How to capture your username on Box A after you have ssh’d onto Box B?

Question

Hi,

Maybe not the best worded question, but hopefully it's a straightforward problem.

The scenario is ssh'ing from a personal account on box A to a generic account on box B. The script running on box B needs to capture the personal account name for logging purposes. Is there any way of capturing this, either via ssh itself or some information captured by the shell? We are using ssh2 (Reflections), and Korn shell on Solaris.

Thanks!

Answer 1

• You can't log the remote username reliably
• You can log the IP of the connection (see the SSH_CONNECTION variable)

• You could have a standard where they use an alias for ssh that logs the remote username as part of the login process, or where they store their username in a .ssh/environment file (but allowing environments to be set may require ssh/sshd config changes).

  alias sshblah='ssh blah "REMOTEUSER=$USER; bash' (Except that doesn't work, and I haven't tried to figure out why - and it would be different if you use tcsh, etc).

You can use environment passing in this manner, and select which variables you allow to be set. You'd have to get the users to set some alternate to $USER, like $REMOTE_USER=$USER, and then allow $REMOTE_USER to pass through. And you're trusting they don't set it incorrectly, or forget to set it (you can handle that case with a little annoyance by modifying this mechanism).

Note that you almost have to trust the client connecting to tell you who the user is - you can make it hard/annoying to spoof the username, but unless you use per-user certificates instead of a generic login/password they all know, you can't verify who connected.

Answer 2

If you have full control of the client machine, you can deploy identd to get the username.

Full procedure to get name from script:

1. Walk up process tree, find sshd
2. Walk netstat -p to find the remote IP and port.
3. Connect to client on port 113 and ask.

You may have to disable privilege separation for this to work as-is; however it should be trivial to modify to work w/o it.