I have a CentOS 5.7 VPS using bash as its shell that displays a branded greeting immediately after logging in via SSH. I've been trying to modify it, but can't seem to find where it is in the usual places. So far I've looked in the motd file and checked sshd_config for banner file settings. A banner file is not set.
Where else can I look for where the login message might be?
Traditional unix systems display /etc/motd after the user is successfully authenticated and before the user's shell is invoked. On modern systems, this is done by the pam_motd PAM module, which may be configured in /etc/pam.conf or /etc/pam.d/* to display a different file.
The ssh server itself may be configured to print /etc/motd if the PrintMotd option is not turned off in /etc/sshd_config. It may also print the time of the previous login if PrintLastLog is not turned off.
Another traditional message might tell you whether that You have new mail or You have mail. On systems with PAM, this is done by the pam_mail module. Some shells might print a message about available mail.
After the user's shell is launched, the user's startup files may print additional messages. For an interactive login, if the user's login shell is a Bourne-style shell, look in /etc/profile, ~/.profile, plus ~/.bash_profile and ~/.bash_login for bash. For an interactive login to zsh, look in /etc/zprofile, /etc/zlogin, /etc/zshrc, ~/.zprofile, ~/.zlogin and ~/.zshrc. For an interactive login to csh, look in /etc/csh.login and ~/.login.
If the user's login shell is bash and this is a non-interactive login, then bash executes ~/.bashrc (which is really odd, since ~/.bashrc is executed for interactive shells only if the shell is not a login shell). This can be a source for trouble; I recommend including the following snippet at the top of ~/.bashrc to bail out if the shell is not interactive:
if [[ $- != *i* ]]; then return; fi
.bash_profile only sends a message to yourself. Some people like to see useful or funny messages when they log in. I can't speak for your system's root account since I know neither the contents of the message nor the people and setting involved.
Commented
Feb 23, 2012 at 13:36
There are a few:
/etc/motd
/etc/issue
/etc/profile - Could echo the message
/etc/profile.d/* - Would be called from /etc/profile
Additionally
/etc/bash_bashrc
/etc/.bashrc
/etc/bashrc
$HOME/.profile
$HOME/.bashrc
You may also have to go through every program that is being called from those scripts because something like fortune could be storing the quips it's displaying in /usr/share. To isolate it you can do:
. /etc/profile
. /etc/bash.bashrc
. $HOME/.profile
. $HOME/.bashrc
On Ubuntu there is also file:
/etc/motd.tail
/etc/issue is traditionally shown before a user logs in, not after.
Commented
Feb 22, 2012 at 23:06
profile and profile.d. Alas, all four of your suggestions didn't turn up anything. I'm wondering if something custom is compiled into the bash binary... ?
Newer systems store the MOTD components in /etc/update-motd.d so that various macros can be run to customize the motd to have update information, system alerts, etc show on login.
Add your customization as another file with priority from 00 to 99
99-footer usually loads /etc/motd.tail if tacking it onto the end is sufficient and you don't want to use any of the macro items.
You could look in /etc/shell, that's where I found a message I was trying to change. It doesn't work to comment out with a "#" you just have to delete any text and add your own. Also spaces and new lines will appear as you place them in the file.
grepin/etcfor some subset of the message./too, takes forever on a 1TB disk, let me tell you... But I've never been on twitter :)