Have Geek Brain

How do you write your username in field "A" after you have SSHed to Box B?

This may not be the best formulated question, but hopefully it's a simple problem.

The script is SSHing from the personal account in field A to the public account in field B. The script statement executed in block B should record the name of the personal account for logging purposes. Is there a way to capture this, either via SSH or some information captured by the shell? We are using ssh2 (Reflections) and KornShell (ksh) for Solaris.

0


a source to share


2 answers


If you have full control over the client machine, you can expand the ID to get the username.

Full procedure for getting name from script:



  • Continue process tree, find sshd
  • Run netstat -p to find the remote IP address and port.
  • Connect to the client on port 113 and ask.

You may need to disable separation of privileges for this to work as is; however, it should be trivial to modify to work without it.

+1


a source


  • Unable to register remote username
  • You can register the IP address of the connection (see the SSH_CONNECTION variable)

  • You may have a standard where they use an alias for ssh, which registers the remote username as part of the login process, or where it stores its username in a .ssh / environment file (but allows environments to be set, ssh / sshd configuration changes may be required ).

    alias sshblah = 'ssh blah "REMOTEUSER = $ USER; bash' (Except it doesn't work and I didn't try to figure out why - and it would be different if you're using tcsh, etc.).

You can use the environment passing in this way and choose which variables you allow to be set. You need to force users to set an alternative to $ USER, for example $ REMOTE_USER = $ USER, and then allow $ REMOTE_USER to pass. And you trust that you are not installing it incorrectly, or remember to install it (you can handle this a bit by changing this mechanism ).



Note that you almost have to trust the client connection to tell you who the user is - you can make it tough / annoying to spoof the username, but if you don't use per-user certificates instead of a generic login / password. which they all know, you cannot check who is connected.

0


a source






More articles:


All Articles