/etc/issue.net print out a warning message to sshed users & log their ip

englishexe · 01-13-2024, 02:52 PM

So I have just installed Debian Linux (CLI) onto a spare laptop acting as a mini server and to "scare" off intruders I want to output something along the lines of:

Code:

===========================================================
---          Unauthorised Access Is Prohibited          ---
--- It is against the law to secure unauthorised access ---
---             (Computers Misuse Act 1990)             ---
===========================================================
This connection has been logged. (\4)

= Metrics =
Users logged in: \u

= Machine =
Debian 12 (\s) (v\r)

The issue I'm noticing is that when physically using the computer it outputs correctly with the correct information but when SSHing in (tried pUTTY and normal Windows Command line) it outputs the literal text ("\u" instead of ("1") how can I fix this?

I also would like to save the user's IP in a file so I can block them from my network if they attempt to log in

Thanks

michaelk · 01-13-2024, 03:48 PM

Why would you want to display any sort of information except for the warning message prior to login? Did you configure the banner in the sshd_config for /etc/issue.net? Not that any warning will scare off any sort of bot.

Is ssh only available on your LAN or is it also available over the internet?

ssh login information including IP address is located in the /var/log/auth.log.

boughtonp · 01-13-2024, 04:15 PM

That header is pointless.

Install fail2ban.

jayjwa · 01-15-2024, 11:41 AM

As I recall, ssh doesn't parse what's in the Banner setting in sshd_config. /etc/issue is for local logins, parsed by a/getty; /etc/issue.net is for remote. 99.9% of the hits against a sshd are bots. You are wasting time and CPU cycles chasing ghosts with IP bans. People rent out VPSs, do their dirt, and get their accounts closed in a number of days. The next customer gets that IP and the ssh scanner is gone on to another IP and the cycle continues. Use key login only and forget about it. The days of one user = one set IP are long gone.