I would like to disable or change the MOTD shown on SSH login on a per-group/per-user basis. This question on SuperUser has an answer stating that I can use Match blocks in sshd_config. However, man sshd_config states:

         Only a subset of keywords may be used on the lines following a
         Match keyword.  Available keywords are AcceptEnv,
         AllowAgentForwarding, AllowGroups, AllowTcpForwarding,
         AllowUsers, AuthenticationMethods, AuthorizedKeysCommand,
         AuthorizedKeysCommandUser, AuthorizedKeysFile,
         AuthorizedPrincipalsFile, Banner, ChrootDirectory, DenyGroups,
         DenyUsers, ForceCommand, GatewayPorts, GSSAPIAuthentication,
         HostbasedAuthentication, HostbasedUsesNameFromPacketOnly,
         KbdInteractiveAuthentication, KerberosAuthentication,
         MaxAuthTries, MaxSessions, PasswordAuthentication,
         PermitEmptyPasswords, PermitOpen, PermitRootLogin, PermitTTY,
         PermitTunnel, PubkeyAuthentication, RekeyLimit,
         RhostsRSAAuthentication, RSAAuthentication, X11DisplayOffset,
         X11Forwarding and X11UseLocalHost.

And I can't see anything related to MOTD in that list. And indeed, trying to use that suggestion causes sshd to fail to start because of incorrect configuration.

So, can I do this? If so, how? From the SSH configuration or by altering whatever generates/prints the MOTD?

Altering files in /etc/update-motd.d isn't useful, since, according to man update-motd:

   Executable  scripts in /etc/update-motd.d/* are executed by pam_motd(8)
   as the root user at each login, and this information is concatenated in

(I tested this out with a script that did echo $USER. I got a root in my MOTD.)

That leaves PAM configuration. I imagine it might be possible to disable pam_motd on a per-group/user basis, but I am not sure how to do it. The last option would be to disable pam_motd altogether, and use pam_exec, but I really hope it doesn't come to that.

  • I agree with your analisys, reading manual it seems that it in not possible use Match directive with PrintMotd. Another approach could be define your own script with custom user/group output in /etc/update-motd.d, did you consider this?
    – Lety
    Oct 15, 2014 at 23:03
  • @Letizia I did. I was hoping for something involving SSH itself or via PAM, but if SSH configuration isn't an option and PAM configuration gets too complex, I'll probably add a 11-custom script and disable some of the others.
    – muru
    Oct 15, 2014 at 23:10
  • About disable motd output, did you see HUSHLOGIN_FILE directive in /etc/login.defs?
    – Lety
    Oct 24, 2014 at 20:34
  • Did you try session optional pam_exec.so seteuid /path/to/script in this context I guess PAM_USER variable value should be right.
    – Lety
    Oct 24, 2014 at 23:26
  • 1
    @Letizia I knew of per-user .hushlogin files, but not of the central one. Since apparently only one of the two can be used, and because my use case is with LDAP of 1000+ users and I'd like some freedom for the user to disable or enable motd, a central file is doubly ineffective.
    – muru
    Oct 25, 2014 at 7:52

1 Answer 1


Here is an implementation on per user/group motd inspired by motd or login banner per user

First comment out:

session    optional   pam_motd.so  motd=/run/motd.dynamic
session    optional   pam_motd.so

in /etc/pam.d/login and set PrintMotd no in /etc/ssh/sshd_config

Then you could define your per user/group message script and put it in folder, for example:

sudo mkdir -p /etc/mymotd/groups
sudo mkdir -p /etc/mymotd/users

In these folders you can create executable scripts for each groups or users that prints on standard output the message of the day.

You could create /etc/profile.d/perUserGroupMotd.sh with the follow lines:

gidName=`id -gn`
if [ -e /etc/mymotd/groups/$gidName ]; then
   if [ -e /etc/mymotd/users/$USER ]; then

or you can use file to enable/disable message and than run /path/to/script -g $gidName or /path/to/script -u $USER, obviously there are many different possible implementations.

About pam_motd, at the end I found these two bug:

For these reasons I guess is not possible to use pam_motd for your objective.

HUSHLOGIN_FILE directive in /etc/login.defs should inhibits all the usual chatter during the login sequence, so any output is suppressed even last login date.

I guess that motd is designed to reach all user in the system and because of this ssh and pam_motd simple enable or disable it for all user.

  • Suggestions: Instead of editing /etc/profile, recommend adding scripts to /etc/profile.d. Cleaner. And when you say "Another approach is write /etc/update-motd.d script ...", you mean without disabling pam_motd?
    – muru
    Oct 25, 2014 at 20:13
  • Thanks for the tip about /etc/profile.d, you're always accurate :) and sorry for pam_motd, I forgot to delete those paragraphs before posting answer :( Now I added information found that would give us an explanation of why is not possible to accomplish your target with pam_motd
    – Lety
    Oct 25, 2014 at 23:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .