I don't even know if this is possible but I thought I'd ask anyays!

I'm wondering, is it possible to run a script immediately after a SSH login? My thought is to make a python script that executes immediately once a user logs in requiring user input (such as typing in a password). If validation fails then it quits the users session.

This would also be handy for logging connections (sending email alerts).

EC2 is fantastic but if someone gets a hold of my private key then can then access the servers. I know there is ways to prevent random access with strong security groups and port changing, but hey, a password trap on login can't hurt!

Anyone know if this might be possible?

migrated from stackoverflow.com Mar 25 '13 at 0:11

This question came from our site for professional and enthusiast programmers.

  • You can configure sshd to require a password in addition to a public key (two factor authentication). It's best to ask this sort of question on ServerFault.com or SuperUser.com. – dave4420 Mar 24 '13 at 22:22
  • 2
    Does this actually have anything to do with EC2? – phs Mar 24 '13 at 22:24
  • I would suggest a different title, like secure agent ssh login or something similar. – DigitalRoss Mar 24 '13 at 22:45

Well, first of all, just put a passphrase on your private key with ssh-keygen -p.

Then, there are several ways to get control after login.

Putting a passphrase on the private key doesn't work terribly well for an agent that logs in under program control. In those cases, it's best to dedicate a login account for the agent (that is, don't use your interactive-capable one) and then force it to do one and only one thing via the second or third method.

1. In this case you need to secure all shell startup files from the agent user. This can be tricky. The system or the shell may object if you try the obvious thing of making them owned by root. This is generally the more dangerous approach.

  • BTW, one reason #2 and #3 are easier to secure is this: scp is a sort of subcommand and it's blocked by forcecommand and command=. This prevents a compromised agent from just rewriting the security files. – DigitalRoss Mar 24 '13 at 23:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.