SSH Banner function

raiak · 03-17-2014, 05:43 AM

Hi

I would like to send a banner to a client after 2 failed password attempts. I know how to send a banner before authentication and after authentication. But I don't know if I can send a banner at any time I want, in my case after 2 failed password.

thanks in advance!!

MensaWater · 03-17-2014, 12:39 PM

I'd suggest you do NOT want to do that.

If someone bad is trying to hack your system you do NOT want to give them clues as to WHY they are being unsuccessful. This is why most system just tell you "login failed" rather than "invalid user" or "invalid password". No point in telling them which part they GUESSED correctly.

If you really do want to do it anyway you could probably muck with pam modules to do what you want.

szboardstretcher · 03-17-2014, 01:43 PM

Agreed.

I display a scary warning message before the prompt. I stole this off of Centos or Redhat a long time ago.

Quote:

WARNING : Unauthorized access to this system is forbidden and will be
prosecuted by law. By accessing this system, you agree that your actions
may be monitored if unauthorized usage is suspected.

Dont ever tell a user what they are doing wrong with regards to login attempts. If you really want something informative,.. make a message that says 'see systems administrator'.

padeen · 03-17-2014, 07:53 PM

I don't want to give a standard banner that uniquely identifies me, so I have a cron script that writes generic output, such as the output of `fortune`, to a banner file every day. Ssh uses that banner.

The idea is that an IP scanner will never receive output that uniquely identifies me. They can still get me from the IP address of course, but nothing from a file containing several million IP addresses and output that they can grep.