Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Is there a possible way that I can execute a script, say abc.sh; as root user on every login to my system via SSH?

I've gone through a similar question which says to add the script execution to .bashrc file. This is not much helpful as I'd have to add it to every users' config file. Also, they'd still have ability to remove it.

Execution as root is not as important as denying the users' the power to stop its execution. The OS is debian, if that helps in any way.

share|improve this question
add comment

2 Answers 2

You could add the call into /etc/bash.bashrc - this is processed on every Bash login, so assuming your users are using Bash as their shell, it should run the script.

share|improve this answer
3  
.bashrc is only sourced when Bash is run as a non-login shell, so you might want to use /etc/profile? –  slhck Jul 14 '13 at 12:23
add comment

OpenSSH supports the ForceCommand configuration variable which might be set to the pathname of a script which

  1. Does something administrative — see below for details.
  2. Calls

    $(SHELL) -c "$SSH_ORIGINAL_COMMAND"
    

    or

    eval "$SSH_ORIGINAL_COMMAND"
    

    after that to actually perform the task the user intended to carry out.

Now the problem is that the forced command is executed with the credentials of the logged in user. To combat this, it's sufficient to use some sort of IPC to communicate with a daemon process, running as root. Unix-domain sockets appears to be a best bet for me as it actually allows transferring of the credentials before the actual data exchange takes place (by using the getsockopt(SO_PREERCRED) call). The downside is that you'll have to write a pair of tools to do that (well, the client part could be handled by socat).

See also this thread.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.