SSH client option to suppress server banners?

Question

I've read Stop ssh login from printing motd from the client?, however my situation is a bit different :

I want to keep Banner /path/to/sometxt serverside
I would like to pass an option under specific conditions so that Banner is not printed (eg ssh -o "PrintBanner=No" someserver).

Any idea?

score 57 · Answer 1 · answered Nov 19 '15 at 18:49

57

There is a LogLevel option:

It silences the banner but you're still able to receive errors:

$ ssh -o LogLevel=error localhost 
Permission denied (publickey).

answered Nov 19 '15 at 18:49

Tiago Lopo

699
6
5

Didn't work with OpenSSH 6.9 client - perhaps version information would be useful? – Zayne S Halsall Apr 11 '16 at 09:01
Works with OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.3, OpenSSL 1.0.1f 6 Jan 2014 – Kulbir Saini May 17 '16 at 19:31

score 11 · Answer 2 · answered Dec 18 '17 at 22:46

11

Update ~/.ssh/config with following to suppress banner

Host *
    LogLevel error

answered Dec 18 '17 at 22:46

Sashi Kant

111
1
2

1

I believe the "Host *" line is either redundant or incorrect. At any rate, I get the desired effect without it. Altho it should be noted that OP wanted to get the effect under certain programmatic conditions, in which case the command line option listed above is the better solution. – UncaAlby Dec 26 '17 at 23:41

score 9 · Answer 3 · edited Jan 15 '15 at 04:51

9

I 've tested it, I think u can use -q in the ssh command. Parameter -q was means Quiet mode. It causes most warning and diagnostic messages to be suppressed, e.g.

ssh -t '$node2' 'sudo cat xxx' |grep xxxxx" 2>/dev/null >/root/node2

or

ssh -t -q '$node2' 'sudo cat xxxx' |grep xxx" >/root/node2

Hope this can help others

edited Jan 15 '15 at 04:51

masegaloeh

17,978
9
56
104

answered Jan 15 '15 at 04:38

gray13

111
1
1

-q didn't work from a Fedora 22 client to Centos 6 and Suse 2.6 (client was OpenSSH 6.9. Maybe this answer would be upvoted if it referenced specific ssh version? – Zayne S Halsall Apr 11 '16 at 09:00

score 7 · Answer 4 · answered Oct 02 '17 at 23:50

Seems like you're looking for -q:

Quiet mode. Causes most warning and diagnostic messages to be suppressed.

ssh user@host
*------------------------------------------------------------------------------*
| banner: blah                                                                 |
*------------------------------------------------------------------------------*
Last login: Mon Oct  2 16:40:01 2017 from ipAddress
$

With -q

ssh -q user@host
Last login: Mon Oct  2 16:40:30 2017 from ipAddress
$

Nice and quiet. The banner is still configured but you're not bothered by it.

On another note: don't use banners. It's best not to confirm or deny anything. It won't help you with the people you weren't worried about and the people you are worried about will laugh as they work past it ;-)

score 4 · Answer 5 · answered Jun 27 '13 at 17:22

4

You should be able to set a different Banner (to none) inside a Match block.

For instance:

Match Address 192.0.2.0/24
        Banner none

But this has to be done server-side, based on specific conditions. You can't do it from the client side.

answered Jun 27 '13 at 17:22

Michael Hampton

237,123
42
477
940

score 2 · Answer 6 · answered May 22 '19 at 13:08

For me, -o LogLevel=error was better than -q, because the latter suppresses the important error information (which you can then obtain only via exit code).

Compare this (without options): [root@myserver804 myuser1]# ssh targetserver1; echo "exit code=$?" @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! Someone could be eavesdropping on you right now (man-in-the-middle attack)! It is also possible that a host key has just been changed. The fingerprint for the RSA key sent by the remote host is SHA256:hvtR8Dl09aUeCeG2cT5EA8b+nbCOoV6h1DUON2vE63w. Please contact your system administrator. Add correct host key in /root/.ssh/known_hosts to get rid of this message. Offending RSA key in /root/.ssh/known_hosts:1735 RSA host key for targetserver1 has changed and you have requested strict checking. Host key verification failed. exit code=255

with this (quiet) [root@myserver804 myuser1]# ssh -q targetserver1; echo "exit code=$?" exit code=255

with this (only log errors) [root@myserver804 myuser1]# ssh -o LogLevel=error targetserver1; echo "exit code=$?" @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! Someone could be eavesdropping on you right now (man-in-the-middle attack)! It is also possible that a host key has just been changed. The fingerprint for the RSA key sent by the remote host is SHA256:hvtR8Dl09aUeCeG2cT5EA8b+nbCOoV6h1DUON2vE63w. Please contact your system administrator. Add correct host key in /root/.ssh/known_hosts to get rid of this message. Offending RSA key in /root/.ssh/known_hosts:1735 RSA host key for targetserver1 has changed and you have requested strict checking. Host key verification failed. exit code=255

So the conclusion is - if you are still interested in relevant errors, use -o LogLevel=error

"-q" is definetly not a good option indeed :) – Clément Moulin - SimpleRezo Apr 19 '22 at 09:55 — Clément Moulin - SimpleRezo, Apr 19 '22 at 09:55

score 1 · Answer 7 · answered Oct 17 '19 at 14:08

1

Neither the -q or the -oLogLevel=error works.

What does work is to suppress STDERR

ssh hostname command 2>/dev/null

The downside, however, is that the STDERR suppression is applied to the entire command and not just the SSH program.

answered Oct 17 '19 at 14:08

Aethalides

139
4

score 0 · Answer 8 · answered Feb 09 '22 at 18:07

0

On a user basis you can suppress server banners by creating an empty file in a user's $HOME directory (/home/username/) called .hushlogin.

touch ~/.hushlogin

answered Feb 09 '22 at 18:07

tomy

101

does not work for banner served prior to login. – mckenzm Mar 29 '22 at 03:18

score 0 · Answer 9 · answered Jun 08 '22 at 15:41

0

Try:

ssh -q

my ssh conections, do not get a banner message.

answered Jun 08 '22 at 15:41

Marcelo Guedes

141
6

score -1 · Accepted Answer · answered Jun 13 '13 at 17:04

-1

You can't. (At least not with stock OpenSSH)

The server banner is sent by the server before authentication happens. It's point is usually to contain a legal disclaimer or similar "If you're not authorized disconnect NOW" type message, or other critical things you don't want the remote user to be able to suppress/ignore.

If you really want to get rid of this you will need to hack and compile your own customized version of the SSH client.

answered Jun 13 '13 at 17:04

voretaq7

79,345
17
128
213

24

This is old information and no longer true on common distributions. The answers below to use either `-q` or `-o LogLevel=error` work great now :-) – Dogsbody Nov 28 '15 at 19:49

score -2 · Answer 11 · answered Jun 13 '13 at 16:57

-2

Just call a shell, that should suppress the banner.

ssh you@someplace.com /bin/bash

Note though, for me at least, my $PS1 doesn't get set, so it looks like it's hanging. I had to type a couple of commands to verify that it was working.

answered Jun 13 '13 at 16:57

chrskly

1,539
11
16

1

This won't suppress banners shown by the `Banner` option in `/etc/sshd_config` (at least it doesn't on FreeBSD / OpenSSH_5.8p2) – voretaq7 Jun 13 '13 at 17:06
Ah, I saw motd in the question. That'll learn me to read the description properly ;) – chrskly Jun 13 '13 at 17:21

score -2 · Answer 12 · answered Jul 06 '16 at 08:04

-2

For me -q did the trick and I was still able to work with the output saved to a file.

ssh -q root@server28 "ls -alF /dr_mksysb |egrep -v \"total|lost+found|./|../\" |awk '{print \$NF}' |sed 's/.\$//g'" > ${basedir}/28.list

answered Jul 06 '16 at 08:04

Zatarra

407
3
5

Great that it works for you. Nevertheless this doesn't answer the question and should be a comment at most. – Gerald Schneider Jul 06 '16 at 08:12
That's the problem, it does answer the question, I got rid of motd (banner) I had exactly the same problem as stated in the question – Zatarra Jul 06 '16 at 09:03
The only part of your answer that relates to the question is the `-q` parameter. The rest is completely unrelated and is only helpful to you. The parameter has already been given as an answer, so feel free to upvote it if it helped you, but this "answer" will only receive downvotes – Gerald Schneider Jul 06 '16 at 09:12

SSH client option to suppress server banners?

12 Answers12