "$banner"

    command ssh "$1"@"$2"
}

Example call:

ssh root 192.168.0.1

Example output:

Entering SSH session as user root onto computer 192.168.0.1 ...
Some generic banner ...


BusyBox v1.30.1 () built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt 19.07.3, r11063-85e04e9f46
 -----------------------------------------------------

Answered by LinuxSecurityFreak on October 31, 2021

Add your own answers!

Ask a Question

Get help from others!

© 2024 TransWikia.com. All rights reserved. Sites we Love: PCI Database, UKBizDB, Menu Kuliner, Sharing RPP