Hacker News Reader

Comment by jcriddle4 | Hacker News Reader

I wonder if instead they could setup a fake or jailed SSH that would let you login, it would then display helpful info about how to really enable SSH and then it would kick you out?

View on HN

You don't even need a jail for that. Just add those lines to the end of /etc/ssh/sshd_config:

  Match User pi
        AcceptEnv
        ForceCommand echo 'To enable SSH, do this and that'

EDIT: added an explicit empty "AcceptEnv".

Allowing untrusted users to run programs is a recipe for disaster. Forcecommand runs its commands using a login shell that gets a lot of information from the connecting user. It wouldn't be the first time someone found an obscure environment variable that turns this into a remote shell.

part of this can be done with openSSH by setting the banner option in sshd_config.

"Banner The contents of the specified file are sent to the remote user before authentication is allowed. If the argument is ``none'' then no banner is displayed. By default, no banner is displayed."

Given that you can specify a "shell" on SSH login, it's definitely possible.

To people who might experiment with this: Be careful! A teenager me, two decades ago, changed the shell of a system account to a joke program, and I didn't know they could suspend that joke and grab a system subshell. Then again, learning one the hard way every now and then is a great way to boost your working memory.

Reply on news.ycombinator.com