How can I determine if a client SSH connection has a tty associated with it?

Question

Im writing a PAM module to handle authentication (server side - sshd) and I have to know if an ssh client is a tty (interactive) or not (non interactive).

Does anyone have a clue?

Answer 1

You could try checking for $SSH_TTY, but that isn't reliable.

$ ssh -6 fedoraplug.local
Last login: ......
-$ echo "${!SSH*}"
SSH_CLIENT SSH_CONNECTION SSH_TTY
-$ exit
$ ssh -6 fedoraplug.local 'echo "${!SSH*}"'
SSH_CLIENT SSH_CONNECTION
$ ssh -t -6 fedoraplug.local 'echo "${!SSH*}"'
SSH_CLIENT SSH_CONNECTION SSH_TTY
Connection to fedoraplug.local closed.

Answer 2

On the client side of things, you can use the tty command (manpage here). Assuming the session is interactive, this command would return something like:

breakthrough@lt0:~$ tty
/dev/pts/0

However, if the client is not interactive/tty-based, the command will return:

not a tty

---

For actually writing a PAM module, while tty does provide some exit codes that you can use, it's unlikely that you can use the tty command directly as a syscall; instead, you should take a look at the ttyname() (or ttyname_r()) function.

You can see a sample implementation of this function here which covers some general use cases. While it should be sufficient to see if a valid ttyname was returned, best practice would be to check if the error ENOTTY was raised, indicating that the passed file descriptor does not refer to a terminal device.

Answer 3

If you are writing in C:

man isatty

DESCRIPTION The isatty() function tests whether fd is an open file descriptor referring to a terminal.

RETURN VALUE isatty() returns 1 if fd is an open file descriptor referring to a terminal; otherwise 0 is returned, and errno is set to indicate the error.