3

This is in reference to this question.

I wanted to log everytime someone logged in via ansible.

I put my script in ~/.bash_profile file. Here is the script,

#!/bin/bash

now=$(date +"%T")
echo "$USER logged in at: $now" >> /home/alphauser/ssh-entries.log

I put this at the end of ~/.bash_profile,

bash ~/ssh-login-entry.sh

However, ansible uses the non-interactive shell, so my script was not executed when I logged in via ansible as ~/.bash_profile is executed only when a new interactive shell is started.

Then I pasted this at the end of .bashrc file, but still it did not work.

How can I log entries when someone logs in via non-interactive shell ? I mean where should I place this script so that it should be executed everytime someone logs in via ansible ?

I hope the question is clear.

16
  • bash_profile is for login-non-interactive shells. use ~/.bashrc for non-login shells
    – Camden
    Jul 18, 2017 at 13:45
  • yes that is what I know. please check my edit
    – luv.preet
    Jul 18, 2017 at 13:47
  • 2
    Regardless, it may well cause problems. If you insist on using .bash_profile, then I suggest you at least copy the code from .profile into it. But I don't know if that will prevent all possible issues...
    – Zanna
    Jul 18, 2017 at 14:04
  • 2
    Is the system auth.log file (in /var/log) not useful for this?
    – Thomas Ward
    Jul 18, 2017 at 20:42
  • 1
    @Zanna there's no reason not to use .bash_profile, it's just not relevant here because the OP is running a non-interactive shell. Basically, if .bash_profile exists, then .profile is ignored by bash. But that's no reason not to use it. Especially if you want to have separate settings for different shells (~/.bash_profile is only read by bash while ~/.profile is read by most or all login shells).
    – terdon
    Jul 19, 2017 at 14:07

2 Answers 2

1

When bash is started as a non-interactive shell, it doesn't read any startup files. Instead, it looks for the environment variable $BASH_ENV and, if that points to a file, reads whatever it points to. This is explained in the INVOCATION section of man bash:

When bash is started non-interactively, to run a shell script, for example, it looks for the variable BASH_ENV in the environment, expands its value if it appears there, and uses the expanded value as the name of a file to read and execute. Bash behaves as if the following com‐ mand were executed:

if [ -n "$BASH_ENV" ]; then . "$BASH_ENV"; fi    

but the value of the PATH variable is not used to search for the file‐
name.

So, if you set BASH_ENV to point to a file containing your command, it should work:

  1. Edit /etc/environment to set BASH_ENV for all users. Open the file in your favorite editor and add this line:

    export BASH_ENV="/path/to/your/file"
    
  2. Create /path/to/your/file with the following contents:

    printf '%s logged in at: %s\n' "$USER" "$(date +'%T')" >> /home/alphauser/ssh-entries.log
    

Now try logging in via ansible again.

Important: I have no experience with ansible, so I am not entirely sure how you log in using it. This assumes that you first start a normal login shell and then run the ansible command. If not, it will probably fail. If this doesn't work, please edit your question and give more information about how you log in through ansible.

4
  • One thing is for sure, ansible uses non-interactive shell. I did as you said. But it did not work. However, After running ansible playbook, I login via ssh and then ran echo $BASH_ENV and it returned nothing.
    – luv.preet
    Jul 19, 2017 at 19:39
  • @luv.preet no, ssh is another special case. What does ssh have to do with it? You don't mention it in your question.
    – terdon
    Jul 19, 2017 at 22:00
  • Nothing to do with ssh. But it should echo out the name of the variable when I run echo $BASH_ENV, shouldn't it ?
    – luv.preet
    Jul 20, 2017 at 6:42
  • @luv.preet yes, but only if you single quote it to protect from the current shell: ssh user@host echo '$BASH_ENV'.
    – terdon
    Jul 20, 2017 at 8:51
0

All log-ins, interactive and non-interactive, local and remote are logged to /var/log/auth.log. I suggest you use that instead of messing with profile start-up files that the audited user account can modify.

2
  • Thanks david. I knew this, but I just needed a separate file for ansible logins.
    – luv.preet
    Jul 19, 2017 at 19:21
  • Can't you filter the log file for specific log-in types? I don't use Ansible myself. Maybe you can provide a log file excerpt after an Ansible log in and I can help you how to distinguish it from other log entries. Jul 19, 2017 at 23:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .