LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Security (https://www.linuxquestions.org/questions/linux-security-4/)
-   -   How do you turn off login banner for non-interactive ssh? (https://www.linuxquestions.org/questions/linux-security-4/how-do-you-turn-off-login-banner-for-non-interactive-ssh-470516/)

cpatter12 08-03-2006 02:55 PM
How do you turn off login banner for non-interactive ssh?
 
I have a requirement to have a login banner for interactive ssh logins. However, the banner also displays for non-interactive commands. Basically I run a script to get me status of processes running on multiple computers. I would like to see the status without seeing a login banner for every system. Is there a way to turn off the banner for non-interactive processes? :confused:

Thanks

live_dont_exist 08-04-2006 01:49 PM
cpatter...how about a couple of example commands here...1 on when you want the banner and one when you dont want it...I'm not quite clear on what you need...

Cheers
Arvind

cpatter12 08-07-2006 09:17 AM
I need the login banner when a user logs in via ssh.

ssh -l root nodename .
When I pass a command I don't want a login banner.

ssh root@nodename ps -ef .

jbivey 06-27-2007 02:09 PM
turning off login banner for non-interactive ssh
 
Have you figured this out yet? I have the same need and am having very little success finding any help.

chandramani_yadav 06-28-2007 03:16 AM
Hey , U cannot have both at a time . if u don't want the banner, just touch ".hushlogin"in the home directory of user . u won't get the banner .

jbivey 06-28-2007 10:25 AM
How do you turn off login banner for non-interactive ssh
 
Quote:
Originally Posted by chandramani_yadav
Hey , U cannot have both at a time . if u don't want the banner, just touch ".hushlogin"in the home directory of user . u won't get the banner .
I tried this and it doesn't work so I did some more investigation and found this about .hushlogin: "This file is used to suppress printing the last login time and /etc/motd, if PrintLastLog and PrintMotd, respectively, are enabled. It does not suppress printing of the banner specified by Banner".

If you have any other suggestions please let me know. Thanks!

sundalo1205 11-21-2007 01:30 AM
hi!
any solution to this? i also have this kind of problem. i hope you guyz can help me out.

thanks in advance!

jbivey 11-23-2007 11:27 AM
No, unfortunately I never figured this out.

sundalo1205 12-03-2007 01:01 AM
Quote:
Originally Posted by jbivey (Post 2968537)
No, unfortunately I never figured this out.
ssh -q
------
this answered my problem. risk is important errors will also be supressed.

scandalist 02-10-2012 08:17 PM
add "DebianBanner no" to /etc/ssh/sshd_conf

it bugged me too :)

jfkenneyjr 09-05-2012 12:04 PM
SSH Options
 
Quote:
Originally Posted by sundalo1205 (Post 2978172)
ssh -q
------
this answered my problem. risk is important errors will also be supressed.
This bothered me as well as I work with a lot of non-interactive sctipts that have logging that gets filled up with banners. I've found that if I use the SSH LogLevel option, I don't get the banners anymore. The SSH options can be passed through scp as well.

Try:
ssh -o LogLevel=Error <rest of cmd>
or
scp -o LogLevel=Error <rest of cmd>

koenpunt 01-16-2013 01:53 PM
The question is 'a bit' outdated, but I have two solutions using a custom shell wrapper.

1. Using .authorized_keys command

In ~/.ssh/authorized_keys you add the following before a specific key
Code:
command="/usr/local/bin/shell-wrapper" ssh-rsa AAAAB3NzaC1yc2EAA...JZK1E8H60=
And in /usr/local/bin/shell-wrapper
Code:
#!/bin/sh

# If there is a command given, it executes it with the users shell if no command
# given it outputs the contents of BANNER and starts the user's shell.

BANNER=/etc/issue.net

if [ -n "$SSH_ORIGINAL_COMMAND" ] ; then
  $SHELL -c "$SSH_ORIGINAL_COMMAND"
else
  cat $BANNER
  $SHELL
fi
2. Changing the users shell

Set shell for user (change USERNAME to your user):
Code:
usermod --shell /usr/local/bin/shell-wrapper USERNAME
Create /usr/local/bin/shell-wrapper with the following content:
Code:
#!/bin/sh

# If there are no arguments, it outputs the contents of BANNER and starts the specified shell
# When there is an argument given it executes it with the specified shell

BANNER=/etc/issue.net
SHELL=/bin/sh

if [ $# -eq 0 ]; then
  cat $BANNER
  $SHELL
else
  shift
  $SHELL -c "$@"
fi

ubix 02-16-2013 10:24 AM
@ koenpunt
 
Thank you for posting even when the thread was old,

I am in a fix, on one hand I cannot disable bannering from sshd_config and on the other hand brtools doesnt like the banners, so I am looking for a way to disable it for this one brtool user and I feel I am getting closer to finding a solution, with your help of course!

can you please elaborate on SSH_ORIGINAL_COMMAND?

Skaperen 02-17-2013 02:00 PM
I believe koenpunt's solution only applies to the banner produced by the remote shell, and not banners produced by the remote ssh daemon. Shells should automatically produce no banner unless invoked for interactive use.

If the problem banner is what the shell outputs, then there's nothing you can do at the local end but parse over this unusual thing. One way to do that is run a command line that the first command outputs an odd sentinel string that you can scan locally for to show only what follows it.

If the problem banner is what the ssh daemon outputs, you might get away with redirecting stderr to /dev/null. If you need the stderr output from the command, redirect that to stdout.
Code:
ssh userid@remote 'remotecommand args ... 2>&1' 2>/dev/null
If you want stdout and stderr to be kept separate from the remote command so you can store their output to separate files, this will be more complicated to do.

Hermann_It 04-05-2013 07:31 AM
2>/dev/null

only banner is removed.

PeterGodward 12-13-2016 01:27 PM
Remove the motd
 
Try removing /etc/motd
There is an option in /etc/sshd_config to PrintMotd no which if turned to yes prints the Message Of The Day twice.

c0wb0y 12-13-2016 02:24 PM
Rather than removing the motd file, why don't you configure sshd not to print motd?

Habitual 12-13-2016 03:15 PM
Code:
-q      Quiet mode.  Causes most warning and diagnostic messages to be suppressed.
Guess where?

Habitual 12-13-2016 03:18 PM
Code:
man ssh
...
-q      Quiet mode.  Causes most warning and diagnostic messages to be suppressed.
Code:
ssh -q user@host

pingu_penguin 12-14-2016 02:19 AM
I thought it was as simple as

# touch .hushlogin

in the users home folder ?

Habitual 12-14-2016 08:18 AM
Quote:
Originally Posted by pingu_penguin (Post 5641964)
I thought it was as simple as

# touch .hushlogin

in the users home folder ?
Giving away all our secrets? :rolleyes:

pingu_penguin 12-14-2016 02:35 PM
You can never beat americans at sarcasm , can you ?

:)


All times are GMT -5. The time now is 07:43 AM.