[SOLVED] How to detect if logged in via ssh?

ccargo · 08-04-2009, 11:30 AM

Hi!

This probably has an easy solution.. I want my bash prompt to reflect if I am logged in via ssh or not.

I have tried checking if $SSH_CLIENT is set, but this does not work if I su to root after logging in on a remote machine ($SSH_CLIENT will not be set for root in that case).

A second option I've tried is simply checking if $SCREEN is set, this works well on remote clients. However, when I su to root on my local machine, $SCREEN is no longer set so I get a false alarm.

I'd be grateful for any suggestions.

Cheers

deesto · 08-04-2009, 03:24 PM

Quote:

Originally Posted by ccargo

This probably has an easy solution.. I want my bash prompt to reflect if I am logged in via ssh or not.

What about simply:

Code:

 w|grep ssh|grep -v grep

If it returns anything, you can see who is logged in via ssh.

ccargo · 08-04-2009, 04:11 PM

Thanks for your reply!

However, 'w' does not return the word 'ssh' in my case. The 'FROM' field simply states the host from which I am logged in, and that varies.

Also, I just realised that I can avoid the problem (without actually solving it) by using 'su' instead of 'su -' when switching to the superuser as that leaves $SSH_CLIENT intact.

chrism01 · 08-04-2009, 09:11 PM

... but in that case you don't get root's env, (specifically PATH) ...

ccargo · 08-05-2009, 01:43 AM

No, I don't. So I'm still interested in finding an actual solution. At least if there's a reasonably straightforward one

maddes.b · 08-05-2009, 06:58 AM

This should work on any full Linux (like Debian):

Code:

#!/bin/sh

# check if this script is run from inside a client session
PROG='/usr/sbin/sshd'
pid="$$"
while [ "${pid}" -ne 0 ]
 do
	# get parent process id
	pid=`cut -d ' ' -f 4 "/proc/${pid}/stat"`
	[ "${pid}" -eq 0 ] && break

	# check if client connection
	ps -f -p "${pid}" | grep "${PROG}" >/dev/null
	[ $? -eq 0 ] && break
done
[ "${pid}" -ne 0 ] && echo "Logged in via ${PROG}"

On embedded machines with Busybox the ps command may not support the -f switch.
For BusyBox use :

Code:

ps | grep -e "^[ ]*${pid} " | grep "${PROG}" >/dev/null

Maddes

deesto · 08-05-2009, 08:18 AM

maddes, JFYI: that script would throw up multiple chunks if run on a Mac (ps options and no proc) ... but Darwin isn't really Linux

Incidentally, my simple 'w' line above would do the trick in Darwin but not for Linux.

maddes.b · 08-06-2009, 03:25 AM

Thanks deesto for the info.
I'm mainly working on Debian GNU/Linux, so do not know much about Darwin.
According to ccargo's profile he is using Slackware, I hope that my solution will work on it.

What to do if you encounter problems with this:
If ps doesn't support "-p" to select a specific pid, then make sure that it lists all pids and grep it as mentioned for Busybox.

If ps doesn't support "-f" to print the executable, then check for other options to do so.
If not possible then reduce the program check to just the name (sshd instead of /usr/bin/sshd). Note that a script called "sshd" could lead to a false positive here.

If /proc is not available, then try to get parent pid via ps and sed.

If all fails maybe you can find other ways/commands to go up the process tree to check for the login method.
Good luck.

ccargo · 08-10-2009, 03:45 AM

Thank you maddes.b! Your script works perfectly on my machines (and yes, they are running Slackware). Thanks also to deesto and chrism01. I'm marking this thread as solved.

Thanks once again!