What are the different ways that a message can be displayed to a bash shell after a user logs in?

Question

I have a CentOS 5.7 VPS using bash as its shell that displays a branded greeting immediately after logging in via SSH. I've been trying to modify it, but can't seem to find where it is in the usual places. So far I've looked in the motd file and checked sshd_config for banner file settings. A banner file is not set.

Where else can I look for where the login message might be?

Solution 1

Traditional unix systems display /etc/motd after the user is successfully authenticated and before the user's shell is invoked. On modern systems, this is done by the pam_motd PAM module, which may be configured in /etc/pam.conf or /etc/pam.d/* to display a different file.

The ssh server itself may be configured to print /etc/motd if the PrintMotd option is not turned off in /etc/sshd_config. It may also print the time of the previous login if PrintLastLog is not turned off.

Another traditional message might tell you whether that You have new mail or You have mail. On systems with PAM, this is done by the pam_mail module. Some shells might print a message about available mail.

After the user's shell is launched, the user's startup files may print additional messages. For an interactive login, if the user's login shell is a Bourne-style shell, look in /etc/profile, ~/.profile, plus ~/.bash_profile and ~/.bash_login for bash. For an interactive login to zsh, look in /etc/zprofile, /etc/zlogin, /etc/zshrc, ~/.zprofile, ~/.zlogin and ~/.zshrc. For an interactive login to csh, look in /etc/csh.login and ~/.login.

If the user's login shell is bash and this is a non-interactive login, then bash executes ~/.bashrc (which is really odd, since ~/.bashrc is executed for interactive shells only if the shell is not a login shell). This can be a source for trouble; I recommend including the following snippet at the top of ~/.bashrc to bail out if the shell is not interactive:

if [[ $- != *i* ]]; then return; fi

Solution 2

There are a few:

/etc/motd
/etc/issue
/etc/profile - Could echo the message
/etc/profile.d/* - Would be called from /etc/profile

Additionally

/etc/bash_bashrc
/etc/.bashrc
/etc/bashrc
$HOME/.profile
$HOME/.bashrc

You may also have to go through every program that is being called from those scripts because something like fortune could be storing the quips it's displaying in /usr/share. To isolate it you can do:

. /etc/profile
. /etc/bash.bashrc
. $HOME/.profile
. $HOME/.bashrc

On Ubuntu there is also file:

/etc/motd.tail

Solution 3

Newer systems store the MOTD components in /etc/update-motd.d so that various macros can be run to customize the motd to have update information, system alerts, etc show on login.

Add your customization as another file with priority from 00 to 99

99-footer usually loads /etc/motd.tail if tacking it onto the end is sufficient and you don't want to use any of the macro items.

Solution 4

You could look in /etc/shell, that's where I found a message I was trying to change. It doesn't work to comment out with a "#" you just have to delete any text and add your own. Also spaces and new lines will appear as you place them in the file.

View more solutions

Comments

[Admin]

You could try a recursive grep in /etc for some subset of the message.

[Admin]

@Kevin Wait, are you following me on twitter? I just mused that I was using grep -r to find something. Except I'm a doofus and decided to start at / =)

[Admin]

I've started at / too, takes forever on a 1TB disk, let me tell you... But I've never been on twitter :)

[Admin]

@WesleyDavid can you post a screenshot?

[clerksx]

/etc/issue is traditionally shown before a user logs in, not after.

[Wesley]

Thanks! Didn't know about profile and profile.d. Alas, all four of your suggestions didn't turn up anything. I'm wondering if something custom is compiled into the bash binary... ?

[Karlson]

@ChrisDown Right but I am not aware of any system that would be putting anything on the screen after prompt is displayed.

[Karlson]

@WesleyDavid I've amended the answer.

[Wesley]

It was a series of echos in my .bash_profile. >_< This question is extraneous to the original, but: Doesn't echoing things in .bash_profile seem like a poor way of sending a message? Maybe it's better if you only want to send messages to a single user. This is, after all, the root account. Then again, I'm a noob so I'm not in a position to judge things too critically.

[Wesley]

Thanks so much for all of the information! This has given me much in the way of learning the various ways that shells can send information to TTY sessions. =)

[Gilles 'SO- stop being evil']

@WesleyDavid Echoing something in .bash_profile only sends a message to yourself. Some people like to see useful or funny messages when they log in. I can't speak for your system's root account since I know neither the contents of the message nor the people and setting involved.

[dmgig]

Putting a message in /etc/motd worked on Mac OS X, which is all I needed. Thanks for that.