Hello.

This should be a simple question for you guys.

When someone ssh's into my linux box, I want it to do two things, put it in the MOTD file, and also log it somewhere so I can have a look.

Is this possible?

The reason I want it in the MOTD file is so basically it can warn the person doing so that there IP is x.x.x.x and it is being monitored.

Any ideas?

Thanks alot.

Craig

well, i know there's a section for configuring logging in the /etc/ssh/sshd_config file... there's also an option in there for selecting if you want the MOTD to be displayed for ssh clients...

but i'm not sure how you'd make it so that their IP appears in the MOTD they receive, though...

maybe just telling them that their IP has been logged could be enough?? actually, the psychological effect of having their IP address displayed is much more powerful, so it's definitely worth it to achieve this "personalized motd" thing...

i'm sure someone knows how to do this and will post the method...

i wanna learn to do it also, if i figure it out i'll let you know...

good luck...

...for the messages, edit

/etc/issue, /etc/issue.net

...for the logging

perhaps /var/log/secure helps you!?
there´s the ssh access listed

issue and issue.net are for local and telnet logins... sshd will usually display /etc/motd by default, AFAIK... as for the logging, on slackware the ssh login info (date, time, username, ip address, reverse dns, source port, etc.) is logged to /var/log/messages, i'm guessing it's probably the same on other distros, but i'm not sure... for the motd to display the ip address of the client you'd probably need a script to look at /var/log/messages (or wherever you're logging) and get the login's corresponding ip from there right after the login and then echo it - but i'm still not sure how to do this in a kosher manner... i suspect it could be done from the user's ~/.profile but then they'd require read permission to the logfile and that would really suck...

(thinking-out-loud) maybe we should look into the "banner" option in /etc/ssh/sshd_config... i think it might be possible to run the script from there for every user upon login... in fact, i think you could show the banner even before they enter the password, and the banner could include the IP like you want...

oops...you´re right! :-)

FC is /var/log/secure

Hi guys,

Thanks for your replies. You are right, it does log the IP etc in /var/log/messages when someone logs in using ssh, and you can set the banner up in sshd_config, which basically runs a script that you point it to. Problem is that I'm not that good at scripting

I'll let you know if I manage to figure it out.

Thanks again.
Craig