You can use PAM for this. The PAM configuration for the SSH service is in
/etc/pam.d/sshd. To run a command before anything in the login process, add something like:
auth [default=ignore] pam_exec.so /path/to/some/script
For example, if I use
cat <<EOF >>/tmp/log
And then I do
ssh muru@localhost, I get:
$ cat /tmp/log
This doesn't happen before the password prompt shows up, but
auth modules are the first ones run after the password is entered - they check whether the user is authenticated, after all:
authentication - authenticate a user and set up user credentials.
Typically this is via some challenge-response request that the user
must satisfy: if you are who you claim to be please enter your
password. Not all authentications are of this type, there exist
hardware based authentication schemes (such as the use of smart-cards
and biometric devices), with suitable modules, these may be substituted
seamlessly for more standard approaches to authentication - such is the
flexibility of Linux-PAM.
So, in effect,
auth modules run before login, and if the first
auth module is
pam_exec, that's pretty much the first thing to run.
[default=ignore] part - since
auth modules authenticate the user, we don't want the script's exit status to mean anything.
default=ignore tells PAM to ignore
pam_exec's return value, whatever it may be, which in turn depends on the script's exit status. See
man pam.d for more details.
- This doesn't run if the user just quit before entering any password.
- This doesn't run if the user provided an empty password (the default SSH configuration has
PermitEmptyPasswords no, so SSH rejects those out of hand).
- SSH needs to have
UsePAM yes for it to use PAM.