2

I added the following line to my sshd_config:

...
ForceCommand /bin/ssh-alert
...

the ssh-alert file looks like this

#!/bin/bash
SSH_IP=$(echo $SSH_CLIENT | head -n1 | awk '{print $1;}')
yowsup-cli demos -c $YOWSUP_CONF -s $PHONENUMBER "SSH Alert! Login from IP $SSH_IP" > /dev/null 2>&1

#the important part:
/bin/bash --login

Now the problem is that if I start a SSH session in the program MobaXTerm the SFTP window is empty and after closing the ssh session it says: Waiting for the pending transfer to complete....

If I change /bin/bash --login in the ssh-alert file to /bin/bash (without --login) It works again, but my .bashrc, .bash_profile, /etc/bash.bashrc won't get sourced.

Is there a way to only execute ForceCommand if it is a SSH session and not a SFTP session. Or a way to check if it is a SFTP session in my bash script.

NOTE: My .bash_profile has a command with output. If I would disable that output it would work again.

EDIT: FileZilla SFTP does not work, too!

1

Is there a way to only execute ForceCommand if it is a SSH session and not a SFTP session.

No.

Or a way to check if it is a SFTP session in my bash script.

This is what $SSH_ORIGINAL_COMMAND is for. You should be able to differentiate using that if the command is SFTP or not

NOTE: My .bash_profile has a command with output. If I would disable that output it would work again.

That is the problem which is breaking SFTP protocol. You should not generate any output if the shell is not interactive:

if [ "$PS1" ]; then
  # generate output
fi
5
  • $SSH_ORIGINAL_COMMAND is always empty in my case. I changed my bash_profile so the command only executes if [ "$PS1" ];. Now I don't even get a SFTP connection. – Scrumplex Feb 6 '17 at 11:36
  • You can use the $PS1 in your script too to detect if it is interactive or not. – Jakuje Feb 6 '17 at 11:46
  • I put that if clause to my ssh-alert file, but it does not change anything. If I do if [ "$PS1" ]; then /bin/bash else /bin/bash --login fi I have the same problem. And if i swap it --login wont be executed. – Scrumplex Feb 6 '17 at 12:05
  • Can you try something like this: [[ $- == *i* ]] && echo 'Interactive' || echo 'Not interactive' (from Unix). – Jakuje Feb 6 '17 at 12:08
  • So after some testing I came to the conslusion, that the problem is not the output. It is the ForceCommand itself. If I just do /bin/bash it does not work either. I just decided to not use ForceCommand and just put the ssh-alert command to my .bash_profile. – Scrumplex Feb 6 '17 at 12:24
0

If ForceCommand is run by sshd, then the daemon drops any further action with this session. It will never check if it's sftp and if it needs an "sftp subsystem". SFTP session cannot talk to bash, this is what ssh and scp are for.

For SFTP to work, the ForceCommand script should in the end exec the /usr/lib/openssh/sftp-server or some similar handler.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.