EC2 - run a script immediately after ssh login?

Question

I don't even know if this is possible but I thought I'd ask anyays!

I'm wondering, is it possible to run a script immediately after a SSH login? My thought is to make a python script that executes immediately once a user logs in requiring user input (such as typing in a password). If validation fails then it quits the users session.

This would also be handy for logging connections (sending email alerts).

EC2 is fantastic but if someone gets a hold of my private key then can then access the servers. I know there is ways to prevent random access with strong security groups and port changing, but hey, a password trap on login can't hurt!

Anyone know if this might be possible?

Answer 1

Well, first of all, just put a passphrase on your private key with ssh-keygen -p.

Then, there are several ways to get control after login.

• One is via a per-user shell startup file or the /etc shell startup file that some shells have.¹
• Another way (won't work in old OpenSSH) is to use the forcecommand option in sshd_config.
• Yet another way is to use the command= option in the authorized_keys file.

Putting a passphrase on the private key doesn't work terribly well for an agent that logs in under program control. In those cases, it's best to dedicate a login account for the agent (that is, don't use your interactive-capable one) and then force it to do one and only one thing via the second or third method.

---

^{1. In this case you need to secure all shell startup files from the agent user. This can be tricky. The system or the shell may object if you try the obvious thing of making them owned by root. This is generally the more dangerous approach.}